www.cybereason.com Open in urlscan Pro
45.60.62.106 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Submission: On December 30 via api (December 30th 2024, 7:46:58 am UTC) from DE — Scanned from US

Summary HTTP 117 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 32 IPs in 2 countries across 25 domains to perform 117 HTTP transactions. The main IP is 45.60.62.106, located in United States and belongs to INCAPSULA, US. The main domain is www.cybereason.com. The Cisco Umbrella rank of the primary domain is 996259.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on May 2nd 2024. Valid for: a year.

This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
49	45.60.62.106 45.60.62.106	19551 (INCAPSULA) (INCAPSULA)
9	2600:1408:ec0... 2600:1408:ec00:43::1737:b053	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2607:f8b0:400... 2607:f8b0:4004:c08::5f	15169 (GOOGLE) (GOOGLE)
1	2600:1408:ec0... 2600:1408:ec00:1e::1735:23ec	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2606:4700:440... 2606:4700:4400::6812:297c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:4004:c1d::5f	15169 (GOOGLE) (GOOGLE)
8	172.253.122.94 172.253.122.94	15169 (GOOGLE) (GOOGLE)
2	157.240.229.1 157.240.229.1	32934 (FACEBOOK) (FACEBOOK)
2	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
5	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:440... 2606:4700:4400::6812:28f0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8c11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4004:c1f::61	15169 (GOOGLE) (GOOGLE)
1	2600:1408:ec0... 2600:1408:ec00:43::1737:b058	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:8bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.160.18.68 18.160.18.68	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:600... 2a04:4e42:600::644	54113 (FASTLY) (FASTLY)
1	18.160.10.55 18.160.10.55	16509 (AMAZON-02) (AMAZON-02)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	99.84.188.56 99.84.188.56	16509 (AMAZON-02) (AMAZON-02)
1	13.249.39.126 13.249.39.126	16509 (AMAZON-02) (AMAZON-02)
2	18.160.18.96 18.160.18.96	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:200... 2600:9000:2009:7e00:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c06::8a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c09::9d	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1d::9b	15169 (GOOGLE) (GOOGLE)
117	32

49 45.60.62.106 (United States)

ASN19551 (INCAPSULA, US)

www.cybereason.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2600:1408:ec00:43::1737:b053 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::5f (Washington, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:ec00:1e::1735:23ec (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:297c (United States)

ASN13335 (CLOUDFLARENET, US)

7052064.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1d::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.253.122.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.229.1 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:28f0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8c11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1f::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:ec00:43::1737:b058 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:8bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.18.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-18-68.iad12.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::644 (United States)

ASN54113 (FASTLY, US)

fast.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.10.55 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-10-55.iad12.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.188.56 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-99-84-188-56.iad89.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.249.39.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-249-39-126.iad89.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.160.18.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-18-96.iad12.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2009:7e00:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::8a (Washington, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::9d (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1d::9b (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
49	cybereason.com www.cybereason.com — Cisco Umbrella Rank: 996259	3 MB
10	typekit.net use.typekit.net — Cisco Umbrella Rank: 460 p.typekit.net — Cisco Umbrella Rank: 571	142 KB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	150 KB
8	gstatic.com fonts.gstatic.com	248 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5921 js.hubspot.com — Cisco Umbrella Rank: 3653 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3677 track.hubspot.com — Cisco Umbrella Rank: 2477 forms.hubspot.com — Cisco Umbrella Rank: 6196	29 KB
5	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415 fonts.googleapis.com — Cisco Umbrella Rank: 29	94 KB
4	company-target.com 1 redirects s.company-target.com — Cisco Umbrella Rank: 1549 segments.company-target.com — Cisco Umbrella Rank: 1655 api.company-target.com — Cisco Umbrella Rank: 4358	2 KB
3	driftt.com js.driftt.com — Cisco Umbrella Rank: 7118	62 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182	556 B
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 854	771 B
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 6210 tag-logger.demandbase.com — Cisco Umbrella Rank: 5387	18 KB
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2580	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	269 KB
2	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2343	27 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1634	27 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	75 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	11 KB
1	google.com analytics.google.com — Cisco Umbrella Rank: 142
1	wistia.com fast.wistia.com — Cisco Umbrella Rank: 4773	145 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514	309 B
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 3819	957 B
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5955	92 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2358	25 KB
1	hubspotusercontent-na1.net 7052064.fs1.hubspotusercontent-na1.net — Cisco Umbrella Rank: 20850	2 KB
1	linkedin.com platform.linkedin.com — Cisco Umbrella Rank: 3945	160 KB
117	25

	Domain	Requested by
49	www.cybereason.com	www.cybereason.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org
9	use.typekit.net	www.cybereason.com
8	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	www.cybereason.com
3	js.driftt.com	www.cybereason.com js.driftt.com
2	segments.company-target.com	1 redirects
2	id.rlcdn.com	2 redirects
2	js.hs-scripts.com	www.googletagmanager.com
2	www.googletagmanager.com	www.cybereason.com www.googletagmanager.com
2	js.hs-banner.com	www.cybereason.com js.hs-banner.com
2	platform.twitter.com	www.cybereason.com platform.twitter.com
2	connect.facebook.net	www.cybereason.com connect.facebook.net
2	cdnjs.cloudflare.com	www.cybereason.com
1	td.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	tag-logger.demandbase.com	tag.demandbase.com
1	api.company-target.com	tag.demandbase.com js.driftt.com
1	s.company-target.com	tag.demandbase.com
1	tag.demandbase.com	www.cybereason.com
1	fast.wistia.com	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	forms.hubspot.com	js.hsleadflows.net
1	track.hubspot.com
1	perf-na1.hsforms.com	www.cybereason.com
1	p.typekit.net	www.cybereason.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	js.hubspot.com	www.cybereason.com
1	js.hsleadflows.net	www.cybereason.com
1	js.hs-analytics.net	www.cybereason.com
1	app.hubspot.com	www.cybereason.com
1	7052064.fs1.hubspotusercontent-na1.net	www.cybereason.com
1	platform.linkedin.com	www.cybereason.com
1	ajax.googleapis.com	www.cybereason.com
117	35

This site contains links to these domains. Also see Links.

Domain
www.trendmicro.com
rclone.org
www.bleepingcomputer.com
symantec-enterprise-blogs.security.com
securityintelligence.com
twitter.com
yoroi.company
docs.microsoft.com
www.virustotal.com
nest.cybereason.com
attack.mitre.org
www.facebook.com
www.linkedin.com
www.youtube.com
www.instagram.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
*.cybereason.com GeoTrust TLS RSA CA G1	`2024-05-02` - `2025-05-17`	a year	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-10` - `2026-01-10`	a year	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2024-03-29` - `2025-03-28`	a year	crt.sh
hubspotusercontent-na1.net WE1	`2024-12-25` - `2025-03-26`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-08` - `2025-01-06`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
hubspot.com WE1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
hs-analytics.net WE1	`2024-12-05` - `2025-03-05`	3 months	crt.sh
hs-banner.com WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
hsleadflows.net WE1	`2024-11-27` - `2025-02-25`	3 months	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
hsforms.com WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh
cookielaw.org WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
hs-scripts.com WE1	`2024-11-24` - `2025-02-22`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
drift.com Amazon RSA 2048 M03	`2024-07-30` - `2025-08-27`	a year	crt.sh
fast.wistia.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
*.company-target.com R10	`2024-12-13` - `2025-03-13`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
tag-logger.demandbase.com Amazon RSA 2048 M02	`2024-12-13` - `2026-01-11`	a year	crt.sh
*.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Frame ID: 4A23B1FCF32CABDE5202027EBD8E9E87
Requests: 113 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: D4465DF4AED94C314734392E6182B81C
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 11161B6526926D2B77DD9958417FDF84
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=zdcd6x8yhg85&eId=zdcd6x8yhg85&region=US&forceShow=false&skipCampaigns=false&sessionId=cd111197-63e9-4d04-9713-e647c211639e&sessionStarted=1735544816.08&campaignRefreshToken=a1c6c942-64b3-433f-b60e-022cfb1f75ce&hideController=false&pageLoadStartTime=1735544812072&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Frame ID: 39F3F2AFCAE7CDAD5380A636FC59FC0A
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1735544812072
Frame ID: 605D1A1491B4C6BFE8B6C80607DF1A8D
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-PZ3FE06790&gacid=705380323.1735544817&gtm=45je4cc1v893336776z8830287785za200zb830287785&dma=0&gcs=G111&gcd=13r3r3r3r5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=803723319
Frame ID: D8FE19589C550F5789463EE76983FDA6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

117
Requests

98 %
HTTPS

59 %
IPv6

25
Domains

35
Subdomains

32
IPs

2
Countries

4232 kB
Transfer

8249 kB
Size

36
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti
Title: TrendMicro reported

Search URL Search Domain Scan URL

URL: https://rclone.org/
Title: Rclone

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/new-ryuk-info-stealer-targets-government-and-military-secrets/
Title: Ryuk Stealer

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration
Title: Exmatter

Search URL Search Domain Scan URL

URL: https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/
Title: LockBit 2.0

Search URL Search Domain Scan URL

URL: https://twitter.com/intel_by_kela/status/1406905385580118017
Title: KELA

Search URL Search Domain Scan URL

URL: https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/
Title: Previous research

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa
Title: LoadLibraryExA

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindowexw
Title: CreateWindowExW

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-features
Title: child

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/fileio/i-o-completion-ports
Title: I/O completion port threading model

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/mswsock/nc-mswsock-lpfn_transmitpackets
Title: TransmitPackets

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsaioctl
Title: WSAIoctl

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
Title: FILE_ATTRIBUTE_SYSTEM

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwreadfile
Title: ZwReadFile

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-shellexecuteexw
Title: ShellExecuteExW

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d/details
Title: 3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636/detection
Title: 107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/6c9a92955402c76ab380aa6927ad96515982a47c05d54f21d67603814d29e4a5/details
Title: 6c9a92955402c76ab380aa6927ad96515982a47c05d54f21d67603814d29e4a5

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/6b9aa479a5f9c6bfee52046c1afa579977dfcde868fdad3f18fdcd1779535068
Title: 6b9aa479a5f9c6bfee52046c1afa579977dfcde868fdad3f18fdcd1779535068

Search URL Search Domain Scan URL

URL: https://nest.cybereason.com/documentation/product-documentation/190/anti-malware-settings
Title: Detect and Prevent modes

Search URL Search Domain Scan URL

URL: https://nest.cybereason.com/knowledgebase/4580181
Title: available on the NEST

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1106/
Title: Native API

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1548/002/
Title: Abuse Elevation Control Mechanism: Bypass User Account Control

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1070/004/
Title: Indicator Removal on Host: File Deletion

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1083/
Title: File and Directory Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1030/
Title: Data Transfer Size Limits

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1559/
Title: Inter-Process Communication

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1027/
Title: Obfuscated Files or Information

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1082/
Title: System Information Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1041/
Title: Exfiltration Over C2 Channel

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1564/003/
Title: Hide Artifacts: Hidden Window

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1614/
Title: System Location Discovery

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&utm_medium=social&utm_source=twitter&url=https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&utm_medium=social&utm_source=twitter&source=tweetbutton&text=

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&utm_medium=social&utm_source=facebook

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&utm_medium=social&utm_source=linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Cybereason/

Search URL Search Domain Scan URL

URL: https://twitter.com/cybereason

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCOm7AaB0HiNH4Phe66sK0Ew

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cybereason

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cybereason

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 107

https://id.rlcdn.com/464526.gif HTTP 307
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCPCfybsGEgUI6AcQAEIASgA HTTP 307
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo HTTP 303
https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo&verifyHash=984cad0eb18620cd8770fcbdfd49627c01b2c6ca

