www.mitiga.io Open in urlscan Pro
52.17.119.105 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Submission: On June 07 via manual (June 7th 2024, 12:51:39 pm UTC) from IN — Scanned from DE

Summary HTTP 64 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 23 IPs in 4 countries across 16 domains to perform 64 HTTP transactions. The main IP is 52.17.119.105, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.mitiga.io.
TLS certificate: Issued by R3 on May 27th 2024. Valid for: 3 months.

This is the only time www.mitiga.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.17.119.105 52.17.119.105	16509 (AMAZON-02) (AMAZON-02)
14	172.64.153.29 172.64.153.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
1	18.239.94.91 18.239.94.91	16509 (AMAZON-02) (AMAZON-02)
6	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:239... 2600:9000:2394:5e00:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	108.156.61.211 108.156.61.211	16509 (AMAZON-02) (AMAZON-02)
5	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	76.76.21.61 76.76.21.61	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
5	2600:9000:20a... 2600:9000:20ab:9400:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:25e... 2600:9000:25e8:de00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	3.126.74.189 3.126.74.189	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:440... 2606:4700:4400::ac40:973c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2600:9000:209... 2600:9000:2090:c200:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
64	23

1 52.17.119.105 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-119-105.eu-west-1.compute.amazonaws.com

www.mitiga.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.64.153.29 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

cdn.prod.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.94.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-94-91.ams1.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.mitiga.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.46 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2394:5e00:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.156.61.211 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-61-211.ams1.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.61 (Walnut, United States)

ASN16509 (AMAZON-02, US)

tools.refokus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:20ab:9400:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:25e8:de00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.74.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-74-189.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:973c (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2090:c200:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	website-files.com cdn.prod.website-files.com — Cisco Umbrella Rank: 10954 assets.website-files.com — Cisco Umbrella Rank: 16428	4 MB
11	gstatic.com fonts.gstatic.com	263 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 351 www.linkedin.com — Cisco Umbrella Rank: 553 px4.ads.linkedin.com — Cisco Umbrella Rank: 6771	4 KB
7	mitiga.io www.mitiga.io go.mitiga.io	96 KB
5	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 260	43 KB
5	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 5011 buttons-config.sharethis.com — Cisco Umbrella Rank: 5759 l.sharethis.com — Cisco Umbrella Rank: 5547 platform-cdn.sharethis.com — Cisco Umbrella Rank: 11277	49 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 29848 ibc-flow.techtarget.com — Cisco Umbrella Rank: 26034	2 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	270 KB
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 524	2 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 461 fonts.googleapis.com — Cisco Umbrella Rank: 70	10 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2406	253 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 880	17 KB
1	refokus.com tools.refokus.com — Cisco Umbrella Rank: 97919	5 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 18880	277 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 16899	278 B
64	16

	Domain	Requested by
14	cdn.prod.website-files.com	www.mitiga.io cdn.prod.website-files.com
11	fonts.gstatic.com	fonts.googleapis.com
6	go.mitiga.io	www.mitiga.io go.mitiga.io
5	px.ads.linkedin.com	3 redirects snap.licdn.com
5	assets.website-files.com	cdn.prod.website-files.com
5	cdnjs.cloudflare.com	www.mitiga.io
3	www.googletagmanager.com	www.mitiga.io www.googletagmanager.com
2	platform-cdn.sharethis.com	www.mitiga.io
2	ibc-flow.techtarget.com	trk.techtarget.com
2	secure.adnxs.com	2 redirects
1	region1.google-analytics.com	www.googletagmanager.com
1	px4.ads.linkedin.com	www.mitiga.io
1	www.linkedin.com	1 redirects
1	trk.techtarget.com	www.mitiga.io
1	snap.licdn.com	www.googletagmanager.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	fonts.googleapis.com	ajax.googleapis.com
1	tools.refokus.com	www.mitiga.io
1	d3e54v103j8qbb.cloudfront.net	www.mitiga.io
1	attr.ml-api.io	www.mitiga.io
1	s.ml-attr.com	1 redirects
1	platform-api.sharethis.com	www.mitiga.io
1	ajax.googleapis.com	www.mitiga.io
1	www.mitiga.io
64	25

This site contains links to these domains. Also see Links.

