www.anomali.com Open in urlscan Pro
2600:1f1c:4b7:6680:5601:58d5:7a57:c91b Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Submission: On November 24 via api (November 24th 2021, 6:14:11 am UTC) from GB — Scanned from GB

Summary HTTP 61 Redirects Links 42 Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 18 domains to perform 61 HTTP transactions. The main IP is 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.anomali.com.
TLS certificate: Issued by R3 on October 27th 2021. Valid for: 3 months.

This is the only time www.anomali.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	2600:1f1c:4b7... 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b	16509 (AMAZON-02) (AMAZON-02)
6	46.137.132.32 46.137.132.32	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:7c00:9:14eb:6280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
7	2600:9000:215... 2600:9000:2156:9400:12:deac:e8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
6	143.204.98.87 143.204.98.87	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	52.20.96.200 52.20.96.200	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c1b::9b	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:45b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:14bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	143.204.98.15 143.204.98.15	16509 (AMAZON-02) (AMAZON-02)
7	18.211.154.252 18.211.154.252	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.98.74 143.204.98.74	16509 (AMAZON-02) (AMAZON-02)
61	20

9 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b (San Jose, United States)

ASN16509 (AMAZON-02, US)

www.anomali.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 46.137.132.32 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com

tribl.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:7c00:9:14eb:6280:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2i34c80a0ftze.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:2156:9400:12:deac:e8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

anomali.cdn.rackfoundry.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 143.204.98.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-87.fra50.r.cloudfront.net

st.fullcircleinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.20.96.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-96-200.compute-1.amazonaws.com

lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1b::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:45b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:14bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.98.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-15.fra50.r.cloudfront.net

assets.trendemon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.211.154.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-154-252.compute-1.amazonaws.com

trackingapi.trendemon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.74 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-74.fra50.r.cloudfront.net

pic.trendemon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	trendemon.com assets.trendemon.com trackingapi.trendemon.com pic.trendemon.com	52 KB
9	anomali.com www.anomali.com	580 KB
7	gstatic.com fonts.gstatic.com	138 KB
7	rackfoundry.net anomali.cdn.rackfoundry.net	220 KB
6	fullcircleinsights.com st.fullcircleinsights.com	7 KB
6	tribl.io tribl.io	17 KB
3	google-analytics.com www.google-analytics.com	20 KB
2	facebook.com www.facebook.com	386 B
2	facebook.net connect.facebook.net	113 KB
1	hubspot.com track.hubspot.com	1003 B
1	hs-banner.com js.hs-banner.com	16 KB
1	hs-analytics.net js.hs-analytics.net	21 KB
1	doubleclick.net stats.g.doubleclick.net	439 B
1	lltrck.com lltrck.com
1	zoominfo.com ws.zoominfo.com	678 B
1	hs-scripts.com js.hs-scripts.com	866 B
1	googleapis.com fonts.googleapis.com	1 KB
1	cloudfront.net d2i34c80a0ftze.cloudfront.net	10 KB
61	18

	Domain	Requested by
9	www.anomali.com	www.anomali.com
7	trackingapi.trendemon.com	assets.trendemon.com
7	fonts.gstatic.com	fonts.googleapis.com
7	anomali.cdn.rackfoundry.net	www.anomali.com
6	st.fullcircleinsights.com	d2i34c80a0ftze.cloudfront.net
6	tribl.io	www.anomali.com tribl.io
3	www.google-analytics.com	www.anomali.com www.google-analytics.com
2	assets.trendemon.com	www.anomali.com assets.trendemon.com
2	www.facebook.com	www.anomali.com
2	connect.facebook.net	www.anomali.com connect.facebook.net
1	pic.trendemon.com
1	track.hubspot.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	lltrck.com	www.anomali.com
1	ws.zoominfo.com	www.anomali.com
1	js.hs-scripts.com	www.anomali.com
1	fonts.googleapis.com	www.anomali.com
1	d2i34c80a0ftze.cloudfront.net	www.anomali.com
61	20

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.bleepingcomputer.com
ui.threatstream.com
www.infosecurity-magazine.com
blog.malwarebytes.com
us-cert.cisa.gov
research.checkpoint.com
threatpost.com
anomali.channeltivity.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
anomali.com R3	`2021-10-27` - `2022-01-25`	3 months	crt.sh
tribl.io R3	`2021-11-12` - `2022-02-10`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cdn.rackfoundry.net Amazon	`2021-01-21` - `2022-02-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-04` - `2022-07-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-02` - `2021-12-01`	3 months	crt.sh
aws-st.fullcircleinsights.com Amazon	`2021-06-28` - `2022-07-27`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2021-06-04` - `2022-06-03`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2021-07-25` - `2022-08-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2021-06-26` - `2022-06-25`	a year	crt.sh
*.trendemon.com SSL.com RSA SSL subCA	`2021-06-27` - `2022-07-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Frame ID: 3F2AF2925FE85747ADABCF1B7C6A4762
Requests: 58 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anomali Cyber Watch: APT, Emotet, Iran, RedCurl and More | Anomali

Page Statistics

61
Requests

100 %
HTTPS

70 %
IPv6

18
Domains

20
Subdomains

20
IPs

4
Countries

1199 kB
Transfer

2697 kB
Size

26
Cookies

42 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/intent/tweet?text=Anomali%20Cyber%20Watch:%20APT,%20Emotet,%20Iran,%20RedCurl%20and%20More&via=Anomali&ref_src=Anomali&original_referer=https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more&url=https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more&title=Anomali%20Cyber%20Watch:%20APT,%20Emotet,%20Iran,%20RedCurl%20and%20More&summary=&source=Anomali

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Title: Emotet malware is back and rebuilding its botnet via TrickBot

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3905074?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Phishing - T1566

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3905084?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Shared Modules - T1129

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947266?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Data Encrypted - T1022

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3904527?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Ingress Tool Transfer - T1105

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947117?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Automated Collection - T1119

Search URL Search Domain Scan URL

URL: https://www.infosecurity-magazine.com/news/wind-turbine-giant-offline-after/
Title: Wind Turbine Giant Offline After Cyber Incident

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/11/patch-now-fatpipe-vpn-zero-day-actively-exploited/
Title: Patch Now! FatPipe VPN Zero-day Actively Exploited

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3906161?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Command and Scripting Interpreter - T1059

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947233?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Exploitation for Privilege Escalation - T1068

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947194?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Indicator Removal on Host - T1070

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947258?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Bypass User Account Control - T1088

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947247?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Web Shell - T1100

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947094?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] External Remote Services - T1133

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947138?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Exploit Public-Facing Application - T1190

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947217?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Exploitation of Remote Services - T1210

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3905767?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Modify Authentication Process - T1556

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/redcurl-corporate-espionage-hackers-resume-attacks-with-updated-tools/
Title: RedCurl Corporate Espionage Hackers Resume Attacks with Updated Tools

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947135?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Data from Local System - T1005

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947195?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] File and Directory Discovery - T1083

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3904494?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Exfiltration Over C2 Channel - T1041

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947180?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Spearphishing Attachment - T1193