117 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool Show response
www.cybereason.com/blog/research/ 121 KB
28 KB 285ms
161ms Document
text/html 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1d83417f3cc0bf5a3047f5b463b7abddb9a1aacdd94d54d5d6c4ef95e261426

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=10800, max-age=0
cf-ray: 8fa06b224e0df7c9-LAX
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 30 Dec 2024 07:46:51 GMT
edge-cache-tag: CT-62011966600,CT-71732723873,CT-93542865026,CG-3354902,CG-5272851739,P-3354902,L-42870461961,CW-34473990280,CW-41681847227,CW-41682410610,CW-42867014566,CW-43300360745,CW-44252461159,CW-86933076631,E-34470223313,E-34470224480,E-34470477360,E-35275979682,E-35291999472,E-42363645447,E-42507089303,E-42507091846,E-42760289143,PGS-ALL,SW-0,B-5272851739,GC-36042052587
last-modified: Sun, 29 Dec 2024 10:34:02 GMT
link: </hs/hsstatic/content-cwv-embed/static-1.1293/embed.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvJiUNHAjcqCj2sbBLlMRvyWz7tuLA%2FgXLvgLLoNT2OU8swyO8aIhpEUxv9KtJX3WLC%2FmOf6MivconYNROoBcM0%2FMOaQ7DbVSPH6xrkyJrx%2BWhpLnKnoc%2F5QpIrFrgQXywRtUw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-frame-options: deny
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: REVALIDATED
x-hs-content-campaign-id: 9d0f7a4c-be0b-46ea-b708-005916cbdaae
x-hs-content-id: 62011966600
x-hs-hub-id: 3354902
x-hs-prerendered: Sun, 29 Dec 2024 10:34:02 GMT
x-iinfo: 62-494006432-494006465 NNNN CT(1 6 0) RT(1735544810973 63) q(0 0 0 1) r(1 1) U12

GET
H2 200 embed.js Show response
www.cybereason.com/hs/hsstatic/content-cwv-embed/static-1.1293/ 13 KB
5 KB 66ms
65ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/content-cwv-embed/static-1.1293/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 233) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=27416996, public
content-encoding: gzip
etag: W/"f667e53d5752ee2e5759f3dfaf20d330"
x-cdn: Imperva
expires: Wed, 12 Nov 2025 15:36:47 GMT
content-length: 4651
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Mon, 23 Sep 2024 19:59:06 GMT
content-type: application/javascript

GET
H2 200 project.js Show response
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
762 B 111ms
110ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 236) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=16098710, public
content-encoding: gzip
etag: W/"61ca66de658cab9587e4636894680d5d"
x-cdn: Imperva
expires: Fri, 04 Jul 2025 15:38:41 GMT
content-length: 562
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
content-type: application/javascript

GET
H2 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/ 3 KB
1 KB 107ms
98ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1644941386203/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 248) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993397, public
content-encoding: gzip
etag: W/"38a0b2ad68cbd188720dcc11cc435ad6"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:48 GMT
content-length: 877
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
content-type: text/css

GET
H2 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/ 6 KB
2 KB 108ms
99ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 250) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993397, public
content-encoding: gzip
etag: W/"af924b62631098b8dc817f28551a6908"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:48 GMT
content-length: 1706
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
content-type: text/css

GET
H2 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1724042214535/ 1 KB
664 B 108ms
99ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1724042214535/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9eb7fabe6f662e9e026fb996288d6e4e5b4fd739c45b260269a73b15eabcb7a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 256) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993396, public
content-encoding: gzip
etag: W/"61ee919ce8359cd4e8e49b3aa0fa2d4c"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:47 GMT
content-length: 474
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Mon, 19 Aug 2024 04:36:55 GMT
content-type: text/css

GET
H2 200 module_86933076631_CR_-_Sticky_CTA_Bar.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1669911113479/ 2 KB
1 KB 108ms
98ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1669911113479/module_86933076631_CR_-_Sticky_CTA_Bar.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 262) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"c21ee1fe9f984d7f96a03cbd5dffeba0"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 880
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
content-type: text/css

GET
H2 200 module_34473990280_CR_-_Footer_Full__en_US.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/ 3 KB
1 KB 109ms
99ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/34473990280/1704383554067/module_34473990280_CR_-_Footer_Full__en_US.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 269) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"2d832f69213af1582ea19a1326d20337"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 947
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 04 Jan 2024 15:52:35 GMT
content-type: text/css

GET
H2 200 vyv2ljd.js Show response
use.typekit.net/ 19 KB
7 KB 493ms
119ms Script
text/javascript 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/vyv2ljd.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

nginx /

Resource Hash

458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 6894
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding
server: nginx

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
88 KB 375ms
122ms Script
text/javascript 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

age: 129112
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 19:55:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 19:55:00 GMT
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 89476
x-xss-protection: 0
server: sffe

GET
H2 200 ionicons.eot
www.cybereason.com/hubfs/__dam/fonts/ 118 KB
67 KB 166ms
158ms Font
application/vnd.ms-fontobject 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.eot

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 304) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358715, public
content-encoding: gzip
etag: W/"2c2ae068be3b089e0a5b59abb1831550"
x-cdn: Imperva
content-length: 68797
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Fri, 25 Sep 2020 09:38:01 GMT
content-type: application/vnd.ms-fontobject

GET
H2 200 Criteria-CF-Regular.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 180ms
172ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Regular.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 305) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358714, public
etag: "8c4e317165d35f99602a1c625d63a040"
x-cdn: Imperva
content-length: 14572
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H2 200 Criteria-CF-Medium.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
15 KB 224ms
216ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Medium.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 307) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358714, public
etag: "32457643e2ecf8bcf7fdba1110db901c"
x-cdn: Imperva
content-length: 14772
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H2 200 Peristyle-Black.woff2
www.cybereason.com/hubfs/dam/fonts/peristyle/ 14 KB
14 KB 225ms
217ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/peristyle/Peristyle-Black.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 307) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358714, public
etag: "a17b2e1c032fa4a5eea1eeb1416eb385"
x-cdn: Imperva
content-length: 14136
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Fri, 15 Oct 2021 16:32:36 GMT
content-type: application/font-woff2

GET
H2 200 in.js Show response
platform.linkedin.com/ 511 KB
160 KB 496ms
119ms Script
text/javascript 2600:1408:ec00:1e::1735:23ec
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:ec00:1e::1735:23ec Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Play /

Resource Hash

3f086f2e7a55cb80a12eceb7ddc586416d24e259d04e17b88953f098f0b13786

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: gzip
x-li-fabric: prod-lva1
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 08:03:47 GMT
x-li-proto: http/1.1
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/javascript; charset=UTF-8
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
x-li-pop: prod-lva1-x
cache-control: public, max-age=3600
x-cdn: AKAM
x-li-uuid: AAYqd2n7v/7/j4QcEjmCRw==
content-length: 163881
server: Play
x-edgeconnect-midmile-rtt: 0
x-edgeconnect-origin-mex-latency: 52

GET
H2 200 template_layout.min.css
7052064.fs1.hubspotusercontent-na1.net/hubfs/7052064/hub_generated/template_assets/DEFAULT_ASSET/1734727215110/ 4 KB
2 KB 212ms
80ms Stylesheet
text/css 2606:4700:4400::6812:297c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://7052064.fs1.hubspotusercontent-na1.net/hubfs/7052064/hub_generated/template_assets/DEFAULT_ASSET/1734727215110/template_layout.min.css
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-robots-tag: none
content-encoding: br
cf-cache-status: HIT
etag: W/"fda5882b24ca5a84d04d090722dc713b"
age: 412621
cache-tag: F-184140246185,FD-184141873497,P-7052064,FLS-ALL
x-amz-version-id: RG80aVHDI5en8gzeMA9zeee3bpCIDM5Q
x-cache: RefreshHit from cloudfront
x-amz-cf-id: N6EudGnWHCCkxaNcVVa5HFF6CA_MpyvC-UBMKa7ytUqkGPoVeMgVyQ==
content-type: text/css
last-modified: Fri, 20 Dec 2024 20:40:16 GMT
x-amz-meta-index-tag: none
x-amz-replication-status: COMPLETED
edge-cache-tag: F-184140246185,FD-184141873497,P-7052064,FLS-ALL
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-amz-request-id: 62E4ZH4EJWWK0GPB
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
x-amz-meta-cache-tag: F-184140246185,FD-184141873497,P-7052064,FLS-ALL
x-hs-alternate-content-type: text/plain
server: cloudflare
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-amz-server-side-encryption: AES256
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
date: Mon, 30 Dec 2024 07:46:52 GMT
vary: Accept-Encoding
x-amz-id-2: 9pMX2dyhcq+bgvUtfXzvjIfp6oXxhq3PQhO4E6xhGS6YM2+ESYtBECeuGX7u9XyQiyPxvOyrKhI=
x-amz-meta-access-tag: public-not-indexable
timing-allow-origin: 7052064.fs1.hubspotusercontent-na1.net
via: 1.1 cf0406bc67043378998de4d2ebe1b638.cloudfront.net (CloudFront)
cf-ray: 8fa06b2428ccf7bb-LAX
access-control-allow-origin: *
x-amz-cf-pop: LAX50-P3
x-amz-meta-created-unix-time-millis: 1734727215832

GET
H2 200 cr-master__cta.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/ 3 KB
1022 B 106ms
100ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470223313/1696396395659/__CR_Web_Platform/CSS/cr-master__cta.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 271) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993397, public
content-encoding: gzip
etag: W/"008f2c66892c6d50330665f22668fc4b"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:48 GMT
content-length: 851
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 04 Oct 2023 05:13:17 GMT
content-type: text/css

GET
H2 200 cr-master__main.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/ 49 KB
11 KB 109ms
103ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 277) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"c7c193ff64da90ae6964f13804257f02"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 11139
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Mon, 11 Mar 2024 05:24:51 GMT
content-type: text/css

GET
H2 200 ionicons.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ 50 KB
10 KB 108ms
102ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 284) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"71c8c946791f3411c42a4cb1e9cdb5ed"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 10145
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 13 Jan 2022 17:50:59 GMT
content-type: text/css

GET
H2 200 cr-mln__build.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/ 23 KB
5 KB 113ms
108ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

510835fe8939dd32b7388d00f583d2f080f9d6bcfc2c9d21098407d000065c22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 292) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"fc8b84a5028f90fd340e1c6e0dc5ef52"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 4708
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Mon, 19 Aug 2024 04:32:32 GMT
content-type: text/css

GET
H2 200 cr-framework__bulma-columns.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/ 19 KB
3 KB 115ms
110ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470224480/1635957556830/__CR_Web_Platform/CSS/bulma/cr-framework__bulma-columns.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 293) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26501023, public
content-encoding: gzip
etag: W/"636c18615b58fca9536b2e1c578c6db7"
x-cdn: Imperva
expires: Sun, 02 Nov 2025 01:10:34 GMT
content-length: 3086
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
content-type: text/css

GET
H2 200 cr-framework__bulma.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/ 62 KB
11 KB 118ms
113ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35291999472/1696396871390/__CR_Web_Platform/CSS/bulma/cr-framework__bulma.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 296) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993397, public
content-encoding: gzip
etag: W/"d320036a903c067c37b9ccf5619f0cb2"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:48 GMT
content-length: 11186
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 04 Oct 2023 05:21:13 GMT
content-type: text/css