Domain
go.mitiga.io
www.microsoft.com
github.com
www.linkedin.com

Subject Issuer	Validity	Valid
www.mitiga.io R3	`2024-05-27` - `2024-08-25`	3 months	crt.sh
prod.website-files.com GTS CA 1P5	`2024-04-26` - `2024-07-25`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
*.google-analytics.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
sharethis.com Amazon RSA 2048 M03	`2024-04-19` - `2025-05-17`	a year	crt.sh
go.mitiga.io Cloudflare Inc ECC CA-3	`2023-12-08` - `2024-12-07`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
tools.refokus.com R3	`2024-04-21` - `2024-07-20`	3 months	crt.sh
*.website-files.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-08`	a year	crt.sh
*.gstatic.com WR2	`2024-05-21` - `2024-08-13`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
trk.techtarget.com GTS CA 1P5	`2024-05-24` - `2024-08-22`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-05-06` - `2024-08-04`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Frame ID: 54D5D3BAE4DC965DD4D8FC20D0D96AF0
Requests: 61 HTTP requests in this frame

Frame: https://go.mitiga.io/index.php/form/XDFrame
Frame ID: 72BD5C97E34C842C4F81F3E3FD2C78AA
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Advanced BEC Scam Campaign Targeting Executives on O365

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

64
Requests

95 %
HTTPS

50 %
IPv6

16
Domains

25
Subdomains

23
IPs

4
Countries

4789 kB
Transfer

6677 kB
Size

16
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://go.mitiga.io/Free-Threat-Hunt-for-Snowflake-Customers.html
Title: Find out fast if you are impacted by this active threat campaign. >>

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/
Title: adversary-in-the-middle technique

Search URL Search Domain Scan URL

URL: https://github.com/kgretzky/evilginx2
Title: ZScaler

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mitiga-io/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.mitiga.io%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.mitiga.io%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.mitiga.io%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.mitiga.io&pId=4189995192717254415

Request Chain 48

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D5564689%26time%3D1717764694782%26url%3Dhttps%253A%252F%252Fwww.mitiga.io%252Fblog%252Fadvanced-bec-scam-campaign-targeting-executives-on-o365%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSync=true&e_ipv6=AQIs9ZVoytvjJgAAAY_ywSYAki3rHmd1WkOc5v6ACuqb2UKfn_EsBSesfludbf_h

64 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request advanced-bec-scam-campaign-targeting-executives-on-o365 Show response
www.mitiga.io/blog/ 75 KB
23 KB 198ms
59ms Document
text/html 52.17.119.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.17.119.105 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-119-105.eu-west-1.compute.amazonaws.com

Software

Resource Hash

52e8daf71c4ff059c0c27f6edc1061060b4939c9b0d8717e58d5b7ddf7b97346

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
age: 26633
content-encoding: gzip
content-length: 23122
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Fri, 07 Jun 2024 12:51:34 GMT
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, HIT
x-cache-hits: 1, 0
x-cluster-name: eu-west-1-prod-hosting-red
x-frame-options: SAMEORIGIN
x-lambda-id: 4e8009b7-5c93-481c-9b79-fe8ea249ce6a
x-served-by: cache-iad-kjyo7100091-IAD, cache-dub4366-DUB
x-timer: S1717764694.425347,VS0,VE1

GET
H3 200 mitigav2.7d5feb816.min.css
cdn.prod.website-files.com/64cbff9066188efae900985b/css/ 402 KB
74 KB 53ms
29ms Stylesheet
text/css 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab6ed58a96d321ec2b2ca92b92e26600d137264fddd69445eeac40a245249f40

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-amz-version-id: LtNp9RHhrHf.hljA3K1JSo.FnVC4rTa3
cf-cache-status: HIT
x-amz-request-id: WFANT10R3CCK4R6V
age: 25304
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 75228
x-amz-id-2: anRzTDbYmiU6lsw2JDANYsB+tXYYGgAUxymmXDpBKCyyz7RcTqYmjL/L6brQOldiefFoBOG9pGkwcXf8XnQS+CaxGgkOHHmkVec6DLA/4oI=
last-modified: Thu, 06 Jun 2024 18:15:09 GMT
server: cloudflare
etag: "92699adb65c376b1e439a0f26bed000b"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 8900c63c992a3731-FRA
expires: Sat, 08 Jun 2024 12:21:34 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 13 KB
6 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 06 Jun 2024 19:30:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62484
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Jun 2025 19:30:10 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 238 KB
85 KB 67ms
39ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11210919179

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c9c20004e1c917a87ec044eaafdc046fccac148ace63e2bb7d7740dff510a3f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86972
x-xss-protection: 0
last-modified: Fri, 07 Jun 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Jun 2024 12:51:34 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 206 KB
46 KB 63ms
13ms Script
text/javascript 18.239.94.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.94.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-239-94-91.ams1.r.cloudfront.net

