URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Submission: On October 19 via api from IN — Scanned from DE

Summary

This website contacted 39 IPs in 5 countries across 34 domains to perform 103 HTTP transactions. The main IP is 104.26.3.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 186213.
TLS certificate: Issued by E6 on September 1st 2024. Valid for: 3 months.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 14 104.26.3.18 13335 (CLOUDFLAR...)
15 2620:12a:8000::2 54113 (FASTLY)
11 2606:4700::68... 13335 (CLOUDFLAR...)
3 34.49.80.229 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
7 104.17.73.206 13335 (CLOUDFLAR...)
2 104.18.16.5 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
6 104.17.111.223 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.35 15169 (GOOGLE)
4 2620:1ec:33::10 8075 (MICROSOFT...)
2 18.245.46.44 16509 (AMAZON-02)
2 184.31.85.59 16625 (AKAMAI-AS)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 162.159.152.17 13335 (CLOUDFLAR...)
1 199.232.188.157 54113 (FASTLY)
3 172.67.213.149 13335 (CLOUDFLAR...)
8 3.126.222.51 16509 (AMAZON-02)
2 2620:1ec:bdf::64 8075 (MICROSOFT...)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 185.89.211.116 29990 (ASN-APPNEX)
1 2600:9000:206... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 162.159.140.229 13335 (CLOUDFLAR...)
1 104.244.42.3 13414 (TWITTER)
1 18.66.102.98 16509 (AMAZON-02)
1 2 52.210.72.167 16509 (AMAZON-02)
1 35.244.174.68 396982 (GOOGLE-CL...)
2 4 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
1 192.28.144.124 15224 (OMNITURE)
3 172.175.234.12 8075 (MICROSOFT...)
1 142.250.186.130 ()
1 2 172.217.18.102 ()
1 142.250.184.230 ()
1 1 142.250.186.66 ()
1 1 142.250.185.228 ()
1 2a00:1450:400... ()
103 39
Apex Domain
Subdomains
Transfer
36 sentinelone.com
www.sentinelone.com — Cisco Umbrella Rank: 186213
de.sentinelone.com
go.sentinelone.com — Cisco Umbrella Rank: 315182
725 KB
11 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 326
192 KB
8 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579
11 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 321
px4.ads.linkedin.com — Cisco Umbrella Rank: 6828
3 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 5396
onesignal.com — Cisco Umbrella Rank: 1637
img.onesignal.com — Cisco Umbrella Rank: 9324
90 KB
5 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 634
n.clarity.ms — Cisco Umbrella Rank: 15771
29 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 136
13115870.fls.doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
1 KB
5 knock-ai.com
js.knock-ai.com — Cisco Umbrella Rank: 395209
ca.knock-ai.com — Cisco Umbrella Rank: 416223
10 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 348
16 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
401 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 58783
e.calibermind.com — Cisco Umbrella Rank: 57571
63 KB
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 598
407 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 479
2 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 6617
q.quora.com — Cisco Umbrella Rank: 5041
15 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3657
7 KB
2 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 8945
tag.demandbase.com — Cisco Umbrella Rank: 5931
34 KB
2 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 4401
www.google.com
24 B
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 77
12 KB
2 qualified.com
js.qualified.com — Cisco Umbrella Rank: 16970
app.qualified.com — Cisco Umbrella Rank: 16988
242 KB
1 google.pt
www.google.pt
455 B
1 googleadservices.com
www.googleadservices.com
3 KB
1 mktoresp.com
327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 689213
318 B
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 812
98 B
1 company-target.com
api.company-target.com — Cisco Umbrella Rank: 4087
513 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 962
724 B
1 t.co
t.co — Cisco Umbrella Rank: 859
625 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 18180
279 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16506
284 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 960
15 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 784
14 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 11271
63 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 498
306 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412
30 KB
0 abrankings.com Failed
cdn.abrankings.com Failed
103 34
Domain Requested by
15 de.sentinelone.com www.sentinelone.com
de.sentinelone.com
14 www.sentinelone.com 12 redirects www.sentinelone.com
11 cdn.cookielaw.org www.sentinelone.com
cdn.cookielaw.org
8 tags.srv.stackadapt.com www.sentinelone.com
tags.srv.stackadapt.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
4 px.ads.linkedin.com 2 redirects snap.licdn.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.sentinelone.com
4 www.googletagmanager.com www.sentinelone.com
www.googletagmanager.com
3 n.clarity.ms www.clarity.ms
3 onesignal.com cdn.onesignal.com
3 js.knock-ai.com www.sentinelone.com
js.knock-ai.com
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 px4.ads.linkedin.com www.sentinelone.com
2 match.prod.bidr.io 1 redirects www.sentinelone.com
2 ca.knock-ai.com js.knock-ai.com
2 secure.adnxs.com 2 redirects
2 www.clarity.ms www.sentinelone.com
www.clarity.ms
2 cdn.calibermind.com www.sentinelone.com
www.googletagmanager.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
1 www.google.pt
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 ad.doubleclick.net
1 www.googleadservices.com www.googletagmanager.com
1 img.onesignal.com www.sentinelone.com
1 app.qualified.com js.qualified.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 e.calibermind.com cdn.calibermind.com
1 id.rlcdn.com www.sentinelone.com
1 api.company-target.com scripts.demandbase.com
1 analytics.twitter.com www.sentinelone.com
1 t.co www.sentinelone.com
1 q.quora.com www.sentinelone.com
1 attr.ml-api.io www.sentinelone.com
1 s.ml-attr.com 1 redirects
1 tag.demandbase.com www.sentinelone.com
1 static.ads-twitter.com www.sentinelone.com
1 a.quora.com www.sentinelone.com
1 snap.licdn.com www.sentinelone.com
1 scripts.demandbase.com www.sentinelone.com
1 www.google.de www.sentinelone.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 js.qualified.com www.sentinelone.com
1 ajax.googleapis.com www.sentinelone.com
0 cdn.abrankings.com Failed www.googletagmanager.com
103 49
Subject Issuer Validity Valid
sentinelone.com
E6
2024-09-01 -
2024-11-30
3 months crt.sh
cookielaw.org
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
js.knock-ai.com
WR3
2024-09-04 -
2024-12-03
3 months crt.sh
upload.video.google.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
go.sentinelone.com
E6
2024-09-15 -
2024-12-14
3 months crt.sh
qualified.com
WE1
2024-09-04 -
2024-12-03
3 months crt.sh
*.google-analytics.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.onesignal.com
WE1
2024-09-02 -
2024-12-01
3 months crt.sh
geolocation.onetrust.com
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
attivonetworks.com
R10
2024-09-07 -
2024-12-06
3 months crt.sh
*.google.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.g.doubleclick.net
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.google.de
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 03
2024-09-16 -
2025-03-15
6 months crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-27 -
2025-09-28
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-12-08 -
2024-12-11
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
quora.com
WR1
2024-10-07 -
2025-01-05
3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-06-25 -
2025-06-24
a year crt.sh
calibermind.com
WE1
2024-10-10 -
2025-01-08
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M02
2024-08-09 -
2025-09-07
a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2024-09-04 -
2025-09-04
a year crt.sh
ca.knock-ai.com
WR3
2024-09-14 -
2024-12-13
3 months crt.sh
onesignal.com
WE1
2024-09-02 -
2024-12-01
3 months crt.sh
t.co
E5
2024-09-28 -
2024-12-27
3 months crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-09-30 -
2025-09-29
a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-13 -
2025-09-14
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2024-02-06 -
2025-03-05
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-08-15 -
2025-09-15
a year crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh
*.googleadservices.com
WR2
2024-09-30 -
2024-12-23
3 months crt.sh
*.doubleclick.net
WR2
2024-09-30 -
2024-12-23
3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Frame ID: DE248B364A56A3196927A27F4E05B168
Requests: 103 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: 42E043A98B2E9EE1760783165FEC7CBD
Requests: 2 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/ZQoyHXFTqngPcfcB/messenger?uuid=b8c2cb86-f2cf-4fff-ad57-7f5679816e31
Frame ID: 07657B0C581329E66756BCEBB0887755
Requests: 1 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F
Frame ID: 9556B8A679971C0DAC2FE0DA8B43D48C
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Threat Actor Interplay | Good Day’s Victim Portals and Their Ties to Cloak

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

103
Requests

83 %
HTTPS

36 %
IPv6

34
Domains

49
Subdomains

39
IPs

5
Countries

1912 kB
Transfer

6178 kB
Size

40
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Request Chain 3
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
Request Chain 9
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
Request Chain 10
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg
Request Chain 11
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg
Request Chain 12
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11 HTTP 302
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Request Chain 13
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
Request Chain 25
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png
Request Chain 36
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Request Chain 37
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg
Request Chain 38
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
Request Chain 60
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6086638121979325715
Request Chain 67
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Request Chain 77
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Request Chain 81
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&e_ipv6=AQJT-60iw9LG7gAAAZKjjbmSSrzj2OAH_jjxwLflttcSwuuDd7iFVwNt70ZUirqyY1vvOQ8
Request Chain 102
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F
Request Chain 103
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJx92MzcyduZAAAAZKjjcsGk3dcERBamDQ3ylyDudrw1aEBGmIPF9AZtoDaWmJn6hDhUQc
Request Chain 106
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJDJsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaNHjbn3Jw77Pk24ngBdkdGcIQ53_Ye1Tbg&pscrd=IhMI4aqDj-6ZiQMVP4iDBx0wzwJJMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkhqU2hYdXB5cTlpbFJZSHI2d1hKa0kwMkt5bmtvalFqbEZnYmNfMUs4OUVDMWh0OVBWZ3Q5Zw HTTP 302
  • https://www.google.com/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJDJsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMI4aqDj-6ZiQMVP4iDBx0wzwJJMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkhqU2hYdXB5cTlpbFJZSHI2d1hKa0kwMkt5bmtvalFqbEZnYmNfMUs4OUVDMWh0OVBWZ3Q5Zw&is_vtc=1&cid=CAQSGwDpaXnfyTczD3DB1YclR6s831ofD-2P3fIqbg&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaMozRNEyPqHrsZmHeLm0gFWfKrTBrboaGA&random=18274263 HTTP 302
  • https://www.google.pt/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJDJsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMI4aqDj-6ZiQMVP4iDBx0wzwJJMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkhqU2hYdXB5cTlpbFJZSHI2d1hKa0kwMkt5bmtvalFqbEZnYmNfMUs4OUVDMWh0OVBWZ3Q5Zw&is_vtc=1&cid=CAQSGwDpaXnfyTczD3DB1YclR6s831ofD-2P3fIqbg&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaMozRNEyPqHrsZmHeLm0gFWfKrTBrboaGA&random=18274263&ipr=y