GET
H2 200 hamburger-animation.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/ 22 KB
3 KB 162ms
157ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42363645447/1635957556555/__CR_Web_Platform/CSS/hamburger-animation.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 298) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26501023, public
content-encoding: gzip
etag: W/"a0b451fd96744fa455495e022542ab86"
x-cdn: Imperva
expires: Sun, 02 Nov 2025 01:10:34 GMT
content-length: 3203
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 03 Nov 2021 16:39:17 GMT
content-type: text/css

GET
H2 200 animate.min.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/ 52 KB
5 KB 162ms
157ms Stylesheet
text/css 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507091846/1635957557027/__CR_Web_Platform/CSS/animate.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 300) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26501024, public
content-encoding: gzip
etag: W/"55009d64191e6f9e712a841773ee6611"
x-cdn: Imperva
expires: Sun, 02 Nov 2025 01:10:35 GMT
content-length: 5154
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 03 Nov 2021 16:39:18 GMT
content-type: text/css

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 160ms
83ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e5f-7918"
age: 244446
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3EqSBbIh%2FuDGfrjXoe45Pydm8WsyfXhXLsPvDI4fEMhD0aDJJj0w8CzmWRVNgjlfZwXB5Mi31Fmdl2FB2zhA27%2FmEq1H7YwSH9Mc4JYEKcq6%2BMb%2BYRl5%2FkUR7PeAgkbUdRU46dea"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 20 Dec 2025 07:46:52 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:07 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8fa06b23db61643a-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5631
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 22 KB
1 KB 379ms
134ms Stylesheet
text/css 2607:f8b0:4004:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a01210a2b1a7e2c2249e9afad4e30bf8c0d7feb7fb6d56badd923fa3bc1a992a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:46:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 06:35:28 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 marker-animation.js Show response
www.cybereason.com/hubfs/dam/plugins/ 6 KB
3 KB 222ms
219ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/plugins/marker-animation.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 308) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1161296, s-maxage=2543696, public
content-encoding: gzip
etag: W/"c789451d244987df6815383a74c748e9"
x-cdn: Imperva
content-length: 2419
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 27 Oct 2020 17:09:14 GMT
content-type: application/javascript

GET
H2 200 cr-logo-inline--primary-black.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 5 KB
5 KB 221ms
218ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-black.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fd6c0f5026c29648ab8887658f23e6c57faedfe7f9d85e702823ae5dfcbdc8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 309) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=24349, public
etag: "0200a44af913040fda048d2ccd029463"
x-cdn: Imperva
content-length: 5084
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Fri, 03 Dec 2021 18:08:59 GMT
content-type: image/png

GET
H2 200 cr-malicious-life-logo-v2.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 35 KB
35 KB 220ms
218ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-malicious-life-logo-v2.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493986044 2CNN RT(1735544810973 310) q(0 0 0 -1) r(0 0)
cache-control: max-age=0, s-maxage=808197, public
etag: "4f8f695cfdda0e2a9e41271fd3ef4840"
x-cdn: Imperva
content-length: 35653
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 15 Dec 2021 18:41:35 GMT
content-type: image/png

GET
H2 200 cr-blog-icon--search-dark-gray.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 440 B
613 B 65ms
64ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-icon--search-dark-gray.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493990038 2CNN RT(1735544810973 467) q(0 0 0 -1) r(0 0)
cache-control: max-age=0, s-maxage=808195, public
etag: "5285e68f20ece59da650da19c81751e2"
x-cdn: Imperva
content-length: 440
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 03 Mar 2021 03:19:57 GMT
content-type: image/png

GET
H2 200 Threat%20Alert%20template%20%285%29.png
www.cybereason.com/hubfs/ 417 KB
417 KB 64ms
64ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Threat%20Alert%20template%20%285%29.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

757fec82c2e045d306d854ea0d8c47a89c39870f4dd399b1294e4da8854b228e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 472) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=440339, s-maxage=1822739, public
etag: "58eaabeb10a96329b81c4bc659d73a87"
x-cdn: Imperva
content-length: 427099
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 15 Dec 2021 20:41:00 GMT
content-type: image/png

GET
H2 200 twitter-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 749 B
620 B 65ms
65ms Image
image/svg+xml 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/twitter-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 535) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1181516, public
content-encoding: gzip
etag: W/"5c103d0cd978b3a8d7ccab6bff714599"
x-cdn: Imperva
content-length: 438
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
content-type: image/svg+xml

GET
H2 200 facebook-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 372 B
475 B 78ms
77ms Image
image/svg+xml 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/facebook-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 905) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1246510, public
content-encoding: gzip
etag: W/"8c22d0d78005c386bf29edacfdd2360d"
x-cdn: Imperva
content-length: 294
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 01 Apr 2021 02:23:43 GMT
content-type: image/svg+xml

GET
H2 200 linkedin-gray.svg
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 742 B
808 B 73ms
73ms Image
image/svg+xml 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/linkedin-gray.svg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 979) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1346474, public
content-encoding: gzip
etag: W/"446340b1a8e73ee28b1a47837a13fdf3"
x-cdn: Imperva
content-length: 630
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 07 Apr 2021 01:13:30 GMT
content-type: image/svg+xml

GET
H2 200 Capture-4.png
www.cybereason.com/hubfs/ 24 KB
25 KB 62ms
62ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/Capture-4.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

f6992602860083443a6e36d8a4189d2ab5275d43eb4f8a8728589b9bfd992da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1006) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=217000, s-maxage=1599400, public
etag: "5b545f45436a98fee1835196019248fa"
x-cdn: Imperva
content-length: 24923
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 09 Sep 2021 17:50:40 GMT
content-type: image/png

GET
H2 200 MSI%20Masquerading%20as%20a%20Malicious%20Software%20Installer%20blog.png
www.cybereason.com/hubfs/ 449 KB
449 KB 63ms
63ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/MSI%20Masquerading%20as%20a%20Malicious%20Software%20Installer%20blog.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

99782de0a886ab8824e0009f6218e01e164265a693ead16cc9735d3320753971

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1042) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1191225, s-maxage=2573625, public
etag: "4551dd787cb3ab29cdff1118a617fdbe"
x-cdn: Imperva
content-length: 459707
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Wed, 30 Nov 2022 23:59:00 GMT
content-type: image/png

GET
H2 200 blog-post-text%20%2884%29.png
www.cybereason.com/hubfs/ 470 KB
471 KB 71ms
70ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/blog-post-text%20%2884%29.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

82a2cc3acbc30e9442fbc259438e7a2d3a53eba702114e1b75f22fc8f3c68371

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1195) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=445859, s-maxage=1828259, public
etag: "1659f2b28f22e6213f7c16deedaf88c3"
x-cdn: Imperva
content-length: 481689
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 22 Apr 2022 17:54:39 GMT
content-type: image/png

GET
H2 200 cr-logo-inline--primary-white.png
www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/ 5 KB
5 KB 70ms
69ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/logos/cr-brand/cr-logo-inline--primary-white.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1198) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=956581, s-maxage=2338981, public
etag: "9fa007f86be3dd9a921a2d00bf86f36e"
x-cdn: Imperva
content-length: 4953
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 03 Dec 2021 18:09:12 GMT
content-type: image/png

GET
H2 200 animatedModal.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/ 2 KB
1 KB 68ms
68ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42507089303/1644440411417/__CR_Web_Platform/JS/animatedModal/animatedModal.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 606) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993399, public
content-encoding: gzip
etag: W/"690ad93d1d2a9fc11f9df295692413fe"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:50 GMT
content-length: 837
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Wed, 09 Feb 2022 21:00:12 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/ 374 B
435 B 64ms
64ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41681847227/1644941386128/module_41681847227_CR_-_Malicious_Life_Network_--_Tier_One_Header.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 616) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993399, public
content-encoding: gzip
etag: W/"1d7f81aaf24568ea5d90a82b829960fd"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:50 GMT
content-length: 245
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 15 Feb 2022 16:09:47 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/ 305 B
411 B 65ms
65ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443113/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 673) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993399, public
content-encoding: gzip
etag: W/"86f1ecf1077302d6bd359676a0142438"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:50 GMT
content-length: 221
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Tue, 15 Feb 2022 16:10:44 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1724042213858/ 224 B
402 B 62ms
62ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/43300360745/1724042213858/module_43300360745_CR_-_Malicious_Life_Network_--_Related_Posts.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

8fb95734be01fd3e163c6ebfb1c8d8d3f60e9339c7e4ec6a3040611cb1ed022c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 681) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993398, public
content-encoding: gzip
etag: W/"ab8f6ede36e2a420f76e425adc28e107"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:49 GMT
content-length: 170
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Mon, 19 Aug 2024 04:36:54 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 module_86933076631_CR_-_Sticky_CTA_Bar.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/ 694 B
527 B 63ms
62ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/86933076631/1669911113440/module_86933076631_CR_-_Sticky_CTA_Bar.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 737) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=26993400, public
content-encoding: gzip
etag: W/"de347f1a06cbb5270942bfc43d48cf48"
x-cdn: Imperva
expires: Fri, 07 Nov 2025 17:56:51 GMT
content-length: 317
date: Mon, 30 Dec 2024 07:46:51 GMT
last-modified: Thu, 01 Dec 2022 16:11:54 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 3354902.js Show response
www.cybereason.com/hs/scriptloader/ 2 KB
833 B 357ms
356ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/scriptloader/3354902.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

c571128321fdcbd922f806670945903b6f8badc36504ca0806ec006e3b75755b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493963119 3CNN RT(1735544810973 1201) q(0 0 0 -1) r(3 3)
cache-control: max-age=85, public
content-encoding: gzip
etag: "457322d3"
x-cdn: Imperva
expires: Mon, 30 Dec 2024 07:48:17 GMT
content-length: 641
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Mon, 30 Dec 2024 07:45:53 GMT
content-type: application/javascript;charset=utf-8

GET
H2 200 index.js Show response
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/ 12 KB
4 KB 71ms
70ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/index.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

3515e02fe5788cfcd3d13d7475727a0ba88b9e1559c786e1fcbd2fe1b08452df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1204) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=30698076, public
content-encoding: gzip
etag: W/"38c48c0bdf3aa4294312a4e7c912393a"
x-cdn: Imperva
expires: Sat, 20 Dec 2025 15:01:28 GMT
content-length: 4201
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 20 Dec 2024 14:04:47 GMT
content-type: application/javascript

GET
H2 200 _Incapsula_Resource Show response
www.cybereason.com/ 81 KB
20 KB 76ms
75ms Script
application/javascript 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1713697118

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

dc248ca25d836534f5b20a9de238f1b570b765d548c23552536fe54dd3734c67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-robots-tag: noindex
cache-control: no-cache, no-store
content-encoding: gzip
content-length: 20054
content-type: application/javascript

GET
H3 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ 70 KB
5 KB 80ms
79ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5f5628a2-11846"
age: 500747
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=72ShWOcVdw1RXo5iCM%2Bva1TG0rDwM056S3rWSAVFCDhyFl7427WIux5fJKXlkuPCLXahZ1mfvFjLhdS2vHFB%2FW5Fc%2FkyMef%2FyOGLuGayKKGoUBZPfaPc1ZNXITNLyeQqY6cbstHC"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 20 Dec 2025 07:46:52 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8fa06b286e9b643a-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4216
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 22 KB
998 B 135ms
133ms Stylesheet
text/css 2607:f8b0:4004:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c19651289e75995debf229028dcaa3c66b58a4d2deda8fcafc2fda0fdd52e8bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:46:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 07:07:18 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 23 KB
1018 B 139ms
138ms Stylesheet
text/css 2607:f8b0:4004:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7ec04c16a86169fc61ae57b7d9a968e149b6f8339d12a8a86ea9a535dc38366a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:46:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 05:56:29 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 81 KB
3 KB 140ms
140ms Stylesheet
text/css 2607:f8b0:4004:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