Software

Resource Hash

98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:43:53 GMT
content-encoding: gzip
via: 1.1 975fd5d0332c1e0796bab30e0bb30a24.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS1-P3
age: 461
etag: W/"336d0-g/6wprihOkYe7HpMswOVDodT6lU"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: UVNolDyRyO3Ts-7XAq81HReeWXZNTHc-MdYMk3si8u_wSfa9kZ5TQg==

GET
H3 200 64cbff9066188efae9009fe0_email.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 40 KB
40 KB 46ms
22ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/64cbff9066188efae9009fe0_email.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a3f2acc6e3ab71b13062d254c3cc9b882d5264a73e83ba882ed543f9f8e91bec

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: wVmpV.TvRm86h8_Tihkt4ANpo0jsakRk
cf-cache-status: HIT
x-amz-request-id: RYWS9KV2VP3VHTQZ
age: 91285
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 40580
x-amz-id-2: 0C9P9xPBHCapeRC71WQo700ojmNXESFMPw4p9/TfZVd2p+u5Fo2IPeYsyS866ZjlNNFYKKzn1yI=
last-modified: Thu, 03 Aug 2023 19:27:18 GMT
server: cloudflare
etag: "21689899ba67d9777abf304c38b3c7b1"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63c992d3731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 64cbff9066188efae9009fdc_3.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 68 KB
68 KB 259ms
245ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/64cbff9066188efae9009fdc_3.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 298de32c358fbdcf8cc819f5ce834c2a406514cd1dd7dfeb9baa63cbdd981fe2

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: skm_D1fYuHXa0yrqg95mn6YP6C_1D1__
cf-cache-status: MISS
x-amz-request-id: TR2JJS6H6YHD1P1P
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 69388
x-amz-id-2: clzEerfgxybzh5f0hZG9SXph9aCNXMNFI+OkoXFsxI/fryND6xJamI0vhwPqgS0y/xjTrsyE/MM=
last-modified: Thu, 03 Aug 2023 19:27:18 GMT
server: cloudflare
etag: "844b9d7fd758ee29e14b5cab42f052f7"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63c992f3731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 64cbff9066188efae9009fde_5.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 75 KB
75 KB 53ms
53ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/64cbff9066188efae9009fde_5.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4789a0a9ddbfa051fbce10cc3b763e76f07462439d36435b920a656c9650f452

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: NsgidsLQ.zFfLxITr88b1NyujVG5i8rR
cf-cache-status: HIT
x-amz-request-id: AZJ1W34ESAVJ4N5B
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 76864
x-amz-id-2: q1sYwCm9ijQqhpvnmUju1J1wdoN5Y6VCcjyP7Z1oPhUy8VFx7fBnX62Ni/wFKhAC1E+fzGgAb0Q=
last-modified: Thu, 03 Aug 2023 19:27:18 GMT
server: cloudflare
etag: "c3638fa5b1a1a04cc6b552cffd95254a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63ce9a13731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H2 200 forms2.min.js Show response
go.mitiga.io/js/forms2/js/ 199 KB
67 KB 279ms
65ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.mitiga.io/js/forms2/js/forms2.min.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 23 Apr 2024 04:13:58 GMT
server: cloudflare
age: 5554
etag: "34003a1-31af8-616bbc873ed80"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 8900c63e492f5d74-FRA
expires: Fri, 07 Jun 2024 16:51:34 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.mitiga.io%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.mitiga.io%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.mitiga.io%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.mitiga.io&pId=4189995192717254415

4 B
277 B

265ms
178ms

Image
application/json

2600:9000:2394:5e00:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.mitiga.io&pId=4189995192717254415
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H2
Server: 2600:9000:2394:5e00:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mitiga.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
via: 1.1 e802bba79ff3efb2497084ca4babc248.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P2
x-cache: Miss from cloudfront
content-type: application/json
alt-svc: h3=":443"; ma=86400
content-length: 4
apigw-requestid: Y_1NqiJqIAMEZuA=
x-amz-cf-id: up7yNdeFi7t314XGtx8dw5_2T9cqe2VbgQqDQTs6tJhLekmu4VNi0g==

Redirect headers

pragma: no-cache
date: Fri, 07 Jun 2024 12:51:35 GMT
an-x-request-uuid: 3e67c226-f6c1-4762-919e-56671a52872e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://attr.ml-api.io/?domain=www.mitiga.io&pId=4189995192717254415
x-proxy-origin: 80.255.10.199; 80.255.10.199; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 48ms
16ms Script
application/javascript 108.156.61.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64cbff9066188efae900985b
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.61.211 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-61-211.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 02:40:04 GMT
content-encoding: br
via: 1.1 8662e3c152f0b241b5d273e9b0c8f9fc.cloudfront.net (CloudFront)
age: 36690
x-amz-cf-pop: AMS1-P2
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: Bsru31xlL9TiuY_Wci6oOSkzHy0KedbVKzwbx_horehIWDHP2-7EmA==