103 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
361 KB
114 KB
Document
General
Full URL
https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89007d3e641894d5bf87dd16c9d42f238618ddec9fd650870abae33f3fb577ad
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age
1
cache-control
max-age=60
cf-cache-status
HIT
cf-ray
8d4eda590e07a03d-FRA
content-encoding
br
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type
text/html; charset=UTF-8
date
Sat, 19 Oct 2024 06:53:45 GMT
last-modified
Sat, 19 Oct 2024 06:53:44 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/posts/83980>; rel="alternate"; title="JSON"; type="application/json", <https://www.sentinelone.com/?p=83980>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K5bG%2BX4VZusTaKzKcUB0EUUXg0nuUnxoWvxWMBiHAqPKWSPyWGEO3weevLCCcrzhHvULWsEC8uESaHSIRFLpcRPDGKuOhPRnoB9SdvnP4FZTrOmN4bYiNETc8m5g1sUeb%2BFrQE4%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
HIT, HIT, MISS, MISS
x-cache-hits
9, 1, 0, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-bppnx
x-served-by
cache-chi-klot8100044-CHI, cache-fra-eddf8230142-FRA, cache-fra-eddf8230142-FRA, cache-fra-eddf8230142-FRA
x-styx-req-id
8cda685e-8cf6-11ef-8cb6-5a2086cc0437
x-timer
S1729320824.332974,VS0,VE7
x-xss-protection
1; mode=block
ABCWhytePlusVariable.woff2
de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
242 KB
242 KB
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-c22gl
etag
"6711b1e9-3c6a4"
age
107691
expires
Sun, 19 Oct 2025 00:58:55 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
font/woff2
last-modified
Fri, 18 Oct 2024 00:55:05 GMT
x-served-by
cache-chi-kigq8000040-CHI, cache-cph2320021-CPH, cache-cph2320030-CPH, cache-cph2320030-CPH
x-cache-hits
0, 0, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.021718,VS0,VE8
x-styx-req-id
260871ca-8cec-11ef-b851-8ed28118664d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
247460
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h1TiapIdpH3PeYyiy047Ty%2BCcbnt36%2FmbBRnLFHb5mVylmTQHCfgUY5K016oTTkwj1gkAbMCjdIGGYib9ek7eqearzXi00aor3S64OHAK%2B%2FTJj%2BRdJnegVF%2FtNC1PCxWXTbVkyo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beb0a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:45 GMT
vary
Accept-Encoding
server
cloudflare
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
22 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCEDAD087F157F
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
46164
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:45 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 06:37:40 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ca0be203-601e-00f9-010e-20596a000000
cf-ray
8d4eda5a3f9d1e5e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
7214
x-ms-blob-type
BlockBlob
server
cloudflare
97ee7348-9176-4a4b-9af2-40711264546b.js
js.knock-ai.com/
33 KB
9 KB
Script
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Type
content-encoding
gzip
x-goog-hash
crc32c=d/mdHQ==, md5=5kJnp5LzzWIIqvCbzwi4ZA==
etag
"e64267a792f3cd6208aaf09bcf08b864"
age
11
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
8988
date
Sat, 19 Oct 2024 06:53:35 GMT
last-modified
Tue, 01 Oct 2024 09:16:01 GMT
content-type
application/javascript
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY1HB8IIIRusAZoqLktC4Noa3iEpYdwXJmglWjhCEkyLKzwUIee6nQOLo_QCdIjQfo9_55w
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1727774161474099
content-length
8988
server
UploadServer
style-default.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
488 KB
83 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3744cdf7226ef40a651e4054a8589854e62cb4da5e5812c9013f23c11700813d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-rm7m4
content-encoding
gzip
etag
W/"6711b1e9-7a062"
age
107691
expires
Sun, 19 Oct 2025 00:56:27 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/css
last-modified
Fri, 18 Oct 2024 00:55:05 GMT
x-served-by
cache-chi-klot8100143-CHI, cache-cph2320031-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
12, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.021579,VS0,VE16
x-styx-req-id
cde5b718-8ceb-11ef-b2e0-26381e4c950b
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
84450
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wt1rmHrJXHrwiWQxVCAGIb1z3C7TT2ZcVE2rglhFuml71yObY%2Byh7DzgWwXPDfpUyHcOQ0VrwI9IczopFnK%2BBqqcDxf0SJbQRRw%2FcmOvgZVcBsPWU5qY230N7O6iapo6Oarmo5Y%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beaaa03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:45 GMT
vary
Accept-Encoding
server
cloudflare
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.0/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.7.0/jquery.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
age
365202
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 15 Oct 2025 01:27:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 15 Oct 2024 01:27:03 GMT
last-modified
Wed, 17 May 2023 18:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30433
x-xss-protection
0
server
sffe
forms2.min.js
go.sentinelone.com/js/forms2/js/
199 KB
67 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01fe-31b91-62370c030d900"
age
4079
x-content-type-options
nosniff
cf-ray
8d4eda5aab6b630a-HAM
expires
Sat, 19 Oct 2024 10:53:46 GMT
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/x-javascript
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
qualified.js
js.qualified.com/
1 MB
242 KB
Script
General
Full URL
https://js.qualified.com/qualified.js?token=ZQoyHXFTqngPcfcB
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
609e5b73559de3c6db3470ebdb8b1550f6ef5712eaba35ecef1b4dc0866aca74
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
ef0138e5-90ae-47e2-99a4-fb4eb6d39699
content-encoding
gzip
cf-cache-status
HIT
etag
W/"1d30272041f22f7837056001992daeae"
age
22795
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
x-cache
miss
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/javascript; charset=utf-8
vary
Accept,Accept-Encoding
x-runtime
0.019002
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains
cache-control
max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400
x-envoy-upstream-service-time
43
referrer-policy
strict-origin-when-cross-origin
x-download-options
noopen
cf-ray
8d4eda5c4f6d4151-HAM
x-xss-protection
1; mode=block
server
cloudflare
js
www.googletagmanager.com/gtag/
327 KB
108 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a79451aab4207938ce5c88145118e0b4b59a91b0cb5f1493d4fea53c88b36498
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Sat, 19 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109380
x-xss-protection
0
server
Google Tag Manager
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=172800, public
content-encoding
gzip
etag
W/"670fb497-4d7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LPZ4ugUhEzBjL%2FqhuS3riIi5iWKueugxtfKBF77jC5whXkEZ8d59VYvrqREXygdPNgYwCbTvHKAN9DdnMMfHmyfWwEy%2B8V47Gh5PIsUWWT6EUx1%2B%2F5dgHOvCCtsGa%2BYy5rKRUzw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beaca03d-FRA
expires
Mon, 21 Oct 2024 06:53:45 GMT
date
Sat, 19 Oct 2024 06:53:45 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 12:41:59 GMT
vary
Accept-Encoding
server
cloudflare
x-frame-options
DENY
Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
61 KB
61 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
93208884e8488ae15aae033e1d9abf065a9acb72dcbcab9f9fa0298530440aed
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7648d669f7-wtd9f
fastly-io-info
ifsz=77661 idim=1200x628 ifmt=jpeg ofsz=62048 odim=1200x628 ofmt=webp
etag
"ReJ5TRTq6GlHTF4KTiIpKUtuRkozE6Ini+ieMH2fi90"
age
343591
expires
Thu, 16 Oct 2025 07:27:14 GMT
x-cache
MISS, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/webp
x-served-by
cache-ams21046-AMS, cache-ams2100121-AMS, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 4, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.021555,VS0,VE24
x-styx-req-id
e625def3-8ac6-11ef-b22d-62fe6b707d93
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
62048
fastly-io-served-by
vpop-etou8240192
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-2.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zXlFjCgJXXh%2FzGrR5xeHIwK11BFZBOv8kN3Z2FgWb5R9%2FLuBJzzrlAZg6Iqlabm%2BzcwlU3sEFpC8RMyR9r9t4MdNdWW9xavdSokUJV8fHPWemPmEhiX3fh2nGB7YA49O8NIAaCU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beada03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:45 GMT
vary
Accept-Encoding
server
cloudflare
ARCrypter_GD_7.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg
7 KB
8 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
37cc04fa1ef6803fa5273ade871d906254ff9aa8d877771c65fa7bd56f97a92c
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-4ddpx
fastly-io-info
ifsz=23869 idim=704x352 ifmt=jpeg ofsz=7438 odim=704x352 ofmt=webp
etag
"m8NxbXyYZ0JXSd4SB0KmRcjmelylAg2mEFdbScyDS44"
age
52200
expires
Sun, 19 Oct 2025 16:23:45 GMT
x-cache
MISS, MISS, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/webp
x-served-by
cache-chi-klot8100110-CHI, cache-ams2100089-AMS, cache-ams2100089-AMS, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 0, 3, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.021726,VS0,VE21
x-styx-req-id
5931f071-8d6d-11ef-9242-1af01b70491e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
7438
fastly-io-served-by
img05-europe-west3
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_7.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x3nuiaVEHIwEMc3d7YGEn%2FYF4PBKY7ElLKxmHOJcBWTnLFGqpFR3z4fUeMj6OMY0qX0IFl42pVQUxkwE6Eo8UHqbg%2BH9jhwCyIzup%2BNU8IJhg8Z8xx82%2FPu6V8XsJ1KdbqZr5mk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beaea03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:45 GMT
vary
Accept-Encoding
server
cloudflare
ARCrypter_GD_9.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg
22 KB
23 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
71d7777595050fcf75727dc90e3fc46012d43d06fee00872b55b6515853bf4f6
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-7ljh9
fastly-io-info
ifsz=43539 idim=764x204 ifmt=jpeg ofsz=22600 odim=764x204 ofmt=webp
etag
"3TrHp3eQTyDjGp47goWqfnrZn7lXNHFGXpveC3rcd9c"
age
52200
expires
Fri, 17 Oct 2025 11:11:19 GMT
x-cache
HIT, MISS, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/webp
x-served-by
cache-chi-klot8100067-CHI, cache-ams21048-AMS, cache-ams21048-AMS, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 0, 2, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.021918,VS0,VE20
x-styx-req-id
5ebbf5fd-8baf-11ef-bc5d-86c29a649947
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
22600
fastly-io-served-by
vpop-etou8240195
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/ARCrypter_GD_9.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vu2vieZQt%2BDvXXOiuhXbCVlzwrar0eUqmHE%2BeffFr%2B2i4b97E02jrRcLwepFNtekn9sMoxIVuZhvHCL1o23MWpo0cWYRPoLe079ZIXyI8kSog9%2FIvggv3viy0QeNzZFea%2BSH%2FQs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda59beafa03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:45 GMT
vary
Accept-Encoding
server
cloudflare
clipboard.min.js
de.sentinelone.com/wp-includes/js/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
9 KB
4 KB
Script
General
Full URL
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-x7p54
content-encoding
gzip
etag
W/"6711b1eb-2331"
age
107691
expires
Sun, 19 Oct 2025 00:58:55 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/x-javascript
last-modified
Fri, 18 Oct 2024 00:55:07 GMT
x-served-by
cache-chi-klot8100072-CHI, cache-cph2320030-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.303033,VS0,VE8
x-styx-req-id
26087d1f-8cec-11ef-bf95-1e568ca11146
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
3466
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WlMExykWR7qA0cP0ZkPxq7TKZOVfJSRO%2Frw3jshHa9OhBsWV9IZOPwMx0WDdXUvyjhv0DVjcOx%2FYe1nwFw4ivTP%2FU7fQon4X23bpKMNrVZ%2FhDyqbl9g0EviKBq9PhsrFGX24DSc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5b684ba03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
global.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
29 KB
11 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-tvqz6
content-encoding
gzip
etag
W/"6711b1e8-739c"
age
107692
expires
Sun, 19 Oct 2025 00:58:55 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/x-javascript
last-modified
Fri, 18 Oct 2024 00:55:04 GMT
x-served-by
cache-chi-klot8100081-CHI, cache-cph2320023-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
9, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.304940,VS0,VE10
x-styx-req-id
26087622-8cec-11ef-b749-626737af83eb
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
10668
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tH9OJ6okQYgiC%2BtOLFXxFhOdNkNfCu7QG6ri1uxY2aRElJBKUesIDkTI7AeQP5%2FJ6zGQ2zqq1FYm4kXh9ECS8ULeIJwEuOOMFhlrJ%2FrP3M3ftbGndaoJcMYU3PJc6nZ0PT77hxM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5b885fa03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"09282956186c8515ef0d208902803581"
age
2540
via
1.1 google
cf-ray
8d4eda5bfdcfca85-HAM
expires
Tue, 22 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
F3zUIq857iGpcyK5PrUpqQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCDF012D7A954A
age
57133
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Sun, 20 Oct 2024 06:53:46 GMT
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/json
last-modified
Fri, 27 Sep 2024 14:32:13 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
8ba91f3b-601e-00f9-09ea-10596a000000
cf-ray
8d4eda5b0eae35f8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1781
x-ms-blob-type
BlockBlob
server
cloudflare
gtm.js
www.googletagmanager.com/
379 KB
119 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
22251055542a5f8c6353c956f92f010a27836742926ee109d639ea39f31421d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Sat, 19 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 19 Oct 2024 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
121170
x-xss-protection
0
server
Google Tag Manager
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
68 B
306 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
application/json
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-methods
GET, OPTIONS
cf-ray
8d4eda5c3d17975e-FRA
access-control-allow-origin
*
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
Content-Type
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
116 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
08d80a196fd16e446bb1d5c7e94adf0b719406286686ab3606e0e49a1dc122d9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
118 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
117 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a6bfc62c8e653fb944b2a6937d2822241c304fa49bbe90ede334a582385f47e1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&callback=jQuery371045974248972885046_1729320826150&_=1729320826151
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1031689dc270b894f27b5975d9a4aec71f6ab261ba828f2d786127e43e87a47c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cf-ray
8d4eda5bdcc4630a-HAM
cached
true
content-encoding
gzip
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
cloudflare
getForm
go.sentinelone.com/index.php/form/
2 KB
1 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2816&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&callback=jQuery371045974248972885046_1729320826152&_=1729320826153
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b8a9555c04275858042dc7a54b8b21102a84d69ef9ae5b2b616e379ae094104