334740680dcc014934905f29d95fa287624b3bd54a0a9a285abab2866761dd72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:46:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:52 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 07:46:52 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 cr-blog-hero-owl-transparent.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 670 KB
670 KB 85ms
84ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-blog-hero-owl-transparent.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/41682410610/1644941443237/module_41682410610_CR_-_Malicious_Life_Network_--_Main_Hero.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493991632 2CNN RT(1735544810973 1226) q(0 1 1 -1) r(1 1)
cache-control: max-age=1065794, s-maxage=2448194, public
etag: "cd208635457bf65f33aa7c8849efcf21"
x-cdn: Imperva
content-length: 685987
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 19 Feb 2021 04:27:31 GMT
content-type: image/png

GET
H2 200 cr-ml-sidebar-subscribe-bg.jpg
www.cybereason.com/hubfs/dam/images/images-web/backgrounds/ 10 KB
11 KB 86ms
86ms Image
image/jpeg 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/backgrounds/cr-ml-sidebar-subscribe-bg.jpg

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

5df47253a9b006c8f8f5894b52c6847488bae41c5f1b11925985b59e97a52f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493990038 2CNN RT(1735544810973 1230) q(0 0 0 -1) r(0 0)
cache-control: max-age=1065792, s-maxage=2448192, public
etag: "c2444af5dedceb18b268a01a640beb72"
x-cdn: Imperva
content-length: 10684
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Thu, 31 Mar 2022 18:30:54 GMT
content-type: image/jpeg

GET
H2 200 cr-mln-network__footer-subscribe-bg.png
www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/ 38 KB
38 KB 83ms
83ms Image
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/hubfs/dam/images/images-web/blog-images/template-images/cr-mln-network__footer-subscribe-bg.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/42760289143/1724041950600/__CR_Web_Platform/CSS/cr-mln__build.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1238) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=808194, public
etag: "c28026bc6a6d55f395e2227b7b19c8c9"
x-cdn: Imperva
content-length: 38595
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Wed, 10 Mar 2021 19:10:18 GMT
content-type: image/png

GET
H2 200 ionicons.ttf
www.cybereason.com/hubfs/__dam/fonts/ 184 KB
107 KB 70ms
66ms Font
font/ttf 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/__dam/fonts/ionicons.ttf

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/35275979682/1642096258129/__CR_Web_Platform/CSS/ionicons.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1280) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358716, public
content-encoding: gzip
etag: W/"24712f6c47821394fba7942fbb52c3b2"
x-cdn: Imperva
content-length: 109704
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 25 Sep 2020 09:38:00 GMT
content-type: font/ttf

GET
H2 200 Criteria-CF-Bold.woff2
www.cybereason.com/hubfs/dam/fonts/criteria/ 14 KB
14 KB 73ms
70ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/criteria/Criteria-CF-Bold.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1283) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358715, public
etag: "ba487b98622054117d0be2f92f3f45b2"
x-cdn: Imperva
content-length: 14332
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Thu, 13 Jan 2022 17:33:57 GMT
content-type: application/font-woff2

GET
H3 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
47 KB 508ms
381ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179619
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:53:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:53:14 GMT
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48444
x-xss-protection: 0
server: sffe

GET
H2 200 FlamCondBook.woff2
www.cybereason.com/hubfs/dam/fonts/flama/ 14 KB
14 KB 82ms
80ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/flama/FlamCondBook.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1296) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=1358714, public
etag: "9b97cc4b573f2e8b6ead12339a15b141"
x-cdn: Imperva
content-length: 14544
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 10 Dec 2021 14:25:11 GMT
content-type: application/font-woff2

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 491ms
366ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B46r2z3bWuQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow+Condensed:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 178661
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 06:09:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 06:09:12 GMT
last-modified: Tue, 19 Apr 2022 18:46:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21440
x-xss-protection: 0
server: sffe

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 246ms
121ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,600;1,700;1,800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179631
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:53:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:53:02 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 468ms
343ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179629
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:53:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:53:04 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E30-8s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 426ms
302ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51os.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179785
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:50:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:50:28 GMT
last-modified: Tue, 19 Apr 2022 19:35:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21796
x-xss-protection: 0
server: sffe

GET
H3 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ 21 KB
21 KB 291ms
167ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 180266
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:42:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:42:27 GMT
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21724
x-xss-protection: 0
server: sffe

GET
H2 200 HOSP.woff2
www.cybereason.com/hubfs/dam/fonts/hsop/ 154 KB
154 KB 84ms
83ms Font
application/font-woff2 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/dam/fonts/hsop/HOSP.woff2

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/34470477360/1710134689941/__CR_Web_Platform/CSS/cr-master__main.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-0 0CNN RT(1735544810973 1297) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=0, s-maxage=937870, public
etag: "2ffd5c598df2d32b13ebd689e6daa668"
x-cdn: Imperva
content-length: 157664
date: Mon, 30 Dec 2024 07:46:52 GMT
last-modified: Fri, 11 Feb 2022 15:12:37 GMT
content-type: application/font-woff2

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 20 KB
20 KB 335ms
211ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4-Lwz3bWuQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179579
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 05:53:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 05:53:54 GMT
last-modified: Tue, 19 Apr 2022 18:38:09 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20432
x-xss-protection: 0
server: sffe

GET
H3 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ 21 KB
21 KB 380ms
256ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlowcondensed/v12/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWuQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://fonts.googleapis.com/

Response headers

age: 563859
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 23 Dec 2025 19:09:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Dec 2024 19:09:14 GMT
last-modified: Tue, 19 Apr 2022 18:30:34 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21352
x-xss-protection: 0
server: sffe

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 245ms
120ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Resource Hash

ff46e29c0230c20a50ec8284fcdf4d929eb776199504af1b426baf6cefedcd95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: QxpswEvWyBWOMDqlgu7dEg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "c68ae2b2624847b17fe2cc9630d3d182"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:55:25 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 1bb88fc759bbb17f4f446760b098ea89
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=118, rtx=0, c=24, mss=1232, tbw=8248, tp=13, tpl=0, uplat=0, ullat=-1
x-fb-debug: WuQpwBMGg9Ws30ZCBmvm0CGorpLO1r5jqdQ4otRIAuCn7DXQqW81TJgsGzwYFXSgy5Dr7yWN9uobxiQBkpB5xA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1687
origin-agent-cluster: ?1

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 360ms
118ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Mon, 30 Dec 2024 07:46:53 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kiad7000169-IAD
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 428ms
301ms XHR
text/plain 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=3354902

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.393/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-request-id: 4f4f7989-6481-496d-a478-77ead8634d75
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-methods: GET
x-content-type-options: no-sniff
x-evy-trace-listener: listener_https
date: Mon, 30 Dec 2024 07:46:53 GMT
x-hubspot-correlation-id: 4f4f7989-6481-496d-a478-77ead8634d75
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8fa06b2ab8bd1018&resource=unknown"
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-hfrjc
x-envoy-upstream-service-time: 4
access-control-allow-credentials: true
cf-ray: 8fa06b2ab8bd1018-LAX
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 16 KB
16 KB 470ms
118ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "eedb93b5a9ba82f97df21a2548066c304a8baad8"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16112
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 16 KB
16 KB 491ms
139ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "2d91046573f0e4458e7737f18f00bb9c13388e11"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16256
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 15 KB
15 KB 480ms
128ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 15452
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 16 KB
16 KB 618ms
266ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16660
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 17 KB
17 KB 607ms
255ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "7b5be73a29b093f7ae3c099f5a521c9274f6db28"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 17152
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 16 KB
16 KB 595ms
243ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 16464
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 23 KB
23 KB 502ms
150ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "122498e3424e674610da39fb441d661549879239"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23244
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 15 KB
15 KB 703ms
352ms Font
application/font-woff2 2600:1408:ec00:43::1737:b053
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b053 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "13c2813ff67959226aaa4eccfcdd1399bd756b8d"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 15336
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 _Incapsula_Resource
www.cybereason.com/ 1 B
36 B 62ms
61ms Image
text/plain 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybereason.com/_Incapsula_Resource?SWKMTFSR=1&e=0.12682286370763984

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-robots-tag: noindex
cache-control: no-cache, no-store
content-length: 1
content-type: text/plain

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 249 KB
74 KB 123ms
122ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=799ce42f36c20bc2d0f2769e131c8a21

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Resource Hash

b37ac51cd68881afe1defc5bf895c63fb863d55dd1e4a5f795f79f36f929d4c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: 97XSO+zAXRs4F+iblBAGNQ==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "4f5bc244176f1c675facbf383e406554"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 07:34:14 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: ef0c7aca1e96001e3e139d5b0c4b32be
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=1888, tp=5, tpl=0, uplat=1, ullat=-1
x-fb-debug: kg/b3p5407+PNvinoGjluvCcSIbEplT+fIFsRd3F9HkaIDNGFZzJ0Actaue/3URw0nfPHBD/Uo/G7xaLAeXY0Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 75190
origin-agent-cluster: ?1

GET
H2 200 3354902.js Show response
js.hs-analytics.net/analytics/1735544700000/ 69 KB
25 KB 319ms
182ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1735544700000/3354902.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05fa485aeffd65bceabb8816dcd6c8f06b2a9b265e8c5beb75ad865219cb77d2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-amz-server-side-encryption: AES256
x-request-id: dd56ec7e-7b09-4633-bf47-22ef38a83c89
content-encoding: gzip
cf-cache-status: MISS
etag: W/"475019bd9f45e08a9a31ff7a91383304"
x-amz-version-id: null
expires: Mon, 30 Dec 2024 07:51:53 GMT
x-evy-trace-listener: listener_https
date: Mon, 30 Dec 2024 07:46:53 GMT
x-hubspot-correlation-id: dd56ec7e-7b09-4633-bf47-22ef38a83c89
content-type: text/javascript
last-modified: Fri, 06 Dec 2024 09:37:15 GMT
vary: origin, Accept-Encoding
x-amz-id-2: 3yAinJH63Rqb0rxPfkGoXFBFh/sTr8YKqttDVzkCxZ7/TOFOVNDrCO9CkMQJmcWr8Bbn2265utwfnbyQACGOkQ==
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-6qjnc
x-envoy-upstream-service-time: 25
access-control-allow-credentials: false
x-amz-request-id: 7SM4F9A0Q1F4K9JG
cf-ray: 8fa06b2c6dd05214-LAX
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/3354902/ 71 KB
26 KB 310ms
176ms Script
text/javascript 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/3354902/banner.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 384ba71373dbad3d3022a9e548dbaf59b6c3c9920b5f4f86770609e89ca8112f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-evy-trace-virtual-host: all
access-control-max-age: 604800
x-request-id: c85aa6e0-efc4-4451-8c09-23f8baca6d9a
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"3476b28843e013f49c5d34daf2308db6"
x-amz-version-id: ugx73hq02BR.uioJgfMYuSaYNTqJOkR3
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires: Mon, 30 Dec 2024 07:51:53 GMT
x-evy-trace-listener: listener_https
date: Mon, 30 Dec 2024 07:46:53 GMT
x-hubspot-correlation-id: c85aa6e0-efc4-4451-8c09-23f8baca6d9a
content-type: text/javascript; charset=UTF-8
last-modified: Fri, 06 Dec 2024 09:37:13 GMT
vary: origin, Accept-Encoding
x-amz-id-2: 7OjazaooS73H5tuHYRaodp7TIGmv9Dchrtgg3E9cihiZr/LSgEwjjttZZvs5AZ1zqJVDXsqCQVk=
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=300,public
timing-allow-origin: *
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-2bzl2
x-envoy-upstream-service-time: 122
access-control-allow-credentials: true
x-amz-request-id: X9M25A1EYFYMHT6K
cf-ray: 8fa06b2c6bf4cba7-LAX
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 550 KB
92 KB 210ms
74ms Script
application/javascript 2606:4700::6812:8c11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-request-id: f21b416c-2332-4b5d-a252-d72d72689629
content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: PqQn.3x38ZWRmSYb9J2u1wYA9Etnh36Z
etag: W/"e9829c28fae41e369bd948323746cc37"
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
age: 51648
x-content-type-options: nosniff
x-cache: Miss from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: dcqzUuUJ8V-VBqqaDHro04qECw8jrcO9RIlYRMEkAP9v7dJqEOe9cQ==
x-hubspot-correlation-id: f21b416c-2332-4b5d-a252-d72d72689629
content-type: application/javascript; charset=utf-8
last-modified: Thu, 12 Dec 2024 15:49:15 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: s-maxage=86400, max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-xqtv6
x-envoy-upstream-service-time: 41
x-hs-target-asset: lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
access-control-max-age: 3000
access-control-allow-methods: GET
x-hs-cache-status: MISS
date: Mon, 30 Dec 2024 07:46:53 GMT
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js&cfRay=8f0ee5e0bc7667bb-DFW
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
cf-ray: 8fa06b2c6e852b54-LAX
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 84 KB
25 KB 269ms
139ms Script
application/javascript 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