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947153?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Scheduled Transfer - T1029

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/3905359?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Proxy - T1090

Search URL Search Domain Scan URL

URL: https://us-cert.cisa.gov/ncas/current-activity/2021/11/17/iranian-government-sponsored-apt-cyber-actors-exploiting-microsoft
Title: Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/2402531?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Data Encrypted for Impact - T1486

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/microsoft/new-microsoft-emergency-updates-fix-windows-server-auth-issues/
Title: New Microsoft emergency updates fix Windows Server auth issues

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
Title: Uncovering MosesStaff techniques: Ideology over Money

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947187?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] System Network Configuration Discovery - T1016

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947207?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Process Discovery - T1057

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947244?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Exploitation for Client Execution - T1203

Search URL Search Domain Scan URL

URL: https://threatpost.com/intel-processor-bug-encryption-keys/176355/
Title: High-Severity Intel Processor Bug Exposes Encryption Keys

Search URL Search Domain Scan URL

URL: https://ui.threatstream.com/ttp/947118?__hstc=41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1&__hssc=41179005.1.1637734445915&__hsfp=808429732
Title: [MITRE ATT&CK] Clipboard Data - T1115

Search URL Search Domain Scan URL

URL: https://anomali.channeltivity.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://twitter.com/anomali
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/anomali_inc/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.facebook.com/threatstream
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/anomali
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCloYBsWSqk_5x7gdpOn4y8g
Title: YouTube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

61 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request anomali-cyber-watch-apt-emotet-iran-redcurl-and-more Show response
www.anomali.com/blog/ 56 KB
15 KB 727ms
210ms Document
text/html 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ef0926157f82e546a917d742d9b9afceb1333945e9f4f80301159c3b2b23e882

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-GB,en;q=0.9

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Expires: Thu, 23 Dec 2021 20:37:56 GMT
Last-Modified: Tue, 23 Nov 2021 20:37:56 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Length: 13943
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK h.js Show response
tribl.io/ 2 KB
1 KB 127ms
51ms Script
text/plain 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tribl.io/h.js?orgId=O8naez8e2eHPYn7m991b
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 7af50cf95aee25377e0d294dfd490228f7bfa3829a47298137dd3495811cb4c3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
ContentType: text/javascript
P3P: CP="Triblio does not have a P3P policy."
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 833

GET
H2 200 fullcircle.js Show response
d2i34c80a0ftze.cloudfront.net/ 30 KB
10 KB 129ms
34ms Script
application/json 2600:9000:2156:7c00:9:14eb:6280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=89e085f3-5a30-494c-87ce-c5df4aacd29b&domain=anomali.com
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:7c00:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5c682e5c6c28f9fd1dfdc40c07e35b712d37fdcdb04f7452ede8f8380f99162d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 19:15:32 GMT
via: 1.1 fd4a8fa7c304171992e7f22fc8894905.cloudfront.net (CloudFront), 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
age: 39511
x-amzn-requestid: 432dffa3-12b8-49f7-8eae-24646cc481d5
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-619d3dd4-1e6d1c630699892208c082ef;Sampled=0
x-amz-cf-pop: FRA60-P1, FRA50-C1
content-encoding: gzip
x-amz-apigw-id: JRaZRHxXvHcFgOQ=
x-amz-cf-id: eUWvUBBhmJHApjNZZi6DIdOgdPmjggSjrUWrgVgPjbxNT9NnypVoVg==

GET
H2 200 css2
fonts.googleapis.com/ 15 KB
1 KB 114ms
39ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3228ae69eff9f480fffba461d687b056902d9c9ac38dadab45234e62aad3312e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 06:14:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Nov 2021 06:14:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Nov 2021 06:14:04 GMT

GET
H/1.1 200
OK e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
www.anomali.com/cache/ 475 KB
69 KB 294ms
206ms Stylesheet
text/css 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

76c53e5125ff430ee41a17469d78d46f93219d407411382a4607154999d28a98

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
Last-Modified: Sun, 03 Oct 2021 01:19:10 GMT
Server: Apache
ETag: "76c5b-5cd68956ce279-gzip"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: text/css
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Expires: Thu, 24 Nov 2022 06:14:04 GMT

GET
H2 200 anomali-logo.svg
anomali.cdn.rackfoundry.net/assets/images/ 2 KB
2 KB 150ms
30ms Image
image/svg+xml 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/assets/images/anomali-logo.svg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9007c069595e9a8f92c35ec1a6acbc74de043eb7fff18bf6a3e42f96267cb796

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 06:25:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5442513
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains;
content-length: 969
last-modified: Tue, 03 Aug 2021 06:00:13 GMT
server: Apache
etag: "8e2-5c8a16631c6eb-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: SG6f-CKTXrOcHnBxXrJJKhJ-ElZ5CGycv2v09u9yGUP_4vi30pvYJQ==
expires: Thu, 22 Sep 2022 06:25:31 GMT

GET
H2 200 anomali-logo-color.svg
anomali.cdn.rackfoundry.net/assets/images/ 2 KB
2 KB 30ms
30ms Image
image/svg+xml 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/assets/images/anomali-logo-color.svg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d6acccd02f291101d54b680470950868abf0e9bfbb44c7561ec0ed81a0d2487f

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 05:51:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5185357
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains;
content-length: 873
last-modified: Sat, 25 Sep 2021 05:41:05 GMT
server: Apache
etag: "7fd-5cccb4f5de810-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: TqcuYC9JB4WCyTjVvwpeqNVgwJ0Fmpe1IFa41P9X63xOiS0snmBJ4g==
expires: Sun, 25 Sep 2022 05:51:27 GMT

GET
H2 200 promo-sunburst.jpg
anomali.cdn.rackfoundry.net/images/uploads/home/promos/ 87 KB
87 KB 38ms
37ms Image
image/jpeg 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/images/uploads/home/promos/promo-sunburst.jpg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

dd3523383caaee7ac9379df0e04308bd50274fa1c845ae61ef03c7dc0140d505

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 17:22:14 GMT
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 3415910
x-cache: Hit from cloudfront
content-length: 88584
last-modified: Thu, 24 Dec 2020 01:19:59 GMT
server: Apache
etag: "15a08-5b72b9b3f8eab"
strict-transport-security: max-age=31536000; includeSubDomains;
content-type: image/jpeg
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: nUC7NXyZ5bJ9reuQFHWOE_TbypoZaA5yzjHOysVHk9x5_c7PRzjMfQ==
expires: Sat, 15 Oct 2022 17:22:14 GMT

GET
H2 200 avatar_6.png
anomali.cdn.rackfoundry.net/images/avatars/ 14 KB
15 KB 33ms
33ms Image
image/png 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/images/avatars/avatar_6.png

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

24f3c5e5d219ad64386debdb56d6e447f6fe88668829af345b9709a2bb0f6958

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 06:42:21 GMT
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5441503
x-cache: Hit from cloudfront
content-length: 14335
last-modified: Sat, 22 Aug 2020 00:23:15 GMT
server: Apache
etag: "37ff-5ad6c5bfebae6"
strict-transport-security: max-age=31536000; includeSubDomains;
content-type: image/png
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 6kG4nqrFNy2-UQbfIMCvNB2RQ8JWt28Ff_V4UvJ7hBUPmneoBuDrQw==
expires: Thu, 22 Sep 2022 06:42:21 GMT