GET
H3 200 mitigav2.f0cd8f346.js Show response
cdn.prod.website-files.com/64cbff9066188efae900985b/js/ 259 KB
82 KB 23ms
22ms Script
text/javascript 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/js/mitigav2.f0cd8f346.js
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ccfa02743623e532ad0ac54e0e8b863d0b34ad8d004da1c3384f37ac8875929

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-amz-version-id: MaPU6nArZ3EHRRB2RGbGBeylY9wz48Q8
cf-cache-status: HIT
x-amz-request-id: 4EDABN98NJW2HF4F
age: 66872
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 83681
x-amz-id-2: F8GRKpkCoXkw5fo8Ok5bayFuAVbh6xwTbuRId1y8qQ8/vjxiziMSA06unB0gIKu8vFONgzSMZFc=
last-modified: Thu, 30 May 2024 20:07:55 GMT
server: cloudflare
etag: "a4b0f17358e4064988bcfcfed029494d"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=84600
accept-ranges: bytes
cf-ray: 8900c63cf9bb3731-FRA
expires: Sat, 08 Jun 2024 12:21:34 GMT

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/ 85 KB
27 KB 46ms
33ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 229370
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27437
last-modified: Sun, 07 Jan 2024 20:26:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "659afac8-6b2d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4aMdIFy4ERM1n%2FF8QeRLA8vpi%2BANAHU%2BHyb%2BfXjQ5PjqVBnecjpIvi7MF8tleFP7UmZqCCiNYuTphIRRKU0VTnCwy61Sn0CLgRyNl8pmyvTVIY1bI5HihEH7knNUVs8DPun2OWL8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8900c63d0f2b18ff-FRA
expires: Wed, 28 May 2025 12:51:34 GMT

GET
H3 200 js.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-cookie/2.2.0/ 2 KB
1 KB 33ms
20ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-cookie/2.2.0/js.cookie.min.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4db76afeb499d277603609152f9e382c0fe112d44c6f8db8c136a89d9bd7682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 751134
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 746
last-modified: Mon, 04 May 2020 16:11:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec5-699"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mhj9GscBa2qNivfMUYnySws49CKaD3XlZfbhQvOIcrmRq2noPB4NFCdZ1NCGpPmay1zYWIKg0vsLG0SG4cNhYRXaTlnvEtxhd61LsgbPmwM17x3rqjYN%2Fd%2BL2D5seC4rCFwRiDJl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8900c63d0f2118ff-FRA
expires: Wed, 28 May 2025 12:51:34 GMT

GET
H3 200 slick.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/ 2 KB
1 KB 56ms
44ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/slick.css

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

893485d48fc8651981b4810fee0d92ebd7fd85baa7f362ad3934a2c652be8dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 227324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 438
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-6e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iE582iJ9E1vNwIexUmzQos6modHHWWfXwXHLvfKaRQKXn4SNPPRcr4fN0XG%2BEXFTg4tuRabgQ2C3VEP7XQDjdY9s%2BsT4IylQa1erC1blgTPCKXfZB2Yyz53VxVYUYZ8OD7Ea%2FE9v"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8900c63d0f2d18ff-FRA
expires: Wed, 28 May 2025 12:51:34 GMT

GET
H3 200 slick-theme.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/ 3 KB
1 KB 48ms
36ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/slick-theme.css

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

822f53109d9d750a8c0c8c189ddb0175b5e0226b66cbaa6a699e78e0f512e2dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 61378
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 718
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-c53"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fxAxTWuwHAoujPCN6vfg2B2T%2Fx4%2F%2BlRuL2pSQpGtc2X3lMe2jG2SzOy29%2Bl%2B%2FjOA400%2BZ9dr%2BEhZ034a8fLM5nHDRpKtyccw9fbhAys%2FQ25%2FXegA%2B58GbJUZnJR8Yt1fr%2Fd784sM"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8900c63d0f2718ff-FRA
expires: Wed, 28 May 2025 12:51:34 GMT

GET
H3 200 slick.js Show response
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/ 78 KB
12 KB 39ms
27ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/slick.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bc26a08c689de93c486947d1e9756da23919268f52a4a604ef7f1e8df7c06e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 229014
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11349
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-13956"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zcVAiWz3Dg3LVFFlqZWLFa1EYoWUvSMQjJwKxVQv6WC%2FyJ5W8MaHLdlcVLwEGwcHKTvc1FfdssQgj1EwmtW45pfQiyDNJliKmqs%2FFvoK%2Fz%2FhfeKoWjzp9BCrUG7WdNTSqTM0HwPm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8900c63d0f3218ff-FRA
expires: Wed, 28 May 2025 12:51:34 GMT