674d5ab1e2c5a783115e67fabc4805ac2e8a83d48eb6a1ad3535c23a959a1801

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.cybereason.com
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-request-id: d9004827-1efd-40e4-b80c-5cbf56a77a68
content-encoding: gzip
cf-cache-status: HIT
etag: W/"03686003e4860757c17ae65c11ab8ea4"
x-amz-version-id: _83IngeMtzUuERab6QgcByX86005NyG0
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RwfQQ%2F3%2FspfOklFrsACfYdukPTg7vGcru5RZ6pz5etXvxp9RoReNvdLw%2BW4VneAv9J9I3yUzf9k%2Bm9Bp2hhkD67M2OB1Ec%2B42CGeFcxcUZWNHmVqfrAOkP9AjyKUfET2AsZHgiSFxjK4TQF0"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-evy-trace-listener: listener_https
x-amz-cf-id: X-iqiB89CB3rHO9uM_zdbbp7gsdHPb_Dz4WiatLmoejIxgvGssihLA==
x-hubspot-correlation-id: d9004827-1efd-40e4-b80c-5cbf56a77a68
content-type: application/javascript; charset=utf-8
last-modified: Fri, 13 Dec 2024 12:10:35 UTC
x-amz-replication-status: COMPLETED
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-856d8787d5-56k8s
x-envoy-upstream-service-time: 3
x-hs-target-asset: web-interactives-embed/static-2.1996/bundles/project.js
server: cloudflare
x-evy-trace-virtual-host: all
x-amz-server-side-encryption: AES256
x-hs-cache-status: HIT
date: Mon, 30 Dec 2024 07:46:53 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1996/bundles/project.js&cfRay=8f8a9f000a73670d-DFW
via: 1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-ray: 8fa06b2c6c2f090c-LAX
access-control-allow-origin: *
x-evy-trace-route-configuration: listener_https/all
x-amz-cf-pop: IAD12-P3

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame D446 0
0 350ms
117ms Document
text/html 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Mon, 30 Dec 2024 07:46:53 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT
x-served-by: cache-iad-kiad7000156-IAD

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 61 B
1 KB 156ms
155ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3354902&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&contentId=62011966600

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-robots-tag: noindex, follow
access-control-max-age: 180
x-request-id: 1d3d78dc-34b9-4c60-8eed-2c7fac87c006
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BYQu%2Bp74XcoKKZeV9wObcjqys5ZWanSR8tEJrAG9HczI6B1WuNA2U2q1BUkWiNsQJLchzoFq7LomH8IDxBrXIBFs24ia%2FlzoqEz2vQDWZsAes6FGy5uKXpGDsnQIKWKqxEWis%2BZOCeMFoKDrhcC1h3J0bFXmQpwuYxI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS, GET
x-evy-trace-listener: listener_https
date: Mon, 30 Dec 2024 07:46:53 GMT
x-hubspot-correlation-id: 1d3d78dc-34b9-4c60-8eed-2c7fac87c006
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-2rx7m
x-envoy-upstream-service-time: 8
access-control-allow-credentials: true
cf-ray: 8fa06b2e1e20090c-LAX
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 5 B
351 B 195ms
72ms Fetch
text/plain 2606:4700:4400::6812:28f0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/3354902/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 776cec61a9f36def61b4b86438402b91faa9814d3fa2ff7adbd9b4463a5c8dc2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

cache-control: private, max-age=1500
cf-ray: 8fa06b2f48462eba-LAX
access-control-allow-origin: *
content-length: 5
date: Mon, 30 Dec 2024 07:46:53 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 441 KB
130 KB 404ms
156ms Script
application/javascript 2607:f8b0:4004:c1f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

20e70ec8ff4b81afc46060a4ab434333dcda18f6eb4cc70d83857acb60e8a7eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 30 Dec 2024 07:46:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:54 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 30 Dec 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 132355
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 698ms
120ms Image
image/gif 2600:1408:ec00:43::1737:b058
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.21.0&app=typekit&e=js&_=1735544813867
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:43::1737:b058 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

cache-control: public, max-age=604800
etag: "66d916d6-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35
date: Mon, 30 Dec 2024 07:46:54 GMT
content-type: image/gif
last-modified: Thu, 05 Sep 2024 02:26:30 GMT
server: nginx

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
957 B 262ms
182ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-robots-tag: none
x-request-id: 20fe48c6-92e8-4aab-8865-fba68a0a4098
access-control-expose-headers: X-Origin-Hublet
cf-cache-status: MISS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-evy-trace-listener: listener_https
server-timing: cfExtPri
date: Mon, 30 Dec 2024 07:46:54 GMT
x-hubspot-correlation-id: 20fe48c6-92e8-4aab-8865-fba68a0a4098
content-type: image/gif
vary: origin, Accept-Encoding
last-modified: Mon, 30 Dec 2024 07:46:54 GMT
priority: u=3,i
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-4nb5b
x-envoy-upstream-service-time: 2
access-control-allow-credentials: false
cf-ray: 8fa06b2f9d8e6804-SJC
accept-ranges: bytes
x-evy-trace-route-configuration: listener_https/all
content-length: 35
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 207ms
71ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: UzmBk0Ra4K9he+CwjGKb/g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD1DE4B7A34202
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 20175
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:54 GMT
content-type: application/javascript
last-modified: Mon, 16 Dec 2024 15:17:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 1138e44e-a01e-0067-6135-50202d000000
cf-ray: 8fa06b345b64cb8e-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7211
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 3354902.js Show response
js.hs-scripts.com/ 2 KB
1 KB 317ms
181ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3354902.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1014cf333957067f6bffe374ba8f655e7e885dc9da0d6ab9f36c8a2e41d7129

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: EXPIRED
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:48:24 GMT
date: Mon, 30 Dec 2024 07:46:54 GMT
x-hubspot-correlation-id: c32b0bc6-cd9d-491f-9b29-0db39c47c45d
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
last-modified: Mon, 30 Dec 2024 07:46:54 GMT
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8fa06b34585808e2-LAX
accept-ranges: bytes
access-control-allow-origin: https://www.cybereason.com
content-length: 640
server: cloudflare

GET
H2 200 26b02624-42c7-456d-82c2-9669db762671.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/ 5 KB
2 KB 201ms
78ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/26b02624-42c7-456d-82c2-9669db762671.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: IGr7iWost09FKtc8kbZS7g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC83D7788B18D7
age: 51645
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 31 Dec 2024 07:46:54 GMT
date: Mon, 30 Dec 2024 07:46:54 GMT
content-type: application/json
last-modified: Mon, 03 Jun 2024 14:14:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 49a4a4ae-401e-006d-3c4c-2639a4000000
cf-ray: 8fa06b359fdef7b9-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1798
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
608 B 176ms
175ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1372317473&v=1.1&a=3354902&pi=62011966600&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&cpi=62011966600&cgi=5272851739&lpi=62011966600&lvi=62011966600&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&t=THREAT+ANALYSIS+REPORT%3A+Inside+the+LockBit+Arsenal+-+The+StealBit+Exfiltration+Tool&cts=1735544814932&vi=f4104c5a7413db7de7b1f397f00e57ac&nc=true&u=85683782.f4104c5a7413db7de7b1f397f00e57ac.1735544814926.1735544814926.1735544814926.1&b=85683782.1.1735544814926&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-robots-tag: none
x-request-id: 7040bc15-585b-476a-b494-3de49b1ac842
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=moqgSSB%2Bzq0j6s0COYGsAl7iBtIHe9TJF5xMLNrKoMle21sefIGIMZMxpA1NtnfKe4%2BtOvujPgQqqfEIUEIsqetrMzwIBsrmYqm47bXAYBWlflOBMnjWLagWq1wg7NBHz6S66czr9G8cM6Xf7mOI"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-evy-trace-listener: listener_https
p3p: CP="NOI CUR ADM OUR NOR STA NID"
date: Mon, 30 Dec 2024 07:46:55 GMT
x-hubspot-correlation-id: 7040bc15-585b-476a-b494-3de49b1ac842
content-type: image/gif
vary: origin, Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: no-cache, no-store, no-transform
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-ktnwt
x-envoy-upstream-service-time: 6
access-control-allow-credentials: false
cf-ray: 8fa06b358e211018-LAX
x-evy-trace-route-configuration: listener_https/all
content-length: 45
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 cr-favicon-1.png
www.cybereason.com/hubfs/ 3 KB
3 KB 82ms
81ms Other
image/png 45.60.62.106
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/hubfs/cr-favicon-1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.62.106 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-iinfo: 62-494006432-493986044 2CNN RT(1735544810973 3172) q(0 0 0 -1) r(0 0)
cache-control: max-age=1177929, s-maxage=2560329, public
etag: "191c614ca975bba9737fcf4fc024f8e7"
x-cdn: Imperva
content-length: 3186
date: Mon, 30 Dec 2024 07:46:54 GMT
last-modified: Fri, 10 Dec 2021 18:39:27 GMT
content-type: image/png

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
1 KB 167ms
167ms XHR
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=f4104c5a7413db7de7b1f397f00e57ac&__hstc=85683782.f4104c5a7413db7de7b1f397f00e57ac.1735544814926.1735544814926.1735544814926.1&__hssc=85683782.1.1735544814926&contentId=62011966600&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2dc69a7713956f320c388767418e6a83ae2696c8968ac1ea76dd84b1c1e58d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-robots-tag: none
access-control-max-age: 180
x-request-id: 39c71111-2a3a-4489-8883-25a35f411438
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zC78tgG%2FJsJ7cplaXnGtZhbGcEGlW9Pt9mk%2BYy4EEYOYeWuj9hl7lWuFvtPKyBL5ZByKIAS4vWsRWnVh3ZNqJTfUswYNyEAjmOfAp6xANMjkWPcRNyOaYqOkXw2s9%2BYoJCZ9XJ9F7nswRVeVhahh"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-listener: listener_https
date: Mon, 30 Dec 2024 07:46:55 GMT
x-hubspot-correlation-id: 39c71111-2a3a-4489-8883-25a35f411438
content-type: application/json;charset=utf-8
vary: origin
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
cache-control: max-age=0, no-cache, no-store
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-b967ccf5d-6w44x
x-envoy-upstream-service-time: 28
access-control-allow-credentials: false
cf-ray: 8fa06b35efb8090c-LAX
access-control-allow-origin: https://www.cybereason.com
x-evy-trace-route-configuration: listener_https/all
server: cloudflare
x-evy-trace-virtual-host: all