GET
H2 200 anomali-cyber-watch.jpg
anomali.cdn.rackfoundry.net/images/uploads/blog/ 111 KB
112 KB 39ms
39ms Image
image/jpeg 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/images/uploads/blog/anomali-cyber-watch.jpg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

69f29684b4e7156ee24547dbb2a7271feb3823500ea7b9dbccb85343c5631447

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 17:51:51 GMT
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 649333
x-cache: Hit from cloudfront
content-length: 114021
last-modified: Tue, 02 Mar 2021 05:47:20 GMT
server: Apache
etag: "1bd65-5bc8744947ca1"
strict-transport-security: max-age=31536000; includeSubDomains;
content-type: image/jpeg
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 00jYtxYo0ZAofBcDlz4LK7o0w1zE16w5AaoslDQ1_x2YXDR6J-wjnQ==
expires: Wed, 16 Nov 2022 17:51:51 GMT

GET
H/1.1 200
OK acw-11232021.png
www.anomali.com/images/uploads/blog/ 76 KB
77 KB 191ms
190ms Image
image/png 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.anomali.com/images/uploads/blog/acw-11232021.png

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d058626c8165ed74ee81d5ffa956675ccd253360b3fa362ccb88c2754d35c0d

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Nov 2021 20:32:34 GMT
Server: Apache
ETag: "13111-5d17aa4326308"
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: image/png
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 78097
Expires: Thu, 24 Nov 2022 06:14:04 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 98ms
29ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4377
date: Wed, 24 Nov 2021 05:01:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 24 Nov 2021 07:01:07 GMT

GET
H2 200 blog_small_arrow.svg
anomali.cdn.rackfoundry.net/files/svg/ 499 B
1 KB 34ms
32ms Image
image/svg+xml 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/files/svg/blog_small_arrow.svg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

30247563a88aac311960f008072fcb547943149dd2d655c7dcc604504ba9a92f

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 06:25:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5442512
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains;
content-length: 317
last-modified: Tue, 04 May 2021 19:05:58 GMT
server: Apache
etag: "1f3-5c185c4b02ecc-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: LHDwb2g9887PuLO5cIo-6CJtKOmzoiIolQRaWgsJ8Ur9VOQXuBfoGQ==
expires: Thu, 22 Sep 2022 06:25:32 GMT

GET
H2 200 blog_subhead_arrow.svg
anomali.cdn.rackfoundry.net/files/svg/ 437 B
1 KB 34ms
32ms Image
image/svg+xml 2600:9000:2156:9400:12:deac:e8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://anomali.cdn.rackfoundry.net/files/svg/blog_subhead_arrow.svg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:9400:12:deac:e8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ece0d13e399a6aaaa3e357ba76cd4c9f18c1bbe0f13e2fc41232f2e0a7c9e4b1

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 06:25:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5442513
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains;
content-length: 290
last-modified: Tue, 04 May 2021 19:18:25 GMT
server: Apache
etag: "1b5-5c185f13d94ef-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: SA1F3TrOyPH1H54sDc-nMiZl01ANI2pC2VU3GJFxWwgs2ZLpvy4TJA==
expires: Thu, 22 Sep 2022 06:25:31 GMT

GET
H/1.1 200
OK a22d1d868692973288e25c89f766247feac6353d.1633223950.js Show response
www.anomali.com/cache/ 547 KB
133 KB 226ms
225ms Script
application/javascript 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.anomali.com/cache/a22d1d868692973288e25c89f766247feac6353d.1633223950.js

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e43bff2b3d92a5961865d37cd8f6b4403434eb64c73558fb7b0d9cef3a9f6d45

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
Last-Modified: Sun, 03 Oct 2021 01:19:11 GMT
Server: Apache
ETag: "88ca6-5cd6895709b9c-gzip"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: application/javascript
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Expires: Thu, 24 Nov 2022 06:14:04 GMT

GET
H2 200 458120.js Show response
js.hs-scripts.com/ 877 B
866 B 178ms
69ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/458120.js
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39af318c5162a69cccae2300c512e8e69f1b14f047d710456270a7bc94ff498b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 14
cf-polished: origSize=984
x-hubspot-correlation-id: 6fecbeba-f412-4eaa-b8f9-30a11191bb17
last-modified: Wed, 24 Nov 2021 06:13:51 GMT
server: cloudflare
x-trace: 2B318F05700C736A485E4716693987A04FEAB5713C000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.anomali.com
expires: Wed, 24 Nov 2021 06:15:05 GMT
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 6b307eb92d315a3d-MXP
cf-bgj: minify

GET
H/1.1 200
OK footer.js Show response
tribl.io/ 2 KB
2 KB 32ms
31ms Script
text/plain 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tribl.io/footer.js?orgId=O8naez8e2eHPYn7m991b
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 58a4b784a220265473782fb69a5ce39c12e20af32a7a8999323ca005ab4350b5

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
ContentType: text/javascript
P3P: CP="Triblio does not have a P3P policy."
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 1056

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 90ms
29ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: BU+0p4HfF9oC3viGIVZmPevdtZpTrQgOv9HBEd7ZyGf3Ukj6kpMWwGbMOqhPobZTS00XMLQ886gzTb3gF5w5Gg==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 24 Nov 2021 06:14:04 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

OPTIONS
H2 200 create
st.fullcircleinsights.com/v1/visitors/ 0
0 624ms
494ms Preflight
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: origin-fci,x-api-key
Origin: https://www.anomali.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 1
date: Wed, 24 Nov 2021 06:14:05 GMT
x-amzn-requestid: cc649cbf-ab5c-4a08-bb10-3e0c879ae9b3
access-control-allow-origin: https://www.anomali.com
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci
x-amz-apigw-id: JS63EF2GPHcFSsw=
access-control-allow-methods: OPTIONS,POST
x-cache: Miss from cloudfront
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: izOl2uRHLBPsD-a5WaKgFKMbMAIssFVJtJUJpBaLpSOODtzRy5TOMw==

POST
H2 200 create Show response
st.fullcircleinsights.com/v1/visitors/ 1 KB
2 KB 561ms
561ms XHR
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=89e085f3-5a30-494c-87ce-c5df4aacd29b&domain=anomali.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash: c4cdae87a5a8303157e74e2008ffed918cb6fc2bcea4a41bb384ead327c347ad

Request headers

origin-fci: https://www.anomali.com
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
x-api-key: IzsA4yOUOh9vPSgEBzJIg9sQK3xz2f6x2000qAXa
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amzn-requestid: 9ecf466b-10d6-444e-a9a5-2b896464ead8
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.anomali.com
x-amzn-trace-id: Root=1-619dd82d-617432e31c332f85616e8f57;Sampled=0
x-amz-apigw-id: JS63JHWNPHcF3qQ=
content-length: 1407
x-amz-cf-id: GuRcR_cOyTAmaDal9Ll-vMyGSFBh8KxnErDP6AU1CRYRPdC1oNAYUw==