GET
H2 200 bundle.v1.0.1.js Show response
tools.refokus.com/pagination-enhancer/ 16 KB
5 KB 70ms
15ms Script
application/javascript 76.76.21.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tools.refokus.com/pagination-enhancer/bundle.v1.0.1.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.61 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

1056f2b478d14d099dff9ef3dadde6009343f10b126566dd353621f74254cb42

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::f8j7x-1717764694609-6b7da8d9d194
age: 4574215
etag: W/"76cbf5b50712760d82e66c6cebdbad20"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="bundle.v1.0.1.js"

GET
H2 200 css
fonts.googleapis.com/ 101 KB
4 KB 52ms
21ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic%7COpen+Sans:300,300italic,400,400italic,600,600italic,700,700italic,800,800italic%7CSource+Sans+Pro:200,300,regular,italic,600,700,900

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4b8b08dfe88bdad825eb249109cc44447aaf76eb4bfd8243b67445ea658105f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 07 Jun 2024 12:51:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 07 Jun 2024 12:51:34 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 258 KB
90 KB 49ms
38ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TFP6DDP

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fbbc20ab2784a0349626bd51b6564b8cfad192972160fb852d38558e2ef30ff0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92122
x-xss-protection: 0
last-modified: Fri, 07 Jun 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 Jun 2024 12:51:34 GMT

GET
H3 200 6514940898210d93a409da02_Remove_button_black.svg
cdn.prod.website-files.com/64cbff9066188efae900985b/ 870 B
738 B 32ms
32ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/6514940898210d93a409da02_Remove_button_black.svg
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da8a8d0e6fdcbee7ee89c023e16232f374e8281960f79be04904266056b7be00

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: M.dSg6dxqAX4r4XevsCjTAlrPrMT9mKO
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 9DG0HW2W8QBD8DMN
age: 663861
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: xDem7lWp6o0OqABlACmVGKLMiBLPxhiWhajoem6vkHS5tkBdLpZ11GcOce9EE290Ou8P12ZQp6c=
last-modified: Wed, 27 Sep 2023 20:43:54 GMT
server: cloudflare
etag: W/"2a27c4b4519140b7db6e0730a5c00508"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8900c63cf9be3731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 64dc306bafbf93965f3d199c_case-study-banner.png
cdn.prod.website-files.com/64cbff9066188efae900985b/ 373 KB
374 KB 33ms
33ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/64dc306bafbf93965f3d199c_case-study-banner.png
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f2174ae4e5279fa76c3d3ae62350a5e262f7790241b615ed91de552e139c948

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: XmVsesz5eGY9RaPGRsifCVyji4ZHs4mj
cf-cache-status: HIT
x-amz-request-id: WZPKVA2H0S5DMK90
age: 668457
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 382230
x-amz-id-2: qeqmb6T10UJCYixPHfevZxjFNnVJovLUfI1pkymIfdxVj+0FqkK9kc6zYAVtSfioDz1mguQ4e3g=
last-modified: Wed, 16 Aug 2023 02:11:57 GMT
server: cloudflare
etag: "1de12beced6ecebd231594366552b731"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63cf9bf3731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 64dc31496de15cf2d005400b_case-study-graphics2.png
cdn.prod.website-files.com/64cbff9066188efae900985b/ 195 KB
196 KB 34ms
33ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/64dc31496de15cf2d005400b_case-study-graphics2.png
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa8b02c9650f9a85601637f53dc9b0a9d68773f360ba086ac86990f3f93a5c10

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: kW4cXcyN_REwhHESvTok.1UbaIx9FhOS
cf-cache-status: HIT
x-amz-request-id: WZPXJX58T2H4N0G0
age: 668457
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 199778
x-amz-id-2: U4ODJdvLWFM733PQ79kANYDNEwowrnZgPuV9f4KMcF5bgrsUDvbTShUnXgQaXZNmpTp424tYjuM=
last-modified: Wed, 16 Aug 2023 02:15:39 GMT
server: cloudflare
etag: "498c64c7a915e6390ef7676438015a78"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63cf9c03731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 6658d3622c79ff3424d4f7e6_tactical-guide-to-threat-hunting-in-snowflake-environments-final.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 2 MB
2 MB 34ms
34ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/6658d3622c79ff3424d4f7e6_tactical-guide-to-threat-hunting-in-snowflake-environments-final.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50ede0e2f1478b1fadfecec04bde0baeb16c1d061bc3c5606133c1b4c05a8d66