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 71 B
309 B 219ms
91ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8fa06b36efbb69a6-LAX
access-control-allow-origin: *
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.38.0/ 369 KB
88 KB 73ms
72ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: jz950M8ZW7RakPP2zlLHZQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29E465D1D
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 31023
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/javascript
last-modified: Thu, 21 Jul 2022 06:31:17 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 264131d5-001e-0103-77d4-3fd6d8000000
cf-ray: 8fa06b377d5dcb8e-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 89624
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-6675-7280-824b-ae6984436ae4/ 152 KB
26 KB 78ms
77ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/26b02624-42c7-456d-82c2-9669db762671/018fde6f-6675-7280-824b-ae6984436ae4/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d143ffe1d767f3bb4bc98fe1b1cd57234966fc5256c125e5f729ed8677775c49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: yUjOfH9WY4QOmwJ59rpuXA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC83D77C66B1B0
age: 42487
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 31 Dec 2024 07:46:55 GMT
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/json
last-modified: Mon, 03 Jun 2024 14:14:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 4eee1262-001e-000c-133e-377d7b000000
cf-ray: 8fa06b38695ef7b9-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26007
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otFloatingRoundedIcon.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 16 KB
4 KB 76ms
75ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otFloatingRoundedIcon.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86dbd997ead92464b9d3e6228dab6902a3f8cdbd17de1da8923cb2f0fb600bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: 5ylejFve50cA47Vq8z8O7g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE299C2B57B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 42487
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 4d0c0e07-b01e-00f0-15a5-5243e4000000
cf-ray: 8fa06b390b2ef7b9-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3803
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/ 63 KB
14 KB 77ms
76ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ea7d0808ff8988ec025b9675e9db94b104f5dbd2b6401b69a8d722b9c74022

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: NMbgeeWI1HTP4d+sqlVJ9w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29AB8B18B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 42487
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:11 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: fb36eb7a-701e-004c-5588-cd5495000000
cf-ray: 8fa06b390b34f7b9-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13981
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 5 KB
2 KB 79ms
79ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: keZk8SpZZgHvyFwdMFhvhQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DA6AE29A3CDCC9
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 11450
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/json
last-modified: Thu, 21 Jul 2022 06:31:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 6737bcb4-201e-001c-0647-ac997e000000
cf-ray: 8fa06b390b36f7b9-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1767
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.38.0/assets/ 22 KB
5 KB 75ms
74ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.38.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.38.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: TLLtdkuMahUQRVIfmZNHNw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 11450
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: text/css
last-modified: Thu, 21 Jul 2022 06:31:23 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8cb94fc3-f01e-00fc-60e3-30ad15000000
cf-ray: 8fa06b390b37f7b9-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 3354902.js Show response
js.hs-scripts.com/ 2 KB
0 0ms
0ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/3354902.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1014cf333957067f6bffe374ba8f655e7e885dc9da0d6ab9f36c8a2e41d7129

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: EXPIRED
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 07:48:24 GMT
date: Mon, 30 Dec 2024 07:46:54 GMT
x-hubspot-correlation-id: c32b0bc6-cd9d-491f-9b29-0db39c47c45d
content-type: application/javascript;charset=utf-8
vary: origin, Accept-Encoding
last-modified: Mon, 30 Dec 2024 07:46:54 GMT
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8fa06b34585808e2-LAX
accept-ranges: bytes
access-control-allow-origin: https://www.cybereason.com
content-length: 640
server: cloudflare

GET
H2 200 zdcd6x8yhg85.js Show response
js.driftt.com/include/1735545000000/ 221 KB
62 KB 440ms
165ms Script
application/javascript 18.160.18.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1735545000000/zdcd6x8yhg85.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.18.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-18-68.iad12.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3867222dd164aabe123fb215f74e7addef42153d5b7798da96e7ff538800d9d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: gzip
x-amz-version-id: 4EwdlBw17X74RQTOe9VuP1Ie.V233clU
etag: W/"553914c3910b26c914577f76e20af476"
access-control-allow-methods: GET, POST, OPTIONS
x-cache: RefreshHit from cloudfront
x-amz-cf-id: QYGHBqZumO1zMuPhhpqBEM0ZobzlYgAv6EaiOpSD2Vam28saGdHLeQ==
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Thu, 19 Dec 2024 17:54:32 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 32
access-control-allow-credentials: true
via: 1.1 a66cf66feb9f859a61920422b04d33a0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD12-P4
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 200 E-v1.js Show response
fast.wistia.com/assets/external/ 851 KB
145 KB 190ms
61ms Script
text/javascript 2a04:4e42:600::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/E-v1.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5c1fe57929a1874ecde1d1dc9e306ca3a8b4c188b2db1e324fce9e587a399ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: br
etag: "bc30ab80e00e31ee2165c097e5cbf5df"
age: 2298
x-cache: HIT, HIT
date: Mon, 30 Dec 2024 07:46:55 GMT
last-modified: Fri, 20 Dec 2024 20:11:38 GMT
x-served-by: cache-iad-kjyo7100137-IAD, cache-lax-kwhp1940130-LAX
x-cache-hits: 38, 38
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=0
cache-control: public, max-age=3600
timing-allow-origin: *
x-timer: S1735544816.658948,VS0,VE0
via: 1.1 varnish, 1.1 varnish
x-browser: chrome
x-ecma-v: modern
x-browser-version: 131
accept-ranges: bytes
access-control-allow-origin: *
content-length: 147471
asset-version: ea49143d3ad772007b2d472dbbb9c363df7c98a6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 6e1424cff90e9cd4.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 403ms
139ms Script
application/javascript 18.160.10.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.10.55 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-10-55.iad12.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

2ef6c164de3a10c6430495e2d71eccedf9ce99fa908e3ef7a634b2fec8ed33fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: gzip
x-amz-version-id: GmVDCYAteuvDz4JH8RenHszn3x6g8rUD
etag: W/"ee5ab610dc1329c0de5862aad57dd3fe"
age: 242
x-cache: Hit from cloudfront
x-amz-cf-id: ZhIJ8DHnQUG5DwDoASA8rbrNoakhMvN1x_uES89rlMS1stJnMkAKXw==
date: Mon, 30 Dec 2024 07:42:54 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Fri, 15 Nov 2024 20:23:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: IAD12-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 70ms
70ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 78682
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 30 Dec 2024 07:46:55 GMT
content-type: image/svg+xml
last-modified: Mon, 16 Dec 2024 15:17:15 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d85d13eb-c01e-005e-3595-556089000000
cf-ray: 8fa06b39bc65cb8e-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 sync
s.company-target.com/s/ Frame 1116 0
0 377ms
124ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Mon, 30 Dec 2024 07:46:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://id.rlcdn.com/464526.gif
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCPCfybsGEgUI6AcQAEIASgA
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo
https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo&verifyHash=984cad0eb18620cd8770fcbdfd49627c01b2c6ca

26 B
348 B

122ms
119ms

Image
image/gif

99.84.188.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo&verifyHash=984cad0eb18620cd8770fcbdfd49627c01b2c6ca
Protocol: HTTP/1.1
Server: 99.84.188.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-188-56.iad89.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

Connection: keep-alive
Via: 1.1 d19e64e406af1f88f7f96d9dcb2393ca.cloudfront.net (CloudFront)
X-Cache: Miss from cloudfront
Content-Length: 26
X-Amz-Cf-Id: 9Qwg9Xycnd7d9izabwcpmeA0MsdgRYWoWDFnpyi7wWzvR4mLI8QhUQ==
Date: Mon, 30 Dec 2024 07:46:56 GMT
Content-Type: image/gif
X-Amz-Cf-Pop: IAD89-C2

Redirect headers

Location: /validateCookie?vendor=liveramp&user_id=Xc1297drvWsWpOPmXp1v--c_eYkTW5kBIJQ550ZzHqmVIqgMo&verifyHash=984cad0eb18620cd8770fcbdfd49627c01b2c6ca
Connection: keep-alive
Via: 1.1 d19e64e406af1f88f7f96d9dcb2393ca.cloudfront.net (CloudFront)
X-Cache: Miss from cloudfront
Content-Length: 176
X-Amz-Cf-Id: C_o68dN_rETNpupCGVDv0QtxD3i-ASVp5TLwIAB-_oft7H6_Q1eCYw==
Date: Mon, 30 Dec 2024 07:46:56 GMT
Content-Type: text/html; charset=utf-8
X-Amz-Cf-Pop: IAD89-C2

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 471 B
1 KB 397ms
138ms XHR
application/json 13.249.39.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&page_title=THREAT%20ANALYSIS%20REPORT%3A%20Inside%20the%20LockBit%20Arsenal%20-%20The%20StealBit%20Exfiltration%20Tool

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.249.39.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-249-39-126.iad89.r.cloudfront.net

Software

nginx /

Resource Hash

ad3613f6714f248087ef8b414505604928b47c4de292557ac831bcd52f6ed0f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: e7b99528-200a-4bf1-8aa9-978f60a0db8e
expires: Sun, 29 Dec 2024 07:46:56 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: 3bO21sEE17PvRFQntg3D9doa-R9-7TRgxzxID55hqUzSGRMJaJOn3Q==
date: Mon, 30 Dec 2024 07:46:56 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.cybereason.com
x-amz-cf-pop: IAD89-C1
server: nginx

GET
H2 200 core
js.driftt.com/ Frame 39F3 0
0 367ms
134ms Document
text/html 18.160.18.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=zdcd6x8yhg85&eId=zdcd6x8yhg85&region=US&forceShow=false&skipCampaigns=false&sessionId=cd111197-63e9-4d04-9713-e647c211639e&sessionStarted=1735544816.08&campaignRefreshToken=a1c6c942-64b3-433f-b60e-022cfb1f75ce&hideController=false&pageLoadStartTime=1735544812072&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1735545000000/zdcd6x8yhg85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.18.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-18-96.iad12.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 30 Dec 2024 07:46:56 GMT
etag: W/"76ea1344fb697ec9177486a08c12338b"
last-modified: Thu, 19 Dec 2024 17:54:25 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
via: 1.1 a57d2f9cdddfdb2c5779462e97c9c00c.cloudfront.net (CloudFront)
x-amz-cf-id: L25sxi0Fip45fGIw62vr7WK6yTYxiQyT0vVNjttmocemkHcpUFZxpw==
x-amz-cf-pop: IAD12-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: Kz8QuytoAUdoOYErMKVHQEQDV8D2oJ_g
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 24

GET
H2 200 chat
js.driftt.com/core/ Frame 605D 0
0 365ms
133ms Document
text/html 18.160.18.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1735544812072

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1735545000000/zdcd6x8yhg85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.18.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-18-96.iad12.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 30 Dec 2024 07:46:56 GMT
etag: W/"76ea1344fb697ec9177486a08c12338b"
last-modified: Thu, 19 Dec 2024 17:54:25 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
via: 1.1 a57d2f9cdddfdb2c5779462e97c9c00c.cloudfront.net (CloudFront)
x-amz-cf-id: rgqat8xc_NQK2_v4E20_MP_D81KpO0sPNzXkf9Qo1zxorOYyFV1-Zg==
x-amz-cf-pop: IAD12-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: Kz8QuytoAUdoOYErMKVHQEQDV8D2oJ_g
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 19