GET
H2 200 2NTdNVxw8uLL0HhQZABg Show response
ws.zoominfo.com/pixel/ 0
678 B 344ms
226ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2NTdNVxw8uLL0HhQZABg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 6b307eb93def3758-MXP
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length: 0

GET
H/1.1 200
OK bg-hero-default.jpg
www.anomali.com/images/uploads/backgrounds/ 72 KB
73 KB 678ms
194ms Image
image/jpeg 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.anomali.com/images/uploads/backgrounds/bg-hero-default.jpg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

1265b1ae11c361143c7bdd1ad239726e1b492ff0d7df8aa308d57ceb8047287a

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 28 Jan 2021 00:40:59 GMT
Server: Apache
ETag: "1217a-5b9eb24323a26"
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 74106
Expires: Thu, 24 Nov 2022 06:14:05 GMT

GET
H/1.1 200
OK blog_small_arrow.svg
www.anomali.com/files/svg/ 499 B
1 KB 835ms
342ms Image
image/svg+xml 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.anomali.com/files/svg/blog_small_arrow.svg

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

30247563a88aac311960f008072fcb547943149dd2d655c7dcc604504ba9a92f

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 317
Last-Modified: Tue, 04 May 2021 19:05:58 GMT
Server: Apache
ETag: "1f3-5c185c4b02ecc-gzip"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: image/svg+xml
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Expires: Thu, 24 Nov 2022 06:14:05 GMT

GET
H/1.1 200
OK bg-white-gradient.png
www.anomali.com/assets/images/ 268 B
1 KB 828ms
335ms Image
image/png 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.anomali.com/assets/images/bg-white-gradient.png

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

18bd4be1ae80d75c34981d8e3b00afd34e066a8de53de52780f0740efc0fb9b9

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 03 Oct 2021 01:19:10 GMT
Server: Apache
ETag: "10c-5cd68956e0b5a"
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: image/png
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 268
Expires: Thu, 24 Nov 2022 06:14:05 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
20 KB 138ms
68ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:40:37 GMT
x-content-type-options: nosniff
age: 570807
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 15:40:37 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
20 KB 116ms
46ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13eb615165c92892fcd46e01782dd0fc52d36f236f883aad488c2cf4dcf9206e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 20:14:30 GMT
x-content-type-options: nosniff
age: 554374
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19868
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:31 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 20:14:30 GMT

GET
H/1.1 200
OK fa-solid-900.woff2
www.anomali.com/assets/fonts/ 134 KB
135 KB 490ms
178ms Font
font/woff2 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.anomali.com/assets/fonts/fa-solid-900.woff2

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8d4d29042c23b5fcbed3af690421776de0f8ad3d308d66e24a9d80bcc8ccb522

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 03 Oct 2021 01:19:10 GMT
Server: Apache
ETag: "21790-5cd68956c9459"
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: font/woff2
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 137104
Expires: Thu, 24 Nov 2022 06:14:05 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
19 KB 132ms
62ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 19:58:58 GMT
x-content-type-options: nosniff
age: 36906
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19824
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:37 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 23 Nov 2022 19:58:58 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_cJD3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
19 KB 122ms
53ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_cJD3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2904b98dfb86ac37a4ed1e33585980adbcbeb63b8802a641fc64615ef7360223

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 18:07:16 GMT
x-content-type-options: nosniff
age: 43608
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19536
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:19:41 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 23 Nov 2022 18:07:16 GMT

GET
H/1.1 200
OK fa-brands-400.woff2
www.anomali.com/assets/fonts/ 75 KB
76 KB 542ms
196ms Font
font/woff2 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.anomali.com/assets/fonts/fa-brands-400.woff2

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1f1c:4b7:6680:5601:58d5:7a57:c91b San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

39c658ef377f9ec31442c5343a15bdfc4c4653bcca74bc7d6fe4b3e736a60aa4

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.anomali.com/cache/e81fe80b777a82c7598ed9fce56d54999f8fbf37.1633223950.css
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 03 Oct 2021 01:19:10 GMT
Server: Apache
ETag: "12bb8-5cd68956d5f79"
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Content-Type: font/woff2
Cache-Control: max-age=31536000
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 76728
Expires: Thu, 24 Nov 2022 06:14:05 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 20 KB
20 KB 97ms
29ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 06:44:42 GMT
x-content-type-options: nosniff
age: 430162
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 19 Nov 2022 06:44:42 GMT

GET
H2 200 JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v18/ 20 KB
20 KB 142ms
73ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec83f9cccd120b3497a09d26618b516b2bd2c8e0e930919c0eda5516991901f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 18:02:31 GMT
x-content-type-options: nosniff
age: 43893
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20248
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 23 Nov 2022 18:02:31 GMT

GET
H2 200 JTUPjIg1_i6t8kCHKm459WxZcgvz_PZw.woff2
fonts.gstatic.com/s/montserrat/v18/ 20 KB
20 KB 145ms
77ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUPjIg1_i6t8kCHKm459WxZcgvz_PZw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a4722f7c6bfc8ed582a1da7f4e552be5350efe348638b31ec4a1291963c8e8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.anomali.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 20 Nov 2021 12:42:18 GMT
x-content-type-options: nosniff
age: 322306
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20516
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:21:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sun, 20 Nov 2022 12:42:18 GMT

GET
H/1.1 200
OK firm_tracking.js Show response
tribl.io/ 20 KB
5 KB 39ms
39ms Script
text/plain 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tribl.io/firm_tracking.js?orgId=O8naez8e2eHPYn7m991b
Requested by: Host: tribl.io
URL: https://tribl.io/footer.js?orgId=O8naez8e2eHPYn7m991b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e2a8f87d29a4c1405ecbf52ab931679b9cfe4a5281587d6c45991cedd3306e5c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
ContentType: text/javascript
P3P: CP="Triblio does not have a P3P policy."
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 4706

GET
H/1.1 200
OK analytics-f.js Show response
tribl.io/ 25 KB
8 KB 73ms
33ms Script
application/javascript 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tribl.io/analytics-f.js
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 46540cba6c2149745a32c8e700768e799221305fecbb3e22cc9cddba8c6fceb4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 06:14:04 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Nov 2021 02:52:47 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: W/"6189e27f-6307"
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 403 lt-v3.js
lltrck.com/scripts/ 0
0 283ms
90ms Script
text/html 52.20.96.200
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lltrck.com/scripts/lt-v3.js?llid=26138
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.96.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-96-200.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 2115220198489652 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 31ms
30ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2115220198489652?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b0a17d7cf327c6e12000435914d90d8415812ed1ed2eadc31c09491cb242535a