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cf-ray
8d4eda5beccc630a-HAM
cached
true
content-encoding
gzip
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
cloudflare
Gartner_Homepage_Banner.png
de.sentinelone.com/wp-content/uploads/2024/09/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png
  • https://de.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png
64 KB
65 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3d088e735e1df1e3e110bced2732b0ec4be974ae0a72fadfc8be82f726f7c0a6
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-547989f88d-wjmwn
fastly-io-info
ifsz=81851 idim=1920x40 ifmt=png ofsz=65854 odim=1920x40 ofmt=webp
etag
"K+Dn2OSnHvfFkwcP6UMk/YuLe+iyrXd5o6KGoQ7iF4s"
age
2042592
expires
Fri, 26 Sep 2025 15:30:33 GMT
x-cache
MISS, HIT, HIT, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/webp
x-served-by
cache-ams21042-AMS, cache-ams21061-AMS, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 672, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.300170,VS0,VE8
x-styx-req-id
1b289e23-7b53-11ef-8533-3e41bc79dfe0
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
65854
fastly-io-served-by
vpop-etou8240199
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zPRAWUr4SxWD7li8N7Fyz4r%2FVsndEOwOODG5AkkSMMv6m78xZIn4MdIZyTiOxXpowVVPmdNth74GZlwsU7izZM3eEiBVT9WKhNNjLFG2Xcf%2FVr%2BxbBiIlKyJjBzucVzm0zAwHic%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5be8c9a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
globe-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
729 B
612 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/globe-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-9ln5j
content-encoding
gzip
etag
W/"6711b1e8-2d9"
age
107586
expires
Sun, 19 Oct 2025 01:00:40 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Fri, 18 Oct 2024 00:55:04 GMT
x-served-by
cache-chi-kigq8000042-CHI, cache-cph2320040-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
13, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.224193,VS0,VE10
x-styx-req-id
64bd7892-8cec-11ef-86f1-26f55946c583
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
295
server
nginx
navigation-arrow-down-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
663 B
620 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-down-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-xw494
content-encoding
gzip
etag
W/"6711b1e9-297"
age
107586
expires
Sun, 19 Oct 2025 01:00:40 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Fri, 18 Oct 2024 00:55:05 GMT
x-served-by
cache-chi-kigq8000166-CHI, cache-cph2320050-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
13, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.224170,VS0,VE12
x-styx-req-id
64bda13d-8cec-11ef-8cbe-56e4174d1869
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
347
server
nginx
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
712 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-4wffj
content-encoding
gzip
etag
W/"6711b1ea-2a9"
age
105566
expires
Sun, 19 Oct 2025 01:34:19 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Fri, 18 Oct 2024 00:55:06 GMT
x-served-by
cache-chi-kigq8000120-CHI, cache-cph2320043-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
6, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320826.234810,VS0,VE10
x-styx-req-id
18393a3a-8cf1-11ef-abbe-f2b03c6e3d3f
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
385
server
nginx
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"15208a8-3437-62370c030d900"
age
6985
x-content-type-options
nosniff
cf-ray
8d4eda5c8d55630a-HAM
expires
Sat, 19 Oct 2024 10:53:46 GMT
accept-ranges
bytes
content-length
2623
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
347 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"15208aa-33c-62370c030d900"
age
6985
x-content-type-options
nosniff
cf-ray
8d4eda5c8d57630a-HAM
expires
Sat, 19 Oct 2024 10:53:46 GMT
accept-ranges
bytes
content-length
246
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/
326 B
229 B
Fetch
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding
gzip
x-goog-hash
crc32c=uhxSig==, md5=XQTCayw0uJPhFpszoEnnIg==
etag
"5d04c26b2c34b893e1169b33a049e722"
age
538
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
196
date
Sat, 19 Oct 2024 06:44:48 GMT
last-modified
Tue, 01 Oct 2024 09:16:16 GMT
content-type
application/json
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY0tVNi_8ZZcm6KPu6mHw-L5P_Kqfpw4maeNyCIvnWdP1kWn5hBtLcKLhcbE0ik24zZDQX8
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1727774176677479
content-length
196
server
UploadServer
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/ Frame
0
0
Preflight
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
DELETE,GET,HEAD,POST,PUT
access-control-allow-origin
*
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
expires
Sat, 19 Oct 2024 06:53:46 GMT
server
UploadServer
via
1.1 google
x-guploader-uploadid
AHmUCY1uiAvgRERl--jPFWLt0E4s-szBGW5voMuRJeMx9AI2eygnWk1JiXeN4_Tj3mcvuFYvaCkMgE2vZQ
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202409.1.0/
457 KB
111 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCED8C88D357E6
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
33223
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 02:45:02 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ecb31dc5-801e-0052-7f23-208e78000000
cf-ray
8d4eda5c998c1e5e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
113760
x-ms-blob-type
BlockBlob
server
cloudflare
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212905
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1fcce91080e0c58b41ddc4bb6e9dad66c72e78802dc59622d8b0a42e5458d3af
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options
nosniff
origin-trial
AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires
Sat, 19 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-security-policy
require-trusted-types-for 'script'
cache-control
private, max-age=0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
x-xss-protection
0
server
ESF
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"7e91359b46e1da637080a03b759164fa"
age
3312
via
1.1 google
cf-ray
8d4eda5d1ec6ca85-HAM
expires
Tue, 22 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
search-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
681 B
626 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-4ddpx
content-encoding
gzip
etag
W/"6711b1e8-2a9"
age
107585
expires
Sun, 19 Oct 2025 01:00:42 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Fri, 18 Oct 2024 00:55:04 GMT
x-served-by
cache-chi-klot8100085-CHI, cache-cph2320056-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320827.521112,VS0,VE8
x-styx-req-id
65e580cc-8cec-11ef-9242-1af01b70491e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
385
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQv2J0rngqFS9Y3OHCCX5rG0705mds6JHlUBHu8sztfTB9wguiHIn%2BmPuG9p5nM0cCtqNhr3WwjSIc97NrW8sBzzRTSZFJ3kKNbyE7JF2Beaw8D2wKqGAF2lTnL5AbFB9RkxGx8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5d2a33a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
header-logo-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg
7 KB
3 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
19661b2f8ca108e51a5adafd6d4658cc410934e96162dbe5c41e80d1892606d8
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-x7p54
content-encoding
gzip
etag
W/"6711b1e9-1b4b"
age
107585
expires
Sun, 19 Oct 2025 01:00:42 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Fri, 18 Oct 2024 00:55:05 GMT
x-served-by
cache-chi-kigq8000126-CHI, cache-cph2320053-CPH, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
11, 0, 0, 0
vary
Accept-Encoding
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320827.521343,VS0,VE8
x-styx-req-id
65e522c3-8cec-11ef-bf95-1e568ca11146
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
2616
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s5j96BU%2F%2BHBvqkZkVDFcU8N%2FX%2FlNdGoP9cSweeLLJ0IZHOK502XUpOqv8Z1dLhnQCgGn1AbB3qvymVE2eFoRHgvl%2BbZSX0V%2FBKRNFMQaNri%2FR03a3WqidwyOs6r9CWyJBkJf59Q%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5d2a35a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
31 KB
31 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4d6e66e10128ecac66c8556d827b74a4118b9b036efba36081a1205195718c7f
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-7ljh9
fastly-io-info
ifsz=43202 idim=1200x628 ifmt=jpeg ofsz=31612 odim=1200x628 ofmt=webp
etag
"5irHR1YuNLMvBrWGbTZJUki9RG+BQKiMbflLmgt0pW0"
age
403187
expires
Wed, 15 Oct 2025 14:53:59 GMT
x-cache
MISS, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/webp
x-served-by
cache-ams21043-AMS, cache-ams21052-AMS, cache-cph2320051-CPH, cache-cph2320051-CPH
x-cache-hits
0, 5, 0, 0
vary
Accept
fastly-stats
io=1
strict-transport-security
max-age=31622400; includeSubDomains; preload
cache-control
max-age=31622400
x-timer
S1729320827.521441,VS0,VE18
x-styx-req-id
2525173a-8a3c-11ef-bc5d-86c29a649947
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
31612
fastly-io-served-by
vpop-etou8240193
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/Threat-Actor-Interplay-Good-Days-Victim-Portals-and-Their-Ties-to-Cloak-3.jpg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jIZIn7205FwLllL07wsNmvrXh6jGytN8wZYY3yRT6STq5JCQJPySEzzlgEYbaJj5xTAGByultG%2B%2FEqsqcROmLZyyZ5EJS725cRVZOrNRYs%2ByUPFnC6NJNDZ%2B9GIWseY6iCeNiBk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda5d2a36a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Accept-Encoding
server
cloudflare
XDFrame
go.sentinelone.com/index.php/form/ Frame 42E0
2 KB
874 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
8d4eda5e0eb7630a-HAM
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sat, 19 Oct 2024 06:53:46 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-7161-9ed5-43e67a363ae5/
172 KB
30 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-7161-9ed5-43e67a363ae5/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
28949ace3235b8211febce28af89ee677531171c3b55897172657102b63592fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
/FWj+4L8+FmRfDFMhY4pQA==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCDF012F151491
age
57132
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Sun, 20 Oct 2024 06:53:46 GMT
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/json
last-modified
Fri, 27 Sep 2024 14:32:15 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
fa9b0a8e-a01e-00a0-66ea-105cec000000
cf-ray
8d4eda5e497835f8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
30186
x-ms-blob-type
BlockBlob
server
cloudflare
collect
region1.analytics.google.com/g/
0
0
Fetch
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je4ah0v889850326za200&_p=1729320826162&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101686685&cid=1095544241.1729320827&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1729320826&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&dt=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1053
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/
0
548 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KJPGLC9EVP&cid=1095544241.1729320827&gtm=45je4ah0v889850326za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101686685
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c1d::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/plain
server
Golfe2
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KJPGLC9EVP&cid=1095544241.1729320827&gtm=45je4ah0v889850326za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101686685&tag_exp=101686685&z=361719004
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 19 Oct 2024 06:53:46 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame 42E0
199 KB
0
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://go.sentinelone.com/index.php/form/XDFrame