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
442 B 485ms
132ms XHR
text/html 2600:9000:2009:7e00:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=3bO21sEE17PvRFQntg3D9doa-R9-7TRgxzxID55hqUzSGRMJaJOn3Q==&api-version=v3
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/6e1424cff90e9cd4.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2009:7e00:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 85273
alt-svc: h3=":443"; ma=86400
x-cache: Error from cloudfront
x-amz-cf-id: kd6EWzfOl28szb791wbHz_MzIsn9pFttH_CoGxqK8ih-_MjA1i1CyQ==
date: Sun, 29 Dec 2024 08:05:44 GMT
content-type: text/html
vary: accept-encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 6bcd5dba28bbc19dcd3f4c10e978e8ee.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: IAD66-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 452 KB
139 KB 152ms
151ms Script
application/javascript 2607:f8b0:4004:c1f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-PZ3FE06790&l=dataLayer&cx=c&gtm=45He4cc1v830287785za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TJVVB7C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5524359a7e071ac32ac58cd4e4a08677eecc2af796e3147e368dac34c53ec164

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Mon, 30 Dec 2024 07:46:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:56 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 141677
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
analytics.google.com/g/ 0
0 377ms
129ms Fetch
text/plain 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-PZ3FE06790&gtm=45je4cc1v893336776z8830287785za200zb830287785&_p=1735544813811&_gaz=1&gcs=G111&gcd=13r3r3r3r5l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&gdid=dZTQ1Zm.dYWJhMj&cid=705380323.1735544817&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1735544816&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&dt=THREAT%20ANALYSIS%20REPORT%3A%20Inside%20the%20LockBit%20Arsenal%20-%20The%20StealBit%20Exfiltration%20Tool&en=Demandbase_Event&_fv=1&_nsi=1&_ss=1&ep.demandbase_audience=Residential&ep.demandbase_audience_segment=&ep.demandbase_city=Non-Company%20Visitor&ep.demandbase_company_name=Non-Company%20Visitor&ep.demandbase_country_name=Non-Company%20Visitor&ep.demandbase_employee_range=Non-Company%20Visitor&ep.demandbase_industry=Non-Company%20Visitor&ep.demandbase_revenue_range=Non-Company%20Visitor&ep.demandbase_sid=Non-Company%20Visitor&ep.demandbase_state=Non-Company%20Visitor&ep.demandbase_website=Non-Company%20Visitor&tfd=5076
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-PZ3FE06790&l=dataLayer&cx=c&gtm=45He4cc1v830287785za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cybereason.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:57 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
556 B 375ms
129ms Ping
text/plain 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-PZ3FE06790&cid=705380323.1735544817&gtm=45je4cc1v893336776z8830287785za200zb830287785&aip=1&dma=0&gcs=G111&gcd=13r3r3r3r5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-PZ3FE06790&l=dataLayer&cx=c&gtm=45He4cc1v830287785za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cybereason.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 07:46:57 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame D8FE 0
0 377ms
135ms Document
text/html 2607:f8b0:4004:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-PZ3FE06790&gacid=705380323.1735544817&gtm=45je4cc1v893336776z8830287785za200zb830287785&dma=0&gcs=G111&gcd=13r3r3r3r5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=803723319

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-PZ3FE06790&l=dataLayer&cx=c&gtm=45He4cc1v830287785za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 30 Dec 2024 07:46:57 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET ip.json
api.company-target.com/api/v3/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.company-target.com
URL: https://api.company-target.com/api/v3/ip.json?auth=demandbase_UBcrPOQv880H7H03hUjDU1ih1EpeWrsScR1YmUME&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&page_title=THREAT%20ANALYSIS%20REPORT%3A%20Inside%20the%20LockBit%20Arsenal%20-%20The%20StealBit%20Exfiltration%20Tool&referrer=

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.cybereason.com/	1970-01-21 02:05:46	Name: __cf_bm Value: n4UyHVlJmwVeLli1hF70_o6vND8xIx7xtW37k3fxf1c-1735544811-1.0.1.1-X8lmFLRDxc4lR26RqUfztyMRelMPAPqgKkLYeRnPWKqvnH2qACAWnwrNLk2zF2hnkPlClKN734Zm1_uNKTBrvw
.www.cybereason.com/	1969-12-31 23:59:59	Name: _cfuvid Value: QPp9EyGwQ6tD.G2Xu9MmNg8pa0oLaRE62ulc4Uhbgmg-1735544811976-0.0.1.1-604800000
.cybereason.com/	1970-01-21 10:51:19	Name: visid_incap_2710048 Value: NITQHN8/QYCZfF0Xqmchm+tPcmcAAAAAQUIPAAAAAAATIW/rGeQth5D0n7BaM03P
.cybereason.com/	1969-12-31 23:59:59	Name: nlbi_2710048 Value: RDrLA80GJiJ4zF3k2P/mMAAAAABtLOakyo44OvXqqDcrwWzy
.cybereason.com/	1969-12-31 23:59:59	Name: incap_ses_172_2710048 Value: lrWoaCoVXXXMmVFlShFjAutPcmcAAAAAFvXywnSqiWmNxA3X0OGC6A==
.hubspotusercontent-na1.net/	1970-01-21 02:05:46	Name: __cf_bm Value: 50KGu5pbYQULbPTsr0Ivl7k5pMTOjDuwQiQt7BYQTsU-1735544812-1.0.1.1-ZsSFEJNFlA8oBtz0MsWkNPtpjD26LgfoAgk5tRIihcK3hM64_9HN8yEo.4C9c0MxrcmJ.nQlnA.uoIYKdwP5kA
.hubspot.com/	1970-01-21 02:05:46	Name: __cf_bm Value: Xy86Gu7BlMF_cs3ViJ.GaaYyX452h6hjf4iPBPZKpxs-1735544813-1.0.1.1-4TmMRKdan_JYcMSnAodJ7O0fRhJDsz.OIX09Nj1LqIQdqqeSppvucBwLLX_Gl2nzFvMs5c0wxNw16CiurgyMiQ
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: mwGjs4S70R0cofYCgWER69COemTRcTXNPek6m.VNegQ-1735544813471-0.0.1.1-604800000
.hs-banner.com/	1970-01-21 02:05:46	Name: __cf_bm Value: EOSJ_9AEuIVxMfEELc56kjr1Bvt3z8.bq9h54xjJnHE-1735544813-1.0.1.1-sjPIz8cUQM0pVY8JZxdTfyskgT5JlwUkps1YBIkbUNMtXtHl5ogUyptcmdM92Ac7ZSYTsREPReQH03U3O8GIZg
.hs-analytics.net/	1970-01-21 02:05:46	Name: __cf_bm Value: A4ScMQuPxaaxoaV1lLkJ9tJXP5QflGZoGsn_neQJU84-1735544813-1.0.1.1-o7Ub3Q.IlJCv1xOt1FhanNRL15YTRJAdjhOJveBqvSknnxIbtA3TvISYKRQ86l4sYSIItohC.VmPMIbcmB7fAg
.hsforms.com/	1970-01-21 02:05:46	Name: __cf_bm Value: .SNlUfnaBA5t_Q0gHwMglBfkquqnoaE_T26NOOADwGo-1735544814-1.0.1.1-2zv.CtQ3ZMrYpiCcy_3zhxPsRM2R5koOeqp_xdAoqVR6iNsmhEnxQgbcW5D6LmHQ.4d9pAXeSfRVKouiqOVA_w
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: xgYTUhPS_NCPcB.iJTPz_6MdMofSOt7ArZfBAbOmLOc-1735544814117-0.0.1.1-604800000
.hs-scripts.com/	1970-01-21 02:05:46	Name: __cf_bm Value: BF5V7kQSCIJmmXpzbKAnlDy6NMJqx.5i.wT79Ew2mso-1735544814-1.0.1.1-lEJPsxVu30B37px4JsGwEoGJS5_xd_BxNwGo33ZqUe62Z.Fn.aEg7PzekQ90w05YKHaBHoNRyGo4P.Cc6vmCXQ
.cybereason.com/	1970-01-21 06:24:56	Name: __hstc Value: 85683782.f4104c5a7413db7de7b1f397f00e57ac.1735544814926.1735544814926.1735544814926.1
.cybereason.com/	1970-01-21 06:24:56	Name: hubspotutk Value: f4104c5a7413db7de7b1f397f00e57ac
.cybereason.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cybereason.com/	1970-01-21 02:05:46	Name: __hssc Value: 85683782.1.1735544814926
.cybereason.com/	1970-01-21 10:51:20	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sun+Dec+29+2024+21%3A46%3A55+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=6.38.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fresearch%2Fthreat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool&groups=C0001%3A1%2CC0003%3A1%2CSPD_BG%3A0%2CC0004%3A0%2CC0002%3A0
www.cybereason.com/	1970-01-21 02:05:46	Name: drift_campaign_refresh Value: a1c6c942-64b3-433f-b60e-022cfb1f75ce
.rlcdn.com/	1970-01-21 10:51:20	Name: rlas3 Value: CQvkVyts6H13jUbAp7CQhv2Vgsa/kvalb6wriSjDpog=
.rlcdn.com/	1970-01-21 03:32:08	Name: pxrc Value: CPCfybsGEgUI6AcQABIGCMrdKhAA
.casalemedia.com/	1970-01-21 10:51:20	Name: CMID Value: Z3JP8MAoIjcAAEClCsiyfQAA
.casalemedia.com/	1970-01-21 04:15:20	Name: CMPS Value: 2006
.casalemedia.com/	1970-01-21 04:15:20	Name: CMPRO Value: 2006
.company-target.com/	1970-01-21 11:41:44	Name: tuuid Value: 2f35b704-b705-413c-84e6-86471be116c5
.company-target.com/	1970-01-21 11:41:44	Name: tuuid_lu Value: 1735544816
.cybereason.com/	1970-01-21 11:41:44	Name: _ga_PZ3FE06790 Value: GS1.1.1735544816.1.0.1735544816.60.0.0
.cybereason.com/	1970-01-21 11:41:44	Name: _ga Value: GA1.1.705380323.1735544817
.tremorhub.com/	1970-01-21 10:51:41	Name: tvid Value: 86322de543b54d11aedb1b8401a7a67e
.tremorhub.com/	1970-01-21 11:41:44	Name: tv_UIDM Value: 6f4fe6f0-c9a2-4aaf-9819-3ba91c545bbd
.rubiconproject.com/	1970-01-21 10:51:20	Name: audit_p Value: 1\|nqPF0dohbL4C/vznX8LxHfZ2SstpcGgCAjgvjhZnUhQJD8deNwibMKOz1UF6aG67/xT1ZAUFd40wHTRO1/p4iJLoYn4tEwhGUVHG4ZjHcr22uxChsbnXgDBLwVepnvfkqueVz4JUmZakrO7fQOtoKGciw1mf2o2BVFGxpdJGiDeWvEnWSmTsitzpQ7vzkXQ/
.rubiconproject.com/	1970-01-21 10:51:20	Name: khaos Value: M5AQKNB7-1O-7T64
.rubiconproject.com/	1970-01-21 10:51:20	Name: khaos_p Value: M5AQKNB7-1O-7T64
.rubiconproject.com/	1970-01-21 10:51:20	Name: audit Value: 1\|nqPF0dohbL4C/vznX8LxHfZ2SstpcGgCAjgvjhZnUhQJD8deNwibMKOz1UF6aG67/xT1ZAUFd40wHTRO1/p4iJLoYn4tEwhGUVHG4ZjHcr22uxChsbnXgDBLwVepnvfkqueVz4JUmZakrO7fQOtoKGciw1mf2o2BVFGxpdJGiDeWvEnWSmTsitzpQ7vzkXQ/
.rubiconproject.com/	1970-01-21 04:15:20	Name: receive-cookie-deprecation Value: 1
.doubleclick.net/	1970-01-21 02:05:45	Name: test_cookie Value: CheckForPermission