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 88879
x-xss-protection: 0
pragma: public
x-fb-debug: TgwMQ6GUQDKhrbsHUJDtMTBFo9WhFW/5g6LcyZtJ77h2jAj2q4Gyo0qThDDkEvq0XYZKhghO6sAzXUFF7WVPJA==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 24 Nov 2021 06:14:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
147 B 37ms
36ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=772091043&t=pageview&_s=1&dl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&ul=en-us&de=UTF-8&dt=Anomali%20Cyber%20Watch%3A%20APT%2C%20Emotet%2C%20Iran%2C%20RedCurl%20and%20More%20%7C%20Anomali&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=954786491&gjid=57721899&cid=806547541.1637734445&tid=UA-38132735-1&_gid=1334560963.1637734445&_r=1&_slc=1&z=379138747

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.anomali.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 29ms
29ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=772091043&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&ul=en-us&de=UTF-8&dt=Anomali%20Cyber%20Watch%3A%20APT%2C%20Emotet%2C%20Iran%2C%20RedCurl%20and%20More%20%7C%20Anomali&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAAABAAAAAC~&jid=&gjid=&cid=806547541.1637734445&tid=UA-38132735-1&_gid=1334560963.1637734445&cd4=M%20247%20Ltd%20London%20Infrastructure&cd5=N%2FA&z=962990366

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Nov 2021 08:17:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 79006
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
439 B 75ms
24ms XHR
text/plain 2a00:1450:400c:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-38132735-1&cid=806547541.1637734445&jid=954786491&gjid=57721899&_gid=1334560963.1637734445&_u=IEBAAAAAAAAAAC~&z=170900323

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 24 Nov 2021 06:14:05 GMT
content-type: text/plain
access-control-allow-origin: https://www.anomali.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 458120.js Show response
js.hs-analytics.net/analytics/1637734200000/ 72 KB
21 KB 174ms
70ms Script
text/javascript 2606:4700::6811:45b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1637734200000/458120.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/458120.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:45b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bb0d200a2e50741dde8adac7f725a3ad2b0d8d10884e5bbfaef338ff74f9902

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 14
x-amz-server-side-encryption: AES256
x-amz-request-id: FJTSNDFC4BM205DD
x-amz-id-2: 0tDFiBJ9CqXCxIFybBuUQOocvKdDewAo5RRF5a17G6RvXBYSjGyOex0miRNJRMpNBs8Y/JpN+Vc=
last-modified: Mon, 19 Jul 2021 14:03:56 GMT
server: cloudflare
etag: W/"c3592916383ed77fa6d1c198b0f9d821"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-ray: 6b307eba7cc8e8f3-MXP
expires: Wed, 24 Nov 2021 06:18:51 GMT

GET
H2 200 458120.js Show response
js.hs-banner.com/ 61 KB
16 KB 587ms
479ms Script
text/javascript 2606:4700::6812:14bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/458120.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/458120.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07f768a6e8c21b30d1327cab4d290b990aa8b847c2b72a19167c8b9713d7028d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: X3MYYYQPQJ7M6362
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-id-2: c2u3KFYMKzbjclu8sc+F3+fQSwzkk5BnJKE+/aIfCKgYby1kLFZ9fyWzsjun5Jc5BR46MGs4cc0=
timing-allow-origin: *
last-modified: Fri, 03 Sep 2021 19:26:39 GMT
server: cloudflare
etag: W/"ee57c6401c2a1fd9918963c3caf15e6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: n962A4NjVjJjOH.Vh4y4f4lgdTXztrZy
access-control-allow-origin: https://www.anomali.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 6b307eba8cca0e22-MXP
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Wed, 24 Nov 2021 06:19:05 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 88ms
29ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2115220198489652&ev=PageView&dl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&rl=&if=false&ts=1637734445146&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1637734445145.1953829745&it=1637734445043&coo=false&exp=p0&rqm=GET

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 24 Nov 2021 06:14:05 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 60ms
29ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2115220198489652&ev=Microdata&dl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&rl=&if=false&ts=1637734445649&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Anomali%20Cyber%20Watch%3A%20APT%2C%20Emotet%2C%20Iran%2C%20RedCurl%20and%20More%20%7C%20Anomali%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Anomali%20Cyber%20Watch%3A%20APT%2C%20Emotet%2C%20Iran%2C%20RedCurl%20and%20More%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fanomali.cdn.rackfoundry.net%2Fimages%2Fmade%2Fimages%2Fuploads%2Fblog%2Foganomali-cyber-watch_1200_630.jpg%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1637734445145.1953829745&it=1637734445043&coo=false&es=automatic&tm=3&exp=p0&rqm=GET

Requested by

Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
expires: Wed, 24 Nov 2021 06:14:05 GMT

OPTIONS
H2 200 queue
st.fullcircleinsights.com/v1/visits/ 0
0 495ms
494ms Preflight
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: origin-fci,x-api-key
Origin: https://www.anomali.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 1
date: Wed, 24 Nov 2021 06:14:06 GMT
x-amzn-requestid: e16487d1-30d3-476d-9c49-f6e261841516
access-control-allow-origin: https://www.anomali.com
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci
x-amz-apigw-id: JS63PHT2PHcFVNw=
access-control-allow-methods: OPTIONS,POST
x-cache: Miss from cloudfront
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: CHptf2fDFLevE3Cbtv9UKwIvvYLVnra-4ePldaa65eK3UA9B_vtg5Q==

POST
H2 200 queue Show response
st.fullcircleinsights.com/v1/visits/ 2 KB
2 KB 565ms
564ms XHR
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=89e085f3-5a30-494c-87ce-c5df4aacd29b&domain=anomali.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash: 79a2aa24ed9f9bc786540454a7f1e01f16a01352ccfddc8a2425463c2d4f8ebb

Request headers

origin-fci: https://www.anomali.com
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
x-api-key: IzsA4yOUOh9vPSgEBzJIg9sQK3xz2f6x2000qAXa
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Nov 2021 06:14:06 GMT
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amzn-requestid: d3c68a76-dc73-443a-b0e9-2e573b4e9365
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.anomali.com
x-amzn-trace-id: Root=1-619dd82e-2e4143172782135214f743a8;Sampled=0
x-amz-apigw-id: JS63UGbvPHcF6Ew=
content-length: 2027
x-amz-cf-id: JNxWBSSDLwpSmVot3Pyq1Evq4B29M7C5FNDSdIIcoAIZ2XeC7qQZIw==

OPTIONS
H2 200 queue
st.fullcircleinsights.com/v1/visits/ 0
0 511ms
510ms Preflight
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: origin-fci,x-api-key
Origin: https://www.anomali.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 1
date: Wed, 24 Nov 2021 06:14:06 GMT
x-amzn-requestid: 68e2d57d-c65e-4921-ab3e-550045bbd13d
access-control-allow-origin: https://www.anomali.com
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci
x-amz-apigw-id: JS63QGiSPHcF8TQ=
access-control-allow-methods: OPTIONS,POST
x-cache: Miss from cloudfront
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 9nLqp2z8ext13sAuFSE8bdX3bU7p_Lxhp3DXq7WFVoE0LKPvfP34Vw==