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01fe-31b91-62370c030d900"
age
4079
x-content-type-options
nosniff
cf-ray
8d4eda5aab6b630a-HAM
expires
Sat, 19 Oct 2024 10:53:46 GMT
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/x-javascript
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
www-widgetapi.js
www.youtube.com/s/player/e627e516/www-widgetapi.vflset/
31 KB
10 KB
Script
General
Full URL
https://www.youtube.com/s/player/e627e516/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
age
9726
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options
nosniff
expires
Sun, 19 Oct 2025 04:11:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 04:11:40 GMT
last-modified
Wed, 16 Oct 2024 04:17:19 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
content-length
10417
x-xss-protection
0
server
sffe
destination
www.googletagmanager.com/gtag/
278 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d1dc4c9dbd72abaa1bf2afed2c7c617b0d56d069d6f099df368fe4aaf15b718f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires
Sat, 19 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 19 Oct 2024 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
97283
x-xss-protection
0
server
Google Tag Manager
bat.js
bat.bing.com/
50 KB
15 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
gzip
etag
"028e0691d20db1:0"
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 48E31FDAB1354E72AAA3443770A9E269 Ref B: FRA31EDGE0211 Ref C: 2024-10-19T06:53:46Z
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
14570
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 22:47:44 GMT
vary
Accept-Encoding
d6076494.min.js
scripts.demandbase.com/
60 KB
17 KB
Script
General
Full URL
https://scripts.demandbase.com/d6076494.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-46-44.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-amz-version-id
zh5pZEN9OJvnC2CgAf9fhsfPsCZz99sW
etag
W/"f1722349926863d8d1925a6aa07f85ce"
age
2406
x-cache
Hit from cloudfront
x-amz-cf-id
D5W0ukH3rE394gb4ZbDOoTlZ7hpOWvZPyYrn0FtN-wLvfI-lCdjVEA==
date
Sat, 19 Oct 2024 06:17:20 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 08 Dec 2020 23:26:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 fd87ab1d9a433dd02274380a706bf7d2.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P9
server
AmazonS3
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-85-59.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Encoding
gzip
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection
keep-alive
Accept-Ranges
bytes
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length
729
Date
Sat, 19 Oct 2024 06:53:46 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
insight.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
max-age=61040
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
14628
date
Sat, 19 Oct 2024 06:53:46 GMT
last-modified
Thu, 22 Aug 2024 10:43:55 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
qevents.js
a.quora.com/
41 KB
15 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"87b5ecaafd0e88097cbbb1bbb7695fe9"
x-amz-version-id
jrgqQn59BHyNBJEhUqaibHl1Lk06.AzO
age
216278
expires
Sat, 19 Oct 2024 10:53:46 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/plain
last-modified
Thu, 28 Mar 2024 17:33:19 GMT
vary
Accept-Encoding
x-amz-id-2
V1KqiLEqgavTxZxeOhRwxks/e9Bwov1/UFMqsrtEEzLmoDSbUpr5Gq/SrBc09Cr251D8a88zvXjr2380vgygWiCKDQGX6cFQNHy8wkgu4h4=
cache-control
public, max-age=14400
x-amz-meta-s3cmd-attrs
md5:87b5ecaafd0e88097cbbb1bbb7695fe9
x-amz-request-id
CHBWA4MHHEB4ZTF0
cf-ray
8d4eda5feb16266d-TXL
server
cloudflare
x-amz-server-side-encryption
AES256
client.js
cdn.abrankings.com/js/
0
0

js
www.googletagmanager.com/gtag/
223 KB
80 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1a3e960a873afccc3e53c21b5e87d7f51744156a4d4a90edfd97f5aa48e4102e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Sat, 19 Oct 2024 06:53:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 19 Oct 2024 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
81715
x-xss-protection
0
server
Google Tag Manager
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

vary
Accept-Encoding,Host
cache-control
no-cache
content-encoding
gzip
etag
"bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges
bytes
x-cache
HIT, HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length
15412
date
Sat, 19 Oct 2024 06:53:46 GMT
x-tw-cdn
FT
last-modified
Fri, 22 Mar 2024 21:07:24 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-iad-kiad7000168-IAD, cache-muc13937-MUC
x-amz-server-side-encryption
AES256
a.js
cdn.calibermind.com/
213 KB
61 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.213.149 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"668efd6c-354c2"
age
35768
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=txKNfpup24GsN2wlEp5h3o4i%2Bw%2BZE0wEnJD8%2F94MpRHNRVcBeAmMV56qESNUry1ASJfOpLZT0KJoB%2Bh7JAsRmvH3kdWvNHSroNgJzAgI5lfbi2Gn%2B2%2FbqeOE3t%2BPCC1HkpuoSdiA"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=38157&sent=12&recv=8&lost=0&retrans=0&sent_bytes=4182&recv_bytes=4512&delivery_rate=81410&cwnd=12000&unsent_bytes=0&cid=4d302556ab218e0a&ts=62&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
last-modified
Wed, 10 Jul 2024 21:30:20 GMT
vary
Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d4eda5fcc6465b6-FRA
server
cloudflare
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
1 KB
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.213.149 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"668efdda-346"
age
46654
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5HE9AvR6PoYo1tTMEjsjfGjDwH66X04NGgMnzBkp4q3EGhFkoS8BDSKodtJrDgEw8wWpniM%2BBsWdWwUjTO0ZStTIqJVRD0qAG3Z13mCLjmi8j8RWjIzQG5FHoK1wpwYA2%2F%2FwN6H"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=38157&sent=22&recv=8&lost=0&retrans=0&sent_bytes=15600&recv_bytes=4512&delivery_rate=81410&cwnd=12000&unsent_bytes=0&cid=4d302556ab218e0a&ts=70&x=1", cfExtPri, cfHdrFlush;dur=30
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript
last-modified
Wed, 10 Jul 2024 21:32:10 GMT
vary
Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d4eda5fdc7165b6-FRA
server
cloudflare
events.js
tags.srv.stackadapt.com/
22 KB
8 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
55e35faaba4dfc8433390ab99542f942b5af6ee60969a9e39d51a1d951985bea