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7052064.fs1.hubspotusercontent-na1.net
ajax.googleapis.com
analytics.google.com
api.company-target.com
app.hubspot.com
cdn.cookielaw.org
cdnjs.cloudflare.com
connect.facebook.net
cta-service-cms2.hubspot.com
fast.wistia.com
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
geolocation.onetrust.com
id.rlcdn.com
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
p.typekit.net
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
s.company-target.com
segments.company-target.com
stats.g.doubleclick.net
tag-logger.demandbase.com
tag.demandbase.com
td.doubleclick.net
track.hubspot.com
use.typekit.net
www.cybereason.com
www.googletagmanager.com
api.company-target.com
104.17.25.14
104.19.175.188
13.249.39.126
146.75.28.157
157.240.229.1
172.253.122.94
18.160.10.55
18.160.18.68
18.160.18.96
2600:1408:ec00:1e::1735:23ec
2600:1408:ec00:43::1737:b053
2600:1408:ec00:43::1737:b058
2600:9000:2009:7e00:1d:8d6d:3b40:93a1
2606:4700:4400::6812:28f0
2606:4700:4400::6812:297c
2606:4700:4400::ac40:9b77
2606:4700::6810:7574
2606:4700::6810:8bd1
2606:4700::6810:a0a8
2606:4700::6812:562a
2606:4700::6812:8c11
2607:f8b0:4004:c06::8a
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c09::9d
2607:f8b0:4004:c1d::5f
2607:f8b0:4004:c1d::9b
2607:f8b0:4004:c1f::61
2a04:4e42:600::644
34.96.71.22
35.244.154.8
45.60.62.106
99.84.188.56
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
02ea7d0808ff8988ec025b9675e9db94b104f5dbd2b6401b69a8d722b9c74022
05fa485aeffd65bceabb8816dcd6c8f06b2a9b265e8c5beb75ad865219cb77d2
09edf98c454b11870a1a667cacab183aaf34e51f53dedb3fa735b9afac34f402
0b281bf2f4179c06ba68f0a427f2341287c41eacc2ce9d534c6f5c513ac633fb
0b454edb897d49bf8a73b07627b670a55f0972988094770495a308e5a5e39d1b
0c33072c2e37faa2b2acd3f76a15c44139cadb7999ec9405382b67eab4161003
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0dfb22afe7173c577144301206aee5fa3939268bfefb7adb44906fa81cb7a1d2
0f94c946a13b9ebe43281550b7d0c00edf4694ad06bcb4c8679bee6d48df5115
119bf322a2ce6d2a82422b51404bc54b375c881f12a120205598d1691fa48820
12127e3110351f54262db955bafe353593dd58c89c7f6b6fc159c10515e93c61
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17770d05051a8a4f270ba5bdf049b90cc166ac42bd4513f419308a5804d7a161
17a31aae550a664382ab9d8085efc03a10a4548985f33ac4e5a533d5ab5e9339
1ef8b59b832109ecbec2f9ed52e8073e2ab73862fa5e6697e1fe05d1c8358a02
20e70ec8ff4b81afc46060a4ab434333dcda18f6eb4cc70d83857acb60e8a7eb
266d85b7ad351501b8651b0e659d6d74fbe07085d3226cd3f7601f6522fbdf97
2b14e8397d552f351a4396dec25ec5da1348865683100e94c4ab0faea4a9a254
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2ca281bdcd543e2e3559e6505c323c8d64df73f2a594a043780df3007e16d161
2d2c4912162eaa41299aaf5063ecb92a26d76071fe6d1f77742b32c833daab99
2ef6c164de3a10c6430495e2d71eccedf9ce99fa908e3ef7a634b2fec8ed33fa
334740680dcc014934905f29d95fa287624b3bd54a0a9a285abab2866761dd72
33ff6b6486bdc5883c2c63e8278e8a547ca86b1f6026667f7733fec6b52a1303
3515e02fe5788cfcd3d13d7475727a0ba88b9e1559c786e1fcbd2fe1b08452df
356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1
384ba71373dbad3d3022a9e548dbaf59b6c3c9920b5f4f86770609e89ca8112f
3867222dd164aabe123fb215f74e7addef42153d5b7798da96e7ff538800d9d5
38b5fa249791d286db654d516dfb6173cc332a8d725c41b58d08c642b26bc641
3a9e725bae41656623ccda8be25cbdd295ee1c73c8d3016023549a83c261a3ab
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3f086f2e7a55cb80a12eceb7ddc586416d24e259d04e17b88953f098f0b13786
42b2b9d16fbf8d3c6be72420699360790966e58fe30d8794fd90a71c8aef122d
458235328e4f7da4ccbe1e308d9f688e6cc5079212285f307cfa43e076c1dbee
4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09
50d93a2c186cbd1032ed973e133713a6dfbbd5f7fba4fb89069350f228ce4d81
510835fe8939dd32b7388d00f583d2f080f9d6bcfc2c9d21098407d000065c22
5524359a7e071ac32ac58cd4e4a08677eecc2af796e3147e368dac34c53ec164
599dd661a1d9e0af96d614fab0ea7396bf06de4265029166a265c2b10cc1a1b0
5c1fe57929a1874ecde1d1dc9e306ca3a8b4c188b2db1e324fce9e587a399ef5
5c8d63abd4075c4ebd692fbd02e35fb72950f214a6486607c1819d4279ad526f
5df47253a9b006c8f8f5894b52c6847488bae41c5f1b11925985b59e97a52f7a
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
65a923b747d84787bc4e01270fa29f4314d3d36df432cd3eb801c30f8adfd466
66ba9d76c09ad6dd52135d52c368f6d87ac40b5b4ce418e41a105fb221c7e470
674d5ab1e2c5a783115e67fabc4805ac2e8a83d48eb6a1ad3535c23a959a1801
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
72493a3f42ed0260f03b6ffd3ea131be38a1070845bfae24927f643a3fcf3255
72fe18777ebf37b44d58c82be9b67edceefb88c2c6984c614c72991d6e3b8853
757fec82c2e045d306d854ea0d8c47a89c39870f4dd399b1294e4da8854b228e
776cec61a9f36def61b4b86438402b91faa9814d3fa2ff7adbd9b4463a5c8dc2
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2
7ec04c16a86169fc61ae57b7d9a968e149b6f8339d12a8a86ea9a535dc38366a
81c836c05ab1f2d37b7aa60d509a656c7a441e2a4fabf035c1b0666a4daa50fa
82a2cc3acbc30e9442fbc259438e7a2d3a53eba702114e1b75f22fc8f3c68371
8320299532b4b81498d5b3714d49c9d5938883b55f4c2a1efe6f105bf4a942bd
843803aeba82f94da6f1cbe1f853ccd12f5d7cc6a3afa20923e57e5df60c412d
85ce42d99ae7d93a9df2304eedc16e1b26d492c38f5b9d034ea5c09c8a996c8f
86dbd997ead92464b9d3e6228dab6902a3f8cdbd17de1da8923cb2f0fb600bda
875f8e591b4fbc6567e2b33553bea9ca2d0e18593bd857783a569fe7bf4ba097
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8f657cd3617d00d51bbc4dee693b71bde939c80310034a8d82641804d4eb7e16
8fb95734be01fd3e163c6ebfb1c8d8d3f60e9339c7e4ec6a3040611cb1ed022c
99782de0a886ab8824e0009f6218e01e164265a693ead16cc9735d3320753971
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9cec59b071d9d61e74c42ac4db8d2815aaace7e51983afe2481c14b97f332258
9d943fe5fde08d5b742d383b625031f75e3e89035369f2cde2778f4c6cf5c119
9eb7fabe6f662e9e026fb996288d6e4e5b4fd739c45b260269a73b15eabcb7a3
a01210a2b1a7e2c2249e9afad4e30bf8c0d7feb7fb6d56badd923fa3bc1a992a
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a4803d7bdeb478a5b9238fe74d8aaa98dafe2e8e68fccbd0e3f4dced823f27f0
a6728e3326fe3805e12f697731cbc97f2a5b773533c1cb4be0c56da998a94db6
abb03b2160dd9f75fa8eb557ca242d7cd93f159d53708c58f4d2887bd4f05ead
ad3613f6714f248087ef8b414505604928b47c4de292557ac831bcd52f6ed0f3
b37ac51cd68881afe1defc5bf895c63fb863d55dd1e4a5f795f79f36f929d4c2
b48f9a7031474a0f73f92f2e6cbbfad730b5466cda96d86a4459c06efc986173
b6c9f9a48bd0a163671773a199c876dc64d66947d47ac509c95e29177046c9a3
c1014cf333957067f6bffe374ba8f655e7e885dc9da0d6ab9f36c8a2e41d7129
c19651289e75995debf229028dcaa3c66b58a4d2deda8fcafc2fda0fdd52e8bd
c571128321fdcbd922f806670945903b6f8badc36504ca0806ec006e3b75755b
c9130ee8c979a74ab038cf5e8a06db5cb94253eab35ea5242f515d605f4781ad
cb5224674e43d02db0037517f4aa29ba5ce9ddd0672e513cc7289714ba657522
d143ffe1d767f3bb4bc98fe1b1cd57234966fc5256c125e5f729ed8677775c49
d2dc69a7713956f320c388767418e6a83ae2696c8968ac1ea76dd84b1c1e58d8
d82231820461c83d1b0966caae71bd2732bd89e9a910fdb90d193c3dca16dbc7
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc248ca25d836534f5b20a9de238f1b570b765d548c23552536fe54dd3734c67
dd8ce52adc4b0ab60f82c29ba12f25e2f6446245fc8c0b5f4bd6dab3146f9ef7
e1d83417f3cc0bf5a3047f5b463b7abddb9a1aacdd94d54d5d6c4ef95e261426
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e90344957225c9e0caa52e2591fd6066740e0650bc100c422435762160fb2e33
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f24560f5b81158a42b8d38ffe5795d9959eb2308ee6780ea912a6594bb999d1e
f3f2822ba3d24c1f7f53bff8959801c644b2c1c556eb8c15ca36a86717f1ae7d
f64368e7be69abe40585911860d83acfa8b14179d3008b2594166ae4c10ec0fd
f6992602860083443a6e36d8a4189d2ab5275d43eb4f8a8728589b9bfd992da7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9db6465a204cc4186368b72a0ba4f063e64569aa4fc96e0f40c7ac69423121b
fcba0ef5c17fd435aaa6cfac66375e7bfae52f5116b7a6e126c8b0f38b841613
fd6c0f5026c29648ab8887658f23e6c57faedfe7f9d85e702823ae5dfcbdc8f0
ff46e29c0230c20a50ec8284fcdf4d929eb776199504af1b426baf6cefedcd95

www.cybereason.com Open in urlscan Pro 45.60.62.106 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

117 Requests

98 %HTTPS

59 %IPv6

25 Domains

35 Subdomains

32 IPs

2 Countries

4232 kBTransfer

8249 kBSize

36 Cookies

43 Outgoing links

Redirected requests

117 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cybereason.com Open in urlscan Pro
45.60.62.106 Public Scan

Screenshot
Live screenshot

Full Image

117
Requests

98 %
HTTPS

59 %
IPv6

25
Domains

35
Subdomains

32
IPs

2
Countries

4232 kB
Transfer

8249 kB
Size

36
Cookies

117 HTTP transactions
1 data transactions