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: ve1d4UOzwTITgHVREqHLiOei2LWcF19M
cf-cache-status: HIT
x-amz-request-id: 5GSBPP1V3KCJRN6H
age: 664743
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 2410042
x-amz-id-2: AJaT7DSStWaQXeCpeu3uikttIXbkb6x9/aENh5cP0xd4CGrD0oqF2xm9c6Ax9/9seEs7O/lNPlI=
last-modified: Thu, 30 May 2024 19:28:37 GMT
server: cloudflare
etag: "8e2862d55c2fbee447b60f01407819dd"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63cf9c43731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 662a367df1aff9b80a7cafb3_66211df6eb164d7e1cec8d6e_EasyMisconfiguration_small.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 92 KB
92 KB 268ms
267ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/662a367df1aff9b80a7cafb3_66211df6eb164d7e1cec8d6e_EasyMisconfiguration_small.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f08b4b4eecf5cff1b131a066d0e4e294e534322f59894b67ba3b25e0adb7329

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: xNlFM7IZox1Vm3gq6_EEB4iaFUP4ka6s
cf-cache-status: HIT
x-amz-request-id: WZPRJ89HZAB1XGCK
age: 663861
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 94283
x-amz-id-2: k41G7+35iJhu3HX34CD395zmpPoFZMMVoGcRTvlEDGWMh5AE/8+a9uKEFoeBmAy5h3JbDxZXZzE=
last-modified: Thu, 25 Apr 2024 10:54:54 GMT
server: cloudflare
etag: "4772c4bc3f00c0d78dd94b56e3694b82"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63cf9c73731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H3 200 662047c3b3c08ac7bb27dc7c_64cbff9066188efae900a0b2_644216b5c3ccfade0ab56775_62d0342285a6cb11557fe5bc_PeacetimeValue_header.png
cdn.prod.website-files.com/64cbff9066188efae9009864/ 392 KB
392 KB 289ms
289ms Image
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae9009864/662047c3b3c08ac7bb27dc7c_64cbff9066188efae900a0b2_644216b5c3ccfade0ab56775_62d0342285a6cb11557fe5bc_PeacetimeValue_header.png
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec3730cc77a62eca887107ca642d7d4c7db4e10290c62ca1005ac54b1e660d5b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: IkW3YI9U62o42J_lQ5QqlrYXSX2lAjMU
cf-cache-status: HIT
x-amz-request-id: WZPXRMPGAEG218KY
age: 668457
x-amz-server-side-encryption: AES256
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 401293
x-amz-id-2: 5CCVs6wmrLC0ygtOW26oSq4Y5p5J8jESoIC8hJW33d38iGtywCWiEvDFwXjs7xcndeonGWSLDmE=
last-modified: Wed, 17 Apr 2024 22:05:57 GMT
server: cloudflare
etag: "fa9deae135fd4f6e4808d0bf539b8a6f"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c63cf9c83731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H2 200 64d4345a4a08bc4e784ec1bc_PPNeueMontreal-Bold.woff2
assets.website-files.com/64cbff9066188efae900985b/ 52 KB
52 KB 174ms
94ms Font
application/octet-stream 2600:9000:20ab:9400:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64cbff9066188efae900985b/64d4345a4a08bc4e784ec1bc_PPNeueMontreal-Bold.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ab:9400:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 615acce4a85b96f9ed05a75e619f9208c5a543387984f9ca6520bc0766f2c548

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 20:57:56 GMT
x-amz-version-id: YnfxmJF2vc1vdiG18bDM.wGq3e1lCoki
via: 1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
age: 662019
x-amz-cf-pop: AMS58-P3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 52856
last-modified: Thu, 10 Aug 2023 00:50:35 GMT
server: AmazonS3
etag: "590849719cf7022bbe8ed81112179465"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: M0fHJVPgXloZB69AaJg2_iaxwsmTRIHi1zE-fAMo_unU0ekTjbQ0uw==

GET
H2 200 64d5e8e252d64bfdbd8be9cc_PPNeueMontreal-Medium.woff2
assets.website-files.com/64cbff9066188efae900985b/ 51 KB
51 KB 160ms
81ms Font
application/octet-stream 2600:9000:20ab:9400:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64cbff9066188efae900985b/64d5e8e252d64bfdbd8be9cc_PPNeueMontreal-Medium.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ab:9400:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 11a1b227a4f432bdc5587a529d34a46abbed7067b6e1fb913db0c489c7175828