POST
H2 200 queue Show response
st.fullcircleinsights.com/v1/visits/ 2 KB
2 KB 570ms
569ms XHR
application/json 143.204.98.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=89e085f3-5a30-494c-87ce-c5df4aacd29b&domain=anomali.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-87.fra50.r.cloudfront.net
Software: /
Resource Hash: c382ec571a776c26b50f00b921b2a6f7cf6bc846bb63c957deca67a7fe7a8e44

Request headers

origin-fci: https://www.anomali.com
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
x-api-key: IzsA4yOUOh9vPSgEBzJIg9sQK3xz2f6x2000qAXa
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 24 Nov 2021 06:14:06 GMT
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amzn-requestid: 7a3a2577-7abb-4380-bd43-6ab51e49f74b
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.anomali.com
x-amzn-trace-id: Root=1-619dd82e-3567ae495609acf170d9a7da;Sampled=0
x-amz-apigw-id: JS63VG8GvHcFmFQ=
content-length: 2028
x-amz-cf-id: ZK9Ex1kv2MK3qFFf3g6MuubkKDUIMlWhInfCrjF3l3VGpdCVKnLb2A==

GET
H/1.1 200
OK _t.gif
tribl.io/ 42 B
539 B 35ms
34ms Image
image/gif 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tribl.io/_t.gif?i=O8naez8e2eHPYn7m991b&s=lZw&u=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&h=www.anomali.com&bw=1600&bh=1200&t=0&rnd=4643595561332
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 06:14:05 GMT
Server: nginx/1.18.0 (Ubuntu)
P3P: CP="Triblio does not have a P3P policy."
Cache-Control: no-store, no-cache, must-revalidate, max-age=0,post-check=0,pre-check=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1003 B 281ms
179ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=808429732&v=1.1&a=458120&rcu=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&pu=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&t=Anomali+Cyber+Watch%3A+APT%2C+Emotet%2C+Iran%2C+RedCurl+and+More+%7C+Anomali&cts=1637734445922&vi=d1d88c48169ee2919b0cd717566a9bc0&nc=true&ce=false&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:06 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: ffef53b2-2a46-4080-9fc9-fefeadefda53
cf-ray: 6b307ebf98935a07-MXP
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AonNEhfYV3oxKTTNI23tYuHdseHzg3NHXzc6lVV0gtDwcCxqwcD8f9sEz%2Bleei2XZ1UXeF2qJzxRoVOiLraPhMPMJRT8ebpr%2Br96H%2BjjxHLQBNZ%2F9FewiDEdgGNUoMM4Jaup7XRthwNJ5CqykR7G"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H2 200 trends.min.js Show response
assets.trendemon.com/tag/ 199 KB
40 KB 123ms
30ms Script
application/javascript 143.204.98.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.trendemon.com/tag/trends.min.js
Requested by: Host: www.anomali.com
URL: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-15.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 41034fd35fe6831322b2ca334dedd90e63a3f50e27e6fff0c08ecb2650888ba7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 09:26:32 GMT
content-encoding: gzip
last-modified: Mon, 22 Nov 2021 09:24:09 GMT
server: AmazonS3
age: 74861
etag: "065695ce3443adaafdb4ccb83b3cc29c"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 40455
x-amz-cf-id: f_yQkdx9ucL9fHQJJGBv4noZncfpTuyKBh-_EhPwKcUjHYvHBfaElA==

GET
H2 200 2154 Show response
trackingapi.trendemon.com/api/settings/ 507 B
646 B 324ms
99ms Script
application/x-javascript 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackingapi.trendemon.com/api/settings/2154?callback=jsonp376878&vid=
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 3cc6a3f004b02fae0048de4759a5edd65fa622f168b98dea2b148c9a1993c198

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:06 GMT
cache-control: no-store,no-cache
server: Kestrel
content-length: 507
content-type: application/x-javascript; charset=UTF-8

GET
H/1.1 200
OK _t.gif
tribl.io/ 42 B
539 B 33ms
33ms Image
image/gif 46.137.132.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tribl.io/_t.gif?maCookie=d1d88c48169ee2919b0cd717566a9bc0&i=O8naez8e2eHPYn7m991b&s=lZw&u=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&h=www.anomali.com&bw=1600&bh=1200&t=13&rnd=1991074254691
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.137.132.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-132-32.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 06:14:06 GMT
Server: nginx/1.18.0 (Ubuntu)
P3P: CP="Triblio does not have a P3P policy."
Cache-Control: no-store, no-cache, must-revalidate, max-age=0,post-check=0,pre-check=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42

GET
H2 200 identity.min.js Show response
assets.trendemon.com/global/ 17 KB
6 KB 31ms
30ms Script
application/javascript 143.204.98.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.trendemon.com/global/identity.min.js
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-15.fra50.r.cloudfront.net
Software: / Express
Resource Hash: 51199eba952a7bc777ac7e424bb5610da76f7e7fc0e11fdebb74f501f51fc9de

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 09:26:32 GMT
content-encoding: gzip
age: 74859
x-powered-by: Express
x-cache: Hit from cloudfront
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
trd-ts: 2021-11-22T09:26:27.330Z
last-modified: Mon, 22 Nov 2021 09:22:15 GMT
etag: W/"46f8-17d46f3fd58"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: GG0bjCTOqTSekBtkT7U9aoAOQqwcQkXnIueIhjAP63Y-yAs3WEP1Bg==

GET
H2 200 me Show response
trackingapi.trendemon.com/api/Identity/ 94 B
507 B 104ms
103ms Script
application/x-javascript 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackingapi.trendemon.com/api/Identity/me?accountId=2154&DomainCookie=16377344465834948&fingerPrint=8c630d3cf619ed2df204b8b5f8efe500&callback=jsonp667005&vid=
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 23cdede55123422b9e7f8676d8628cedc3730a57cce4cd4bba58e20a1970c2a9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:06 GMT
cache-control: no-store,no-cache
server: Kestrel
content-length: 94
content-type: application/x-javascript; charset=UTF-8

GET
H2 200 marketingautomation Show response
trackingapi.trendemon.com/api/ 94 B
231 B 110ms
109ms Script
application/x-javascript 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackingapi.trendemon.com/api/marketingautomation?AccountId=2154&ClientUrl=aHR0cHM6Ly93d3cuYW5vbWFsaS5jb20vYmxvZy9hbm9tYWxpLWN5YmVyLXdhdGNoLWFwdC1lbW90ZXQtaXJhbi1yZWRjdXJsLWFuZC1tb3Jl&CookieId=16377344465834948&MaCookie=ZDFkODhjNDgxNjllZTI5MTliMGNkNzE3NTY2YTliYzA%3D&MaCookieName=aHVic3BvdHV0aw%3D%3D&MaName=hubspot&callback=jsonp345920&vid=2154:16377344321130991
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 24599f5b04006d30eae062a37c121e165b26c680f8fa43f91d9aa3267f1f30ba

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:06 GMT
cache-control: no-store,no-cache
server: Kestrel
content-length: 94
content-type: application/x-javascript; charset=UTF-8