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
max-age=5
content-encoding
gzip
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/javascript
d16b1fea0b2ed64f.min.js
tag.demandbase.com/
61 KB
18 KB
Script
General
Full URL
https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-46-44.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-amz-version-id
N2rb5lMV51RwbNUWzMvxWNf3Nzc5EPqh
etag
W/"1745d7ef3444455a72a3f86e4fb2ad07"
age
2406
x-cache
Hit from cloudfront
x-amz-cf-id
z3121av8_35C3yk-PQpFSIkTTyCD1E6Mz9XmznOZ5lYur5uPgvuE7A==
date
Sat, 19 Oct 2024 06:17:22 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 13:53:58 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 fd87ab1d9a433dd02274380a706bf7d2.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P9
server
AmazonS3
x-amz-server-side-encryption
AES256
o0e2bgdhqr
www.clarity.ms/tag/
553 B
809 B
Script
General
Full URL
https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8c705886eb654e0551d610ed7bf353373a67fea2a00f0ffd1dd015ae0f348bbf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
553
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/x-javascript
x-azure-ref
20241019T065347Z-176d4fdd79cr92c836nts3ssag0000000k4000000000kty4
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6086638121979325715
4 B
279 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6086638121979325715
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2600:9000:206f:8a00:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

via
1.1 910fc18161f0602555cc5b6397ca26f2.cloudfront.net (CloudFront)
apigw-requestid
f4qbahbIoAMEPDg=
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
4
x-amz-cf-id
UmR4J0dXWGXuFV9sOxSdipSCWy0y6efRMrgpZZpmMbZHbOEWifop0g==
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/json
x-amz-cf-pop
FRA56-C1

Redirect headers

cache-control
no-store, no-cache, private
location
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6086638121979325715
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
80.255.7.122; 80.255.7.122; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
a683939a-d39a-4728-8add-c4e945cfa172
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sat, 19 Oct 2024 06:53:47 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
rt
tags.srv.stackadapt.com/
43 B
945 B
Image
General
Full URL
https://tags.srv.stackadapt.com/rt?sid=DIQlrAikIjHHohfyFxzIrn
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/gif
content-length
43
uid
ca.knock-ai.com/client/an/v1/
50 B
371 B
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1/uid
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
82124d33814bfce8a525ea7932740ef9394fce2adc10b91dcc2b661f6bbbd364
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
x-request-id
ff8b85c7-ba0a-4dd7-b3ea-df39dbd843a7
cache-control
private, max-age=31536000, immutable
etag
4404905a4b21aa827605773dc0469c18
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
50
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/html; charset=utf-8
x-powered-by
Express
server
Google Frontend
x-cloud-trace-context
a4f5c8b0718f873e149344e25aeedf83
x-frame-options
SAMEORIGIN
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec24e2c2f9d7b5e5ec9401310f5338c072dc877e0e1482507a14358620486d3a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
48cc08ce-114a-48f9-b192-749ed6582846
content-encoding
br
cf-bgj
minify
etag
W/"d16cd3240bd02163ec935c81458d8f25"
age
1474
cf-cache-status
HIT
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Sat, 19 Oct 2024 07:53:46 GMT
cf-polished
origSize=3446
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/javascript; charset=utf-8
vary
Origin, Accept-Encoding
x-runtime
0.031754
x-frame-options
SAMEORIGIN
access-control-allow-headers
SDK-Version
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=3600
referrer-policy
strict-origin-when-cross-origin
via
1.1 google
x-download-options
noopen
cf-ray
8d4eda60a8e86a63-HAM
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
otFlat.json
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
RGlYb2KBTfdkPpxIxwwu0g==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCED8C8519203B
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
54475
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/json
last-modified
Wed, 16 Oct 2024 02:44:56 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
cfbc84a1-901e-00a3-1c00-205feb000000
cf-ray
8d4eda5fba9035f8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
3003
x-ms-blob-type
BlockBlob
server
cloudflare
otPcPanel.json
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/
64 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
woYZp0HVhx8yo641nhyLrw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCED8C868E8C65
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
57096
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/json
last-modified
Wed, 16 Oct 2024 02:44:58 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
5d9905d1-901e-00e7-61da-1f8387000000
cf-ray
8d4eda5fba9235f8-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
12881
x-ms-blob-type
BlockBlob
server
cloudflare
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/
24 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
53794
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
text/css
last-modified
Wed, 16 Oct 2024 02:45:07 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ccd14207-201e-00ba-19d9-1f7383000000
cf-ray
8d4eda5fba9335f8-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
ABCWhytePlusVariable.woff2
de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
  • https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
242 KB
0
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-c22gl
etag
"6711b1e9-3c6a4"
age
107691
expires
Sun, 19 Oct 2025 00:58:55 GMT
x-cache
HIT, HIT, MISS, MISS
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
font/woff2
last-modified
Fri, 18 Oct 2024 00:55:05 GMT
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000040-CHI, cache-cph2320021-CPH, cache-cph2320030-CPH, cache-cph2320030-CPH
cache-control
max-age=31622400
x-timer
S1729320826.021718,VS0,VE8
x-styx-req-id
260871ca-8cec-11ef-b851-8ed28118664d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
247460
server
nginx

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHhFN9jvwfY00Svpcfjwr0XagAtM4ZHH1Q6%2B9af9bwsey3ItlEqLg0wk00HqZwXIH4aGeM1zQd5r4JaVIGXaI4wJrzAK%2FMCABeDUyrhqBsIvwkK7EiRP96lzWt%2FVy3N1M2iXTz8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d4eda60dda3a03d-FRA
content-length
0
date
Sat, 19 Oct 2024 06:53:47 GMT
vary
Accept-Encoding
server
cloudflare
ot_close.svg
cdn.cookielaw.org/logos/static/
651 B
601 B
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_close.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
30682
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:42 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
7b5cf61b-201e-001b-0ce1-1fbd18000000
cf-ray
8d4eda604cd21e5e-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/
497 B
518 B
Fetch
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
84336
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:42 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
d9dd2877-d01e-0027-6ff5-1f09c3000000
cf-ray
8d4eda60cb6e35f8-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
header-logo-dark.png
cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/
17 KB
17 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/header-logo-dark.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
zP9vNoac0WWOsoM5qHSlqQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
etag
0x8DCD7E5B54439DF
age
37305
cf-cache-status
HIT
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
mage/png
last-modified
Wed, 18 Sep 2024 13:27:56 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
e0125d72-801e-0095-09ce-09f2b9000000
cf-ray
8d4eda60dd321e5e-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
17475
x-ms-blob-type
BlockBlob
server
cloudflare
powered_by_logo.svg
cdn.cookielaw.org/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
34546
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/svg+xml
last-modified
Wed, 16 Oct 2024 06:37:43 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
324d4739-a01e-00a0-6e98-1f5cec000000
cf-ray
8d4eda60dd331e5e-FRA
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-85-59.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Cache-Control
max-age=8640000
Content-Encoding
gzip
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection
keep-alive
Expires
Mon, 27 Jan 2025 06:53:47 GMT
Accept-Ranges
bytes
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length
4741
Date
Sat, 19 Oct 2024 06:53:47 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/
43 B
294 B
Image
General
Full URL
https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&tag=ViewContent&ts=1729320827026
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-q-stat
,4840ed0ede9149a687d9d7e314ff2ee7,10.0.0.251,60028,80.255.7.122,,422920914120,1,1729320827.123,0.002,,.,0,0,0.000,0.000,-,0,0,203,69,34,10,26847,,,,,,-,
cf-ray
8d4eda612c86266d-TXL
alt-svc
h3=":443"; ma=86400
content-length
43
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/gif
server
cloudflare
adsct
t.co/1/i/
43 B
625 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=23f53f2d-6064-43b4-a42c-6af8f4bf2b58&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=744a7a86-a4d3-4566-995e-08355a339684&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
2ddc13681a151e4d
cache-control
no-cache, no-store, max-age=0
x-connection-hash
623508ac4869160c5c2cd9891c7d6d25476e31408ec8c454e27a94611497b80b
cf-cache-status
DYNAMIC
cf-ray
8d4eda61bf7eca5c-HAM
x-response-time
100
content-length
43
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_o
adsct
analytics.twitter.com/1/i/
43 B
724 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=23f53f2d-6064-43b4-a42c-6af8f4bf2b58&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=744a7a86-a4d3-4566-995e-08355a339684&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
baabd64fec3768ec
cache-control
no-cache, no-store, max-age=0
x-connection-hash
5ff9fd58a65174f9db3e4c904def6bb80e485a75c742a91078e6c7a89ee249fa
x-response-time
102
content-length
43
date
Sat, 19 Oct 2024 06:53:47 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_o
ip.json
api.company-target.com/api/v2/
12 B
513 B
XHR
General
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&page_title=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/d6076494.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-98.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
7200
access-control-expose-headers
access-control-allow-methods
GET, POST, OPTIONS
x-content-type-options
nosniff
request-id
c44e4529-6203-4646-8df9-a956e8c3bf4c
x-cache
Error from cloudfront
x-amz-cf-id
lNGY3obY1WYe49EEA61JU41XM2WVv8pX9JVgUBKnkAhmJZPQpCeUOw==
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/plain;charset=utf-8
vary
Origin
www-authenticate
DemandBase API
access-control-allow-credentials
true
via
1.1 1f0db25765b79d244ad1fa2184395c12.cloudfront.net (CloudFront)
access-control-allow-origin
https://www.sentinelone.com
content-length
12
x-amz-cf-pop
FRA56-P2
server
nginx
demandbase
match.prod.bidr.io/cookie-sync/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
27 B
27 B
Image
General
Full URL
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
HTTP/1.1
Server
52.210.72.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-72-167.eu-west-1.compute.amazonaws.com
Software
gunicorn /
Resource Hash
0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
27
Date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/plain
Server
gunicorn
Connection
keep-alive