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 20:57:56 GMT
x-amz-version-id: GvIveKC4q4Kd0Jml5rjoTaMuczaKQC7u
via: 1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
age: 662019
x-amz-cf-pop: AMS58-P3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 51980
last-modified: Fri, 11 Aug 2023 07:53:08 GMT
server: AmazonS3
etag: "b36caee87073c28b3f64d07e13d86b2a"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: qJvdLvecR8eWtxYOPl-1GiFYyfFcP2YsClSEoH0HHfSaDVxOWmRrJQ==

GET
H2 200 64d5e92043d1cdd34f8d1b02_PPNeueMontreal-Book.woff2
assets.website-files.com/64cbff9066188efae900985b/ 49 KB
49 KB 132ms
52ms Font
application/octet-stream 2600:9000:20ab:9400:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64cbff9066188efae900985b/64d5e92043d1cdd34f8d1b02_PPNeueMontreal-Book.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ab:9400:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 10fefbe97500ccada8e9c76cd94d1a8c068e8d30e6d558bef36e6d3ed9671b6d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 20:57:56 GMT
x-amz-version-id: YsVnz78k49y6jk1AF0riIiufGrnISAgi
via: 1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
age: 662019
x-amz-cf-pop: AMS58-P3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 49784
last-modified: Thu, 24 Aug 2023 16:57:40 GMT
server: AmazonS3
etag: "dcf5de2fa72fccb80055391b486b97f3"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: buWIC7CH8N9JIceLp_8wKcc3EZSsILAlKN9sKTCsoC15JRnET9U-jQ==

GET
H2 200 64d434fe0eec1ae8e95a6de0_PPRightGrotesk-WideBlack.woff2
assets.website-files.com/64cbff9066188efae900985b/ 46 KB
47 KB 122ms
43ms Font
application/octet-stream 2600:9000:20ab:9400:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64cbff9066188efae900985b/64d434fe0eec1ae8e95a6de0_PPRightGrotesk-WideBlack.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ab:9400:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1bfc227ba109b698a549875de4c139027b517fe331c7a000746eff75a39bbb4c

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 30 May 2024 20:57:56 GMT
x-amz-version-id: Ln9CcPlFGpc5ROprcE62vYaMt_2CFCdg
via: 1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
age: 662019
x-amz-cf-pop: AMS58-P3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 47468
last-modified: Thu, 10 Aug 2023 00:53:20 GMT
server: AmazonS3
etag: "7f6d58699fe055f5e842961f11c75051"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: pNH1WnuxcHAxevw460mXHCwulPOU_AFOlD8JS26_OJORttiDPQ5tsg==

GET
H2 200 64e78c202c9e28a08dd318d2_PPNeueMontreal-BookItalic.woff2
assets.website-files.com/64cbff9066188efae900985b/ 50 KB
51 KB 204ms
126ms Font
application/octet-stream 2600:9000:20ab:9400:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64cbff9066188efae900985b/64e78c202c9e28a08dd318d2_PPNeueMontreal-BookItalic.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/css/mitigav2.7d5feb816.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ab:9400:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8c64ff48c675b06fa0fe0f561ede39aec9c2b26b6a1bc9f63385504f0c2b0ef5

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cdn.prod.website-files.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 03 Jun 2024 20:08:58 GMT
x-amz-version-id: 4QcPK4aTwcHYUtohGDSLL0tofnMxISzq
via: 1.1 64e65d847e47fbcbf4dc70bc1c185676.cloudfront.net (CloudFront)
age: 319357
x-amz-cf-pop: AMS58-P3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 51320
last-modified: Thu, 24 Aug 2023 16:58:10 GMT
server: AmazonS3
etag: "3d4afa107b4801b854b2896be610ab6c"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: EwoFcWAlrAOCPUtMD7JWUigiyJovAIg0GniujfItFllQSis0B3bJiw==

GET
H3 200 64d1f4b61f48b9132aaf971f_Mitiga%20Logo.svg
cdn.prod.website-files.com/64cbff9066188efae900985b/ 2 KB
1 KB 312ms
312ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/64d1f4b61f48b9132aaf971f_Mitiga%20Logo.svg
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f82b0bf306b84a4d28140677db2f0be5c2e994139ba755e583b224680ebc22c