GET
H2 200 personal Show response
trackingapi.trendemon.com/api/experience/ 1 KB
1 KB 125ms
124ms Script
application/x-javascript 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackingapi.trendemon.com/api/experience/personal?AccountId=2154&ClientUrl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&MarketingAutomationCookie=d1d88c48169ee2919b0cd717566a9bc0&ExcludeUnitsJson=%5B%5D&callback=jsonp535356&vid=2154:16377344321130991
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 72ce40bed40cb200a589ed930b6626e6d91ce20ba13dde032c5a2bb315838f9e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:06 GMT
server: Kestrel
content-length: 1233
content-type: application/x-javascript; charset=UTF-8

GET
H2 200 pageview
trackingapi.trendemon.com/api/events/ 43 B
234 B 110ms
110ms Image
image/gif 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trackingapi.trendemon.com/api/events/pageview?accountId=2154&url=aHR0cHM6Ly93d3cuYW5vbWFsaS5jb20vYmxvZy9hbm9tYWxpLWN5YmVyLXdhdGNoLWFwdC1lbW90ZXQtaXJhbi1yZWRjdXJsLWFuZC1tb3Jl&cookie=16377344465834948&referral=&vid=2154:16377344321130991&r=1637734446849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:06 GMT
server: Kestrel
age: 1691358
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
content-length: 43
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK closex.png
pic.trendemon.com/images/ 386 B
847 B 126ms
30ms Image
image/png 143.204.98.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pic.trendemon.com/images/closex.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-74.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c3a58e45ccfffece1df8e470fd853a81321e4f78f6af8d22e78310da1380f7d5

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 05:16:22 GMT
Via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
Last-Modified: Tue, 16 Apr 2019 23:23:30 GMT
Server: AmazonS3
Age: 4651
ETag: "7da2ae17c3b671047838f7b78687a56f"
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 386
X-Amz-Cf-Id: iqUWroLD-PKnV6hT6RONT9qXI_MLieDpqk1mKs8TOjvQzCYD5o26qA==

GET
H2 200 personal-embedded Show response
trackingapi.trendemon.com/api/experience/ 2 KB
3 KB 103ms
103ms Script
application/x-javascript 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackingapi.trendemon.com/api/experience/personal-embedded?AccountId=2154&ClientUrl=https%3A%2F%2Fwww.anomali.com%2Fblog%2Fanomali-cyber-watch-apt-emotet-iran-redcurl-and-more&MarketingAutomationCookie=d1d88c48169ee2919b0cd717566a9bc0&Ids=%5B%222ec4bd97-a5f5-4ac1-9d27-9bff735a6058%22%5D&Groups=%5B%5D&callback=jsonp868789&vid=2154:16377344321130991
Requested by: Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 7bdff4f7458720c14ced3c76010ceb51474090934f68454cf690204ce2cd7858

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 06:14:06 GMT
server: Kestrel
content-length: 2501
content-type: application/x-javascript; charset=UTF-8

GET
H2 200 uplift
trackingapi.trendemon.com/api/events/ 43 B
234 B 141ms
141ms Image
image/gif 18.211.154.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trackingapi.trendemon.com/api/events/uplift?AccountId=2154&Cookie=16377344465834948&Url=aHR0cHM6Ly93d3cuYW5vbWFsaS5jb20vYmxvZy9hbm9tYWxpLWN5YmVyLXdhdGNoLWFwdC1lbW90ZXQtaXJhbi1yZWRjdXJsLWFuZC1tb3Jl&EventType=SURVEY_LOAD&CtaId=103584&Widget=true&InAbTest=false&UnitTypeId=5&vid=2154:16377344321130991&r=1637734447106
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.154.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-154-252.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.anomali.com/blog/anomali-cyber-watch-apt-emotet-iran-redcurl-and-more
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 06:14:07 GMT
server: Kestrel
age: 1691358
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
content-length: 43
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