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Content-Length
0
Date
Sat, 19 Oct 2024 06:53:47 GMT
Server
gunicorn
Connection
keep-alive
464526.gif
id.rlcdn.com/
0
98 B
Image
General
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Sat, 19 Oct 2024 06:53:47 GMT
134618848.js
bat.bing.com/p/action/
370 B
420 B
Script
General
Full URL
https://bat.bing.com/p/action/134618848.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
br
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: BFC32E61F9A04B0BA288339C6D9A51E3 Ref B: FRA31EDGE0211 Ref C: 2024-10-19T06:53:47Z
x-cache
CONFIG_NOCACHE
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
attribution_trigger
px.ads.linkedin.com/
2 B
817 B
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*
Referer
https://www.sentinelone.com/

Response headers

x-li-pop
afd-prod-lva1-x
content-encoding
gzip
x-fs-uuid
000624cee19c7b6a0d4fe1978d47dfc7
x-msedge-ref
Ref A: 0FEEF4B1156547DFB57E51F6838DF262 Ref B: DUS30EDGE0711 Ref C: 2024-10-19T06:53:47Z
x-li-fabric
prod-lva1
x-restli-protocol-version
1.0.0
access-control-allow-methods
GET, OPTIONS
x-li-uuid
AAYkzuGce2oNT+GXjUffxw==
x-li-proto
http/2
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/json
access-control-allow-headers
*
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-t...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-...
0
267 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&e_ipv6=AQJT-60iw9LG7gAAAZKjjbmSSrzj2OAH_jjxwLflttcSwuuDd7iFVwNt70ZUirqyY1vvOQ8
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: FF94E10CF1B04EDABEB3DF786159B4DA Ref B: DUS30EDGE0712 Ref C: 2024-10-19T06:53:47Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYkzuGhCZwWC5Qeq7hA2w==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729320827075&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&e_ipv6=AQJT-60iw9LG7gAAAZKjjbmSSrzj2OAH_jjxwLflttcSwuuDd7iFVwNt70ZUirqyY1vvOQ8
x-msedge-ref
Ref A: 2DFC4B8B96284818AFE8294133F924DC Ref B: FRAEDGE1318 Ref C: 2024-10-19T06:53:47Z
x-li-fabric
prod-ltx1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYkzuGcx9V/+JO+u2M+0g==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Sat, 19 Oct 2024 06:53:46 GMT
/
px.ads.linkedin.com/wa/
0
442 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 3A40C8D6A54449EDB244D2A10FE30607 Ref B: FRAEDGE1318 Ref C: 2024-10-19T06:53:47Z
x-li-fabric
prod-ltx1
access-control-allow-credentials
true
x-li-uuid
AAYkzuGcxtBbsMWlraL9Tg==
x-li-proto
http/2
access-control-allow-origin
https://www.sentinelone.com
x-cache
CONFIG_NOCACHE
date
Sat, 19 Oct 2024 06:53:46 GMT
vary
Origin
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
23b7c02712582224b05809fe9ad972d9054df4970bea73d0011e24195e123317

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/jpeg
sa.jpeg
tags.srv.stackadapt.com/
0
0
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/jpeg
rt
tags.srv.stackadapt.com/
43 B
108 B
Image
General
Full URL
https://tags.srv.stackadapt.com/rt?sid=uQM497B9yR1fPnLLwZZDtK&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&t=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&tip=i33HbTqRFGwN3540dp5dZdUkCbHhYPfLZSr1WmGeg14&l_src=&l_src_d=&u_src=&u_src_d=&shop=false
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/gif
content-length
43
p
e.calibermind.com/v1/
16 B
777 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.213.149 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
900
x-request-id
b9ea9a76-5cf2-4f07-a965-8dae5a3d123d
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8FQTEvVNiq25Kf2UtZcbCV5lGfsXJKZd6UwY1B4j%2BtRVHvOF7PRiiMM9PunfkkwP0Z7Q8vtzrx2aYaB0hF6gAlPrlLJwGcWzMu45%2FOONp4cs12f08IbvVrawaqI9q7m4DvsVHA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=38569&sent=12&recv=12&lost=0&retrans=0&sent_bytes=4180&recv_bytes=5825&delivery_rate=439&cwnd=12000&unsent_bytes=0&cid=2a6c5f8f7d2438b5&ts=436&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/json; charset=utf-8
priority
u=1,i
access-control-allow-headers
Content-Type,Authorization
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8d4eda625be3d232-FRA
access-control-allow-origin
*
content-length
16
server
cloudflare
v1
ca.knock-ai.com/client/an/
0
0
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1?clientId=97ee7348-9176-4a4b-9af2-40711264546b&version=1.1.1&revisionNumber=10&userId=7e456670-e7c0-494b-868a-cda037dd7fd2.1729320826967&sessionId=d6400c7d-8077-479d-9480-2e1450426054&prevSessionStartTime=null&sessionStartTime=1729320827173&browser=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36&device=pc&os=Linux&pageNumber=1&pageVisit=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&prevPageVisitStartTime=null&pageVisitStartTime=1729320827174&prevPageVisitEndTime=null&pageVisitEndTime=null&timestamp=1729320827174&utmSource=&utmMedium=&utmCampaign=&utmTerm=&utmContent=&referrerDomain=&referrerPath=&referrerUrl=Direct
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

0
bat.bing.com/action/
0
287 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=5b01cd3d-837c-49d3-b20b-43a4858ea127&bo=1&sid=e39549508de611ef85333b970996d9c1&vid=e395be108de611ef90bcb953a55833d0&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&p=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&r=&lt=750&evt=pageLoad&sv=1&cdb=AQET&rn=992002
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DC604C6AF06840B9AF8D810176304C65 Ref B: FRA31EDGE0211 Ref C: 2024-10-19T06:53:47Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Sat, 19 Oct 2024 06:53:46 GMT
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1729320827208&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1729320827204-21956&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Transfer-Encoding
chunked
X-Request-Id
46a6aac8-9f01-42de-b418-446b7a00cc3a
Content-Encoding
gzip
Connection
keep-alive
Access-Control-Allow-Origin
*
Date
Sat, 19 Oct 2024 06:53:47 GMT
Content-Type
text/plain; charset=UTF-8
Server
nginx/1.20.1
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2592000
content-encoding
br
cf-cache-status
HIT
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
age
2555
via
1.1 google
cf-ray
8d4eda628a5c6a63-HAM
expires
Mon, 18 Nov 2024 06:53:47 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/css
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
clarity.js
www.clarity.ms/s/0.7.48/
64 KB
27 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.48/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-azure-ref
20241019T065347Z-176d4fdd79cr92c836nts3ssag0000000k4000000000ktz7
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DCEEDAF33D8C6F"
x-fd-int-roxy-purgeid
51562430
x-ms-request-id
e80c7123-701e-0001-584f-217107000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Thu, 17 Oct 2024 18:38:53 GMT
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&t=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&tip=i33HbTqRFGwN3540dp5dZdUkCbHhYPfLZSr1WmGeg14&host=https%3A%2F%2Fwww.sentinelone.com&sa_conv_data_css_value=%270-17ea928b-5b5c-5acc-5db5-da1bb32911e2%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd917ea928b5b5c5acc5db5da1bb32911e250ff077a&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKICtiEwmzRs-nB6axd8iM-Mr_pIYAGl0SlHcI7Q7NKn1eENYBGAQg-q7NuAYwAToEQN4Ii0IE3CKHKw.L5AfU%252BQAIByzuyLISnxAzHGvpVcnK6BIMr4%252BYonJwYg&sa-user-id-v2=s%253AF-qSi1tcWsxdtdobsykR4lD_B3o.%252Fc56W%252BVfy%252Bc6ana2n42Vz%252FOOCuk7yPVhw%252FzEmMWOags&sa-user-id=s%253A0-17ea928b-5b5c-5acc-5db5-da1bb32911e2.%252Fqpd0nDCXZ%252FKmSHd5rq2UJm8KobqdzpHNDHWmLN50z8
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.sentinelone.com
content-length
213
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&t=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&tip=i33HbTqRFGwN3540dp5dZdUkCbHhYPfLZSr1WmGeg14&host=https%3A%2F%2Fwww.sentinelone.com&sa_conv_data_Event%20Name=mkto.form.success&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd917ea928b5b5c5acc5db5da1bb32911e250ff077a&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKICtiEwmzRs-nB6axd8iM-Mr_pIYAGl0SlHcI7Q7NKn1eENYBGAQg-q7NuAYwAToEQN4Ii0IE3CKHKw.L5AfU%252BQAIByzuyLISnxAzHGvpVcnK6BIMr4%252BYonJwYg&sa-user-id-v2=s%253AF-qSi1tcWsxdtdobsykR4lD_B3o.%252Fc56W%252BVfy%252Bc6ana2n42Vz%252FOOCuk7yPVhw%252FzEmMWOags&sa-user-id=s%253A0-17ea928b-5b5c-5acc-5db5-da1bb32911e2.%252Fqpd0nDCXZ%252FKmSHd5rq2UJm8KobqdzpHNDHWmLN50z8
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.126.222.51 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-222-51.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.sentinelone.com
content-length
213
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
240 B
784 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
1ba1d7fb-7dc8-47be-94e5-c023e5c81df7
content-encoding
br
cf-cache-status
HIT
etag
W/"c30dc39ff7449779c568ff4e90c170f0"
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
application/json; charset=utf-8
vary
Accept, Origin, Accept-Encoding
x-runtime
0.014313
access-control-allow-headers
SDK-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
max-age=0, private, must-revalidate
referrer-policy
strict-origin-when-cross-origin
x-download-options
noopen
via
1.1 google
cf-ray
8d4eda6359bd7282-HAM
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
messenger
app.qualified.com/w/1/ZQoyHXFTqngPcfcB/ Frame 0765
0
0
Document
General
Full URL
https://app.qualified.com/w/1/ZQoyHXFTqngPcfcB/messenger?uuid=b8c2cb86-f2cf-4fff-ad57-7f5679816e31
Requested by
Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=ZQoyHXFTqngPcfcB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8d4eda64a81aca70-HAM
content-encoding
gzip
content-security-policy
content-type
text/html; charset=utf-8
date
Sat, 19 Oct 2024 06:53:47 GMT
link
<https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
server-timing
cfCacheStatus;desc="DYNAMIC"
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
x-cache
miss
x-content-type-options
nosniff
x-download-options
noopen
x-envoy-upstream-service-time
26
x-permitted-cross-domain-policies
none
x-request-id
eafd0f19-0cbc-4b3a-a9af-1db9da651723
x-runtime
0.024128
x-xss-protection
1; mode=block
wINUGMVQyKNdKtMTH4Wt_s1.png
img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/
6 KB
7 KB
Image
General
Full URL
https://img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/wINUGMVQyKNdKtMTH4Wt_s1.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=1QkUUA==, md5=Dj+SUoicGnX7oiG7n37+GQ==
cf-bgj
imgq:85,h2pri
etag
"-CPLdwrW3woQDEAE="
age
1475
cf-cache-status
HIT
x-goog-stored-content-encoding
identity
expires
Tue, 19 Nov 2024 06:53:47 GMT
cf-polished
origSize=11143, status=vary_header_present
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
11143
date
Sat, 19 Oct 2024 06:53:47 GMT
content-type
image/png
last-modified
Fri, 23 Feb 2024 21:44:25 GMT
vary
Origin, Accept-Encoding
x-guploader-uploadid
ACJd0Nrl5lFdjBWzwX7lwLeNmPn-R8z_wpa0UjHvw36FfkD7pmgFsTStXM92vjZCWqzcsL56tJw
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2678400
pragma
no-cache
x-goog-storage-class
STANDARD
cf-ray
8d4eda643d2eca85-HAM
x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
accept-ranges
bytes
x-goog-generation
1708724665233138
content-length
6492
server
cloudflare
collect
n.clarity.ms/
0
283 B
XHR
General
Full URL
https://n.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.175.234.12 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Sat, 19 Oct 2024 06:53:47 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
collect
n.clarity.ms/
0
283 B
XHR
General
Full URL
https://n.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.175.234.12 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Sat, 19 Oct 2024 06:53:48 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
collect
n.clarity.ms/
0
283 B
XHR
General
Full URL
https://n.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.175.234.12 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Sat, 19 Oct 2024 06:53:50 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
/
www.googleadservices.com/pagead/conversion/970186784/
6 KB
3 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/970186784/?random=1729320831641&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&bttype=purchase&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
4351d63f954607188842f742d89242828c6ba013aaeb13c731b23cdf2fe38b46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
2815
date
Sat, 19 Oct 2024 06:53:51 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;u...
13115870.fls.doubleclick.net/ Frame 9556
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=...
0
0
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.102 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
415
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 19 Oct 2024 06:53:51 GMT
expires
Sat, 19 Oct 2024 06:53:51 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sat, 19 Oct 2024 06:53:51 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CIykh4_umYkDFYCT_QcdeDoiHw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
px4.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
  • https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJx92MzcyduZAAAAZKjjcsGk3dcERBamDQ3ylyDudrw1aEBGmIPF9AZtoDaWmJn6hDhUQc
43 B
248 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJx92MzcyduZAAAAZKjjcsGk3dcERBamDQ3ylyDudrw1aEBGmIPF9AZtoDaWmJn6hDhUQc
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
content-encoding
gzip
x-msedge-ref
Ref A: 3FAE908BAA684708BAB1EE1FB1CCC30B Ref B: DUS30EDGE0712 Ref C: 2024-10-19T06:53:51Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYkzuHjrGXDnBtug8ofHw==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
65
date
Sat, 19 Oct 2024 06:53:51 GMT
content-type
image/gif
vary
Accept-Encoding

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
location
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJx92MzcyduZAAAAZKjjcsGk3dcERBamDQ3ylyDudrw1aEBGmIPF9AZtoDaWmJn6hDhUQc
x-msedge-ref
Ref A: CA63E2F2D67441B2989A1CA250A59F16 Ref B: FRAEDGE1318 Ref C: 2024-10-19T06:53:51Z
x-li-fabric
prod-ltx1
x-li-uuid
AAYkzuHg9sK5IzMtiC151g==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Sat, 19 Oct 2024 06:53:51 GMT
activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=no...
ad.doubleclick.net/
0
23 B
Image
General
Full URL
https://ad.doubleclick.net/activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=1;auiddc=2095795357.1729320827;ps=1;pcor=1899387312;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F?
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.230 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Sat, 19 Oct 2024 06:53:51 GMT
attribution-reporting-register-trigger
{"aggregatable_deduplication_keys":[{"deduplication_key":"4653382088267786067"}],"aggregatable_trigger_data":[{"filters":[{"14":["14055451"]}],"key_piece":"0x8df7aeb1216dcdda","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x67203eedbaa215a3","not_filters":{"14":["14055451"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"13622460619842188384","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"4653382088267786067","filters":[{"14":["14055451"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"4653382088267786067","filters":[{"14":["14055451"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"4653382088267786067","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"4653382088267786067","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["13115870"]}}
content-type
image/png
x-xss-protection
0
server
cafe
0
bat.bing.com/action/
0
239 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=5b01cd3d-837c-49d3-b20b-43a4858ea127&bo=2&sid=e39549508de611ef85333b970996d9c1&vid=e395be108de611ef90bcb953a55833d0&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQET&rn=15779
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 712986705CD34647B708791056AB5B09 Ref B: FRA31EDGE0211 Ref C: 2024-10-19T06:53:51Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Sat, 19 Oct 2024 06:53:51 GMT
/
www.google.pt/pagead/1p-conversion/970186784/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13...
  • https://www.google.com/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=sy...
  • https://www.google.pt/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syp...
42 B
455 B
Image
General
Full URL
https://www.google.pt/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJDJsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMI4aqDj-6ZiQMVP4iDBx0wzwJJMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkhqU2hYdXB5cTlpbFJZSHI2d1hKa0kwMkt5bmtvalFqbEZnYmNfMUs4OUVDMWh0OVBWZ3Q5Zw&is_vtc=1&cid=CAQSGwDpaXnfyTczD3DB1YclR6s831ofD-2P3fIqbg&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaMozRNEyPqHrsZmHeLm0gFWfKrTBrboaGA&random=18274263&ipr=y
Protocol
H2
Server
2a00:1450:4001:81d::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 19 Oct 2024 06:53:52 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
location
https://www.google.pt/pagead/1p-conversion/970186784/?random=714924134&cv=11&fst=1729320831641&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101533421~101686685~101794736&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&value=0&npa=1&pscdl=noapi&auid=2095795357.1729320827&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=CA&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCJDJsQJKJ2V2ZW50LXNvdXJjZTtuYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMI4aqDj-6ZiQMVP4iDBx0wzwJJMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkhqU2hYdXB5cTlpbFJZSHI2d1hKa0kwMkt5bmtvalFqbEZnYmNfMUs4OUVDMWh0OVBWZ3Q5Zw&is_vtc=1&cid=CAQSGwDpaXnfyTczD3DB1YclR6s831ofD-2P3fIqbg&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaMozRNEyPqHrsZmHeLm0gFWfKrTBrboaGA&random=18274263&ipr=y
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 19 Oct 2024 06:53:52 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.abrankings.com
URL
https://cdn.abrankings.com/js/client.js

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| NREUM object| webpackChunk:NRBA-1.268.0.PROD object| newrelic function| FontFaceObserver function| OptanonWrapper function| $ function| jQuery object| MktoForms2 function| documentInitOneSignal function| OneSignal string| QualifiedObject function| qualified function| gtag object| dataLayer object| OtTrustedType string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| ClipboardJS object| lazyLoadInstance function| checkPageScroll function| LazyLoad function| WOW object| Apologetic object| Autopop object| FormGCLID object| GlobalMediaViewer object| PathFactoryUtils object| UtmLinks object| wow object| swiper object| hljs object| MarkerAnimation function| Swiper object| TableOfContents object| AmazonPolly object| Highlighter object| Magnifier object| Tooltip object| ProgressBar function| addCaptchaScript object| google_tag_manager object| google_tag_data boolean| _q_widgetInitialized string| _q_lastClientActivityAt function| onYouTubeIframeAPIReady object| gaGlobal object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| Cookies object| freeEditElems string| _linkedin_partner_id object| _linkedin_data_partner_ids function| qp number| abr_id function| twq object| analytics function| saq function| _saq function| lintrk function| clarity object| zi string| ZIProjectKey number| __knock_is_running number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| expireIn object| Optanon object| OneTrust function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| qevents object| regeneratorRuntime object| twttr function| UET function| UET_init function| UET_push function| __extends object| Demandbase object| __db function| DBSegment function| ga object| ueto_2098b0c7d8 object| uetq boolean| _already_called_lintrk object| ORIBILI object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ string| res string| current_window_url_param object| MunchkinTracker object| saCookies object| GooglebQhCsO object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener number| r