104 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.anomali.com/	1970-01-19 22:55:41	Name: exp_csrf_token Value: b99d013e4cfa47fbf46fdda59d2c9179753038ea
.tribl.io/	1970-01-20 16:00:51	Name: ti_ Value: s%3AG3NArYYkpTgFfu9EIjxuLoMO.mBe9O4owMiXyvmg97XI4OfGdte3qrCkwZinldu3NF3g
.anomali.com/	1969-12-31 23:59:59	Name: _fcdscst Value: 1637734444571
.anomali.com/	1970-01-20 16:26:46	Name: _ga Value: GA1.2.806547541.1637734445
.anomali.com/	1970-01-19 22:57:00	Name: _gid Value: GA1.2.1334560963.1637734445
.anomali.com/	1970-01-19 22:55:34	Name: _gat Value: 1
.anomali.com/	1970-01-20 01:05:10	Name: _fbp Value: fb.1.1637734445145.1953829745
.ws.zoominfo.com/	1970-01-20 07:41:10	Name: visitorId Value: a6b87ba01d64b87037088736f318e30f401cc2d4bb3424e7455ed3a6a683b89f
.zoominfo.com/	1970-01-19 22:55:36	Name: __cf_bm Value: dfCHr0tb6ussgJbYkX2JDDAGm6kbTmc63ySfznsCbv0-1637734445-0-AXGvJSsO5VJZ/II7fBoQq6LFwVoZrhP2txyhoo1kcBCB8+2PoSA8FbGDhcx/2F6Rx3JTplpqWl6XgHwFHlEB6uA=
.anomali.com/	1970-01-20 16:26:46	Name: _fcdscv Value: eyJDdXN0b21lcklkIjoiODllMDg1ZjMtNWEzMC00OTRjLTg3Y2UtYzVkZjRhYWNkMjliIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiJjNjAwZTI3YS1lZGYwLTQ4NmMtYjI3NC0yMGIwZmFjOWNjNWIifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
.anomali.com/	1970-01-20 08:17:10	Name: __hstc Value: 41179005.d1d88c48169ee2919b0cd717566a9bc0.1637734445913.1637734445913.1637734445913.1
.anomali.com/	1970-01-20 08:17:10	Name: hubspotutk Value: d1d88c48169ee2919b0cd717566a9bc0
.anomali.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.anomali.com/	1970-01-19 22:55:36	Name: __hssc Value: 41179005.1.1637734445915
.hubspot.com/	1970-01-19 22:55:36	Name: __cf_bm Value: LAe2bz3iEMbYKaa4uErFuOz4uWRNXZP3jGGM5DBEFM8-1637734446-0-AbsfzLsztcqWfGZt/+cwTIR2gaOtQXnFqbGImYOwa3y0h9I9XZSoi9VMVR/RYZSBtFQ+De+mk2/4fbwUPtBGjx8=
.anomali.com/	1970-01-20 07:41:10	Name: trd_cid Value: 16377344465834948
trackingapi.trendemon.com/	1978-01-11 21:31:40	Name: trd_gavid_2154 Value: 16377344321130991
trackingapi.trendemon.com/	1978-01-11 21:31:40	Name: trd_gvid Value: 16377344321130991
trackingapi.trendemon.com/	1978-01-11 21:31:40	Name: trd_vid_2154 Value: 2154%3A16377344321130991
.anomali.com/	1970-01-20 07:41:10	Name: trd_vid_l Value: 2154%3A16377344321130991
.anomali.com/	1970-01-20 07:41:10	Name: trd_vuid_l Value: -307346715590897349
.anomali.com/	1970-01-20 07:41:10	Name: trd_first_visit Value: 1637734447
.anomali.com/	1970-01-20 07:41:10	Name: trd_pw Value: 1
.anomali.com/	1970-01-19 22:55:36	Name: trd_pws Value: 1
.anomali.com/	1970-01-19 22:55:36	Name: trd_sid Value: 16377344468422750
.anomali.com/	1970-01-19 22:56:17	Name: trd_ma_cookie Value: ZDFkODhjNDgxNjllZTI5MTliMGNkNzE3NTY2YTliYzA%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lltrck.com/scripts/lt-v3.js?llid=26138 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; font-src * 'unsafe-inline' 'unsafe-eval' data:; media-src * 'unsafe-inline' 'unsafe-eval' data: blob:;worker-src * 'unsafe-inline' 'unsafe-eval' blob: data:;script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anomali.cdn.rackfoundry.net
assets.trendemon.com
connect.facebook.net
d2i34c80a0ftze.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
lltrck.com
pic.trendemon.com
st.fullcircleinsights.com
stats.g.doubleclick.net
track.hubspot.com
trackingapi.trendemon.com
tribl.io
ws.zoominfo.com
www.anomali.com
www.facebook.com
www.google-analytics.com
143.204.98.15
143.204.98.74
143.204.98.87
18.211.154.252
2600:1f1c:4b7:6680:5601:58d5:7a57:c91b
2600:9000:2156:7c00:9:14eb:6280:93a1
2600:9000:2156:9400:12:deac:e8c0:93a1
2606:4700::6810:650c
2606:4700::6811:45b0
2606:4700::6811:d4cc
2606:4700::6812:14bf
2606:4700::6813:9b53
2a00:1450:4001:812::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:831::200e
2a00:1450:400c:c1b::9b
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
46.137.132.32
52.20.96.200
07f768a6e8c21b30d1327cab4d290b990aa8b847c2b72a19167c8b9713d7028d
0bb0d200a2e50741dde8adac7f725a3ad2b0d8d10884e5bbfaef338ff74f9902
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1265b1ae11c361143c7bdd1ad239726e1b492ff0d7df8aa308d57ceb8047287a
13eb615165c92892fcd46e01782dd0fc52d36f236f883aad488c2cf4dcf9206e
18bd4be1ae80d75c34981d8e3b00afd34e066a8de53de52780f0740efc0fb9b9
1a4722f7c6bfc8ed582a1da7f4e552be5350efe348638b31ec4a1291963c8e8e
23cdede55123422b9e7f8676d8628cedc3730a57cce4cd4bba58e20a1970c2a9
24599f5b04006d30eae062a37c121e165b26c680f8fa43f91d9aa3267f1f30ba
24f3c5e5d219ad64386debdb56d6e447f6fe88668829af345b9709a2bb0f6958
2904b98dfb86ac37a4ed1e33585980adbcbeb63b8802a641fc64615ef7360223
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
30247563a88aac311960f008072fcb547943149dd2d655c7dcc604504ba9a92f
3228ae69eff9f480fffba461d687b056902d9c9ac38dadab45234e62aad3312e
39af318c5162a69cccae2300c512e8e69f1b14f047d710456270a7bc94ff498b
39c658ef377f9ec31442c5343a15bdfc4c4653bcca74bc7d6fe4b3e736a60aa4
3cc6a3f004b02fae0048de4759a5edd65fa622f168b98dea2b148c9a1993c198
41034fd35fe6831322b2ca334dedd90e63a3f50e27e6fff0c08ecb2650888ba7
46540cba6c2149745a32c8e700768e799221305fecbb3e22cc9cddba8c6fceb4
51199eba952a7bc777ac7e424bb5610da76f7e7fc0e11fdebb74f501f51fc9de
58a4b784a220265473782fb69a5ce39c12e20af32a7a8999323ca005ab4350b5
5c682e5c6c28f9fd1dfdc40c07e35b712d37fdcdb04f7452ede8f8380f99162d
61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3
69f29684b4e7156ee24547dbb2a7271feb3823500ea7b9dbccb85343c5631447
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
72ce40bed40cb200a589ed930b6626e6d91ce20ba13dde032c5a2bb315838f9e
76c53e5125ff430ee41a17469d78d46f93219d407411382a4607154999d28a98
79a2aa24ed9f9bc786540454a7f1e01f16a01352ccfddc8a2425463c2d4f8ebb
7af50cf95aee25377e0d294dfd490228f7bfa3829a47298137dd3495811cb4c3
7bdff4f7458720c14ced3c76010ceb51474090934f68454cf690204ce2cd7858
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8d058626c8165ed74ee81d5ffa956675ccd253360b3fa362ccb88c2754d35c0d
8d4d29042c23b5fcbed3af690421776de0f8ad3d308d66e24a9d80bcc8ccb522
9007c069595e9a8f92c35ec1a6acbc74de043eb7fff18bf6a3e42f96267cb796
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0a17d7cf327c6e12000435914d90d8415812ed1ed2eadc31c09491cb242535a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
c382ec571a776c26b50f00b921b2a6f7cf6bc846bb63c957deca67a7fe7a8e44
c3a58e45ccfffece1df8e470fd853a81321e4f78f6af8d22e78310da1380f7d5
c4cdae87a5a8303157e74e2008ffed918cb6fc2bcea4a41bb384ead327c347ad
d6acccd02f291101d54b680470950868abf0e9bfbb44c7561ec0ed81a0d2487f
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd3523383caaee7ac9379df0e04308bd50274fa1c845ae61ef03c7dc0140d505
e2a8f87d29a4c1405ecbf52ab931679b9cfe4a5281587d6c45991cedd3306e5c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43bff2b3d92a5961865d37cd8f6b4403434eb64c73558fb7b0d9cef3a9f6d45
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
ec83f9cccd120b3497a09d26618b516b2bd2c8e0e930919c0eda5516991901f6
ece0d13e399a6aaaa3e357ba76cd4c9f18c1bbe0f13e2fc41232f2e0a7c9e4b1
ef0926157f82e546a917d742d9b9afceb1333945e9f4f80301159c3b2b23e882
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.anomali.com Open in urlscan Pro 2600:1f1c:4b7:6680:5601:58d5:7a57:c91b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

61 Requests

100 %HTTPS

70 %IPv6

18 Domains

20 Subdomains

20 IPs

4 Countries

1199 kBTransfer

2697 kBSize

26 Cookies

42 Outgoing links

Redirected requests

61 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.anomali.com Open in urlscan Pro
2600:1f1c:4b7:6680:5601:58d5:7a57:c91b Public Scan

Screenshot
Live screenshot

Full Image

61
Requests

100 %
HTTPS

70 %
IPv6

18
Domains

20
Subdomains

20
IPs

4
Countries

1199 kB
Transfer

2697 kB
Size

26
Cookies

61 HTTP transactions
0 data transactions