40 Cookies

Domain/Path Name / Value
.sentinelone.com/ Name: __cfredirector_sm
Value: DE
.go.sentinelone.com/ Name: __cf_bm
Value: enOieSJa7MgTzBlOyOhMbJ9bMYyCcUHbc2PsZ9VPCm0-1729320826-1.0.1.1-KfTRCe00hkFoyrWcP2hrraOzfs2oB1spelXjWgvfBjB5fBkNFjB3TD0jSCvLoxVgxDsceFO3OMoQdihytngVCA
.onesignal.com/ Name: __cf_bm
Value: ZTNaHcNtuKQYiutRSu6rOZdLkJus.5.Al4Md.aQ3Ex0-1729320826-1.0.1.1-uHwPRnKEkxjAqAjH_4J2SQ74QSWAfV2ydJ8Tn6y_Eq536S3esjC_AgyjiTMcWQcurkEcS4rx9DFQNbpz4laCiw
.youtube.com/ Name: YSC
Value: 8eph2KBVI9o
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: AQctZAFNPiI
.youtube.com/ Name: VISITOR_PRIVACY_METADATA
Value: CgJERRIEEgAgSQ%3D%3D
.sentinelone.com/ Name: __q_state_ZQoyHXFTqngPcfcB
Value: eyJ1dWlkIjoiYjhjMmNiODYtZjJjZi00ZmZmLWFkNTctN2Y1Njc5ODE2ZTMxIiwiY29va2llRG9tYWluIjoic2VudGluZWxvbmUuY29tIn0=
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !67sIUqp6fE59rZ3agI9xdiUvaZp4gmeES3+vZhqfJLvW/E9XgGWhhmBugI4yfGdNx/5v/mz8XuPBxD8=
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1729320826.1.0.1729320826.60.0.0
.sentinelone.com/ Name: _ga
Value: GA1.1.1095544241.1729320827
.sentinelone.com/ Name: _gcl_au
Value: 1.1.2095795357.1729320827
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Sat+Oct+19+2024+08%3A53%3A46+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-17ea928b-5b5c-5acc-5db5-da1bb32911e2.%2Fqpd0nDCXZ%2FKmSHd5rq2UJm8KobqdzpHNDHWmLN50z8
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-17ea928b-5b5c-5acc-5db5-da1bb32911e2.%2Fqpd0nDCXZ%2FKmSHd5rq2UJm8KobqdzpHNDHWmLN50z8
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AF-qSi1tcWsxdtdobsykR4lD_B3o.%2Fc56W%2BVfy%2Bc6ana2n42Vz%2FOOCuk7yPVhw%2FzEmMWOags
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AF-qSi1tcWsxdtdobsykR4lD_B3o.%2Fc56W%2BVfy%2Bc6ana2n42Vz%2FOOCuk7yPVhw%2FzEmMWOags
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKICtiEwmzRs-nB6axd8iM-Mr_pIYAGl0SlHcI7Q7NKn1eENYBGAQg-q7NuAYwAToEQN4Ii0IE3CKHKw.L5AfU%2BQAIByzuyLISnxAzHGvpVcnK6BIMr4%2BYonJwYg
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKICtiEwmzRs-nB6axd8iM-Mr_pIYAGl0SlHcI7Q7NKn1eENYBGAQg-q7NuAYwAToEQN4Ii0IE3CKHKw.L5AfU%2BQAIByzuyLISnxAzHGvpVcnK6BIMr4%2BYonJwYg
.sentinelone.com/ Name: ajs_anonymous_id
Value: ce398889-2e8f-4d01-b965-76b61cfe7c71
www.sentinelone.com/ Name: sa-user-id
Value: s%253A0-17ea928b-5b5c-5acc-5db5-da1bb32911e2.%252Fqpd0nDCXZ%252FKmSHd5rq2UJm8KobqdzpHNDHWmLN50z8
www.sentinelone.com/ Name: sa-user-id-v2
Value: s%253AF-qSi1tcWsxdtdobsykR4lD_B3o.%252Fc56W%252BVfy%252Bc6ana2n42Vz%252FOOCuk7yPVhw%252FzEmMWOags
www.sentinelone.com/ Name: sa-user-id-v3
Value: s%253AAQAKICtiEwmzRs-nB6axd8iM-Mr_pIYAGl0SlHcI7Q7NKn1eENYBGAQg-q7NuAYwAToEQN4Ii0IE3CKHKw.L5AfU%252BQAIByzuyLISnxAzHGvpVcnK6BIMr4%252BYonJwYg
.sentinelone.com/ Name: _uetsid
Value: e39549508de611ef85333b970996d9c1
.sentinelone.com/ Name: _uetvid
Value: e395be108de611ef90bcb953a55833d0
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1729320827204-21956
.bing.com/ Name: MUID
Value: 2ED3561FF5416C051F4D4302F4CA6DAE
.twitter.com/ Name: guest_id_marketing
Value: v1%3A172932082719745795
.twitter.com/ Name: guest_id_ads
Value: v1%3A172932082719745795
.twitter.com/ Name: personalization_id
Value: "v1_IaKjElOgonI8uK8Ampcs5A=="
.twitter.com/ Name: guest_id
Value: v1%3A172932082719745795
.t.co/ Name: muc_ads
Value: fbf65dc1-c38f-428a-a43e-eb0a3438c3bf
.t.co/ Name: __cf_bm
Value: LRRKA7q_1nLNZTcrbB5ayzNGOzkJRDb.yo7FaDRiue0-1729320827-1.0.1.1-j7h3XoE.SSuC_Zg2ZvohJ.PKOVt3sMciSbl0eyc4P9dciHM_.sWehJT_80ZcRSBbxesCc6L3z8HNKwCARlk50Q
.bidr.io/ Name: bito
Value: AAI8JU7OJq8AABV7hHAsTw
.bidr.io/ Name: bitoIsSecure
Value: ok
.linkedin.com/ Name: lidc
Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3314:u=1:x=1:i=1729320827:t=1729407227:v=2:sig=AQF9LMkUntrXBIgrg7clGjYsljqv8O3C"
.linkedin.com/ Name: bcookie
Value: "v=2&ca6dc87c-0535-43b1-801b-f6812e0169f7"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MjkzMjA4Mjc7MjswMjE/XYGPYFk/KVx2qlvRveQqWFs11PNr4NdJHmCT+tCW7w==
.adnxs.com/ Name: XANDR_PANID
Value: jLv8u5Jttyg5GfkrXsi8_oPIxClvgSQSC2B3rJfWH_02K8rjgNxFms1sGhgs5f-wZ1LuUpsgP1Oa9OD63AXeJLgO1lqsfMe5DCWGVPoWUh4.
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.adnxs.com/ Name: uuid2
Value: 6086638121979325715

3 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fthreat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak%2F&page_title=Threat%20Actor%20Interplay%20%7C%20Good%20Day%E2%80%99s%20Victim%20Portals%20and%20Their%20Ties%20to%20Cloak&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
ad.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
app.qualified.com
attr.ml-api.io
bat.bing.com
ca.knock-ai.com
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.onesignal.com
de.sentinelone.com
e.calibermind.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
id.rlcdn.com
img.onesignal.com
js.knock-ai.com
js.qualified.com
match.prod.bidr.io
munchkin.marketo.net
n.clarity.ms
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
s.ml-attr.com
scripts.demandbase.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tag.demandbase.com
tags.srv.stackadapt.com
www.clarity.ms
www.google.com
www.google.de
www.google.pt
www.googleadservices.com
www.googletagmanager.com
www.sentinelone.com
www.youtube.com
cdn.abrankings.com
104.17.111.223
104.17.73.206
104.18.16.5
104.244.42.3
104.26.3.18
13.107.42.14
142.250.184.230
142.250.185.228
142.250.186.130
142.250.186.35
142.250.186.66
162.159.140.229
162.159.152.17
172.175.234.12
172.217.18.102
172.67.213.149
18.245.46.44
18.66.102.98
184.31.85.59
185.89.211.116
192.28.144.124
199.232.188.157
2001:4860:4802:34::36
2600:9000:206f:8a00:5:7a81:86c0:93a1
2606:4700:4400::6812:2089
2606:4700::6812:562a
2620:12a:8000::2
2620:1ec:21::14
2620:1ec:33::10
2620:1ec:bdf::64
2a00:1450:4001:80f::200e
2a00:1450:4001:80f::2013
2a00:1450:4001:810::200a
2a00:1450:4001:81c::2008
2a00:1450:4001:81d::2003
2a00:1450:400c:c1d::9d
2a02:26f0:3500:10::210:a99
3.126.222.51
34.49.80.229
35.244.174.68
52.210.72.167
68.67.153.60
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
08d80a196fd16e446bb1d5c7e94adf0b719406286686ab3606e0e49a1dc122d9
0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990
1031689dc270b894f27b5975d9a4aec71f6ab261ba828f2d786127e43e87a47c
187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745
19661b2f8ca108e51a5adafd6d4658cc410934e96162dbe5c41e80d1892606d8
1a3e960a873afccc3e53c21b5e87d7f51744156a4d4a90edfd97f5aa48e4102e
1b8a9555c04275858042dc7a54b8b21102a84d69ef9ae5b2b616e379ae094104
1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701
1fcce91080e0c58b41ddc4bb6e9dad66c72e78802dc59622d8b0a42e5458d3af
22251055542a5f8c6353c956f92f010a27836742926ee109d639ea39f31421d8
23b7c02712582224b05809fe9ad972d9054df4970bea73d0011e24195e123317
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
28949ace3235b8211febce28af89ee677531171c3b55897172657102b63592fd
36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4
36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959
3744cdf7226ef40a651e4054a8589854e62cb4da5e5812c9013f23c11700813d
37cc04fa1ef6803fa5273ade871d906254ff9aa8d877771c65fa7bd56f97a92c
3d088e735e1df1e3e110bced2732b0ec4be974ae0a72fadfc8be82f726f7c0a6
400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930
4351d63f954607188842f742d89242828c6ba013aaeb13c731b23cdf2fe38b46
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d6e66e10128ecac66c8556d827b74a4118b9b036efba36081a1205195718c7f
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55e35faaba4dfc8433390ab99542f942b5af6ee60969a9e39d51a1d951985bea
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
609e5b73559de3c6db3470ebdb8b1550f6ef5712eaba35ecef1b4dc0866aca74
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
71d7777595050fcf75727dc90e3fc46012d43d06fee00872b55b6515853bf4f6
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
82124d33814bfce8a525ea7932740ef9394fce2adc10b91dcc2b661f6bbbd364
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b
89007d3e641894d5bf87dd16c9d42f238618ddec9fd650870abae33f3fb577ad
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8c705886eb654e0551d610ed7bf353373a67fea2a00f0ffd1dd015ae0f348bbf
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
93208884e8488ae15aae033e1d9abf065a9acb72dcbcab9f9fa0298530440aed
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a6bfc62c8e653fb944b2a6937d2822241c304fa49bbe90ede334a582385f47e1
a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c
a79451aab4207938ce5c88145118e0b4b59a91b0cb5f1493d4fea53c88b36498
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d1dc4c9dbd72abaa1bf2afed2c7c617b0d56d069d6f099df368fe4aaf15b718f
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
ec24e2c2f9d7b5e5ec9401310f5338c072dc877e0e1482507a14358620486d3a
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f