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-amz-version-id: ZsYhiSkeMpPxJk8YFnunRsnH0yEgc7jd
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 9DG2NXH2HZGQ74AD
age: 668457
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: SzNE+4C+Dj3E9XvGVr59hUc5RxeUttXFLhxXuhz/KNRPxjK+de/gFaThZlwFKpRo1rjJNjh6cZk=
last-modified: Tue, 08 Aug 2023 07:54:32 GMT
server: cloudflare
etag: W/"c9a99c0bd464df92e0560068eb7bbbde"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8900c63d19f43731-FRA
expires: Sat, 07 Jun 2025 12:51:34 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
32 KB 113ms
73ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic%7COpen+Sans:300,300italic,400,400italic,600,600italic,700,700italic,800,800italic%7CSource+Sans+Pro:200,300,regular,italic,600,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 01:36:19 GMT
x-content-type-options: nosniff
age: 40515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 01:36:19 GMT

GET
H2 200 JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v26/ 33 KB
34 KB 77ms
40ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92443d06835a28423649bca60e6d755e4a1bd09638443196d58e0dd1f06c827f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 01:32:33 GMT
x-content-type-options: nosniff
age: 40741
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34288
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:52:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 01:32:33 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 79ms
44ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 03:59:33 GMT
x-content-type-options: nosniff
age: 31921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 03:59:33 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
50 KB 53ms
19ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 06:26:15 GMT
x-content-type-options: nosniff
age: 23119
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50296
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 06:26:15 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 97ms
62ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdu.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec190e2f6ca2b272958e593e24827f3e51d2352733b509cbe1e30868b875bb7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 11:23:14 GMT
x-content-type-options: nosniff
age: 5300
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14428
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 11:23:14 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
15 KB 95ms
61ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 09:45:42 GMT
x-content-type-options: nosniff
age: 11152
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14780
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 09:45:42 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 15 KB
15 KB 106ms
72ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 11:37:43 GMT
x-content-type-options: nosniff
age: 4431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 11:37:43 GMT

GET
H2 200 6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 93ms
60ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

500f8aaf69ddcf71a16ceae58c927f03371b33665185e16df347b67f7f11bdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 05 Jun 2024 00:46:39 GMT
x-content-type-options: nosniff
age: 216295
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14160
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Jun 2025 00:46:39 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
15 KB 90ms
56ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 04 Jun 2024 14:10:16 GMT
x-content-type-options: nosniff
age: 254478
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Jun 2025 14:10:16 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 109ms
76ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 04 Jun 2024 14:14:21 GMT
x-content-type-options: nosniff
age: 254233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14712
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Jun 2025 14:14:21 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 110ms
77ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aee584e3d58344a41b190bb7b6e550f98ad3bb8e28fbc7ea6ddca22f0ef97183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://www.mitiga.io
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 09:31:21 GMT
x-content-type-options: nosniff
age: 12013
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14188
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:53:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Jun 2025 09:31:21 GMT

GET
H2 200 5900be23b6ee520012cda1f9.js Show response
buttons-config.sharethis.com/js/ 531 B
975 B 582ms
499ms Script
text/javascript 2600:9000:25e8:de00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5900be23b6ee520012cda1f9.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25e8:de00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

0ee5751877f93e6fb939ff14692e482427a1d301eae0243a5a5d4c408de859d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:36 GMT
via: 1.1 7cbec639ed3557aac04425ec5a5f177a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 16 Aug 2023 06:43:44 GMT
server: AmazonS3
x-amz-cf-pop: AMS1-P3
x-amz-server-side-encryption: AES256
etag: "b02fb3ac6a701527345b90cfe1ca6599"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 531
x-amz-cf-id: 36sGC2uWL-k5yrc_JJqSJSO6iVPGazHMfBxvFGJYp1fnSTLk4MHM5A==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
400 B 129ms
56ms XHR
text/plain 3.126.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=www.mitiga.io&location=%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&product=inline-share-buttons&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Advanced%20BEC%20Scam%20Campaign%20Targeting%20Executives%20on%20O365&cms=unknown&publisher=5900be23b6ee520012cda1f9&sop=true&version=st_sop.js&lang=en&description=Mitiga%20spotted%20a%20sophisticated%2C%20advanced%20business%20email%20compromise%20(BEC)%20campaign%2C%20directly%20targeting%20relevant%20executives%20of%20organizations%20(mostly%20CEOs%20and%20CFOs)%20using%20Office%20365.&ua=%22Google%20Chrome%22%3Bv%3D%22125%22%2C%20%22Not%3AA-Brand%22%3Bv%3D%228%22%2C%20%22Chromium%22%3Bv%3D%22125%22&ua_mobile=false&ua_platform=Win32&ua_full_version_list=%22Google%20Chrome%22%3Bv%3D%22125.0.6422.141%22%2C%20%22Chromium%22%3Bv%3D%22125.0.6422.141%22%2C%20%22Not.A%2FBrand%22%3Bv%3D%2224.0.0.0%22&ua_platform_version=10.0.0&uuid=b7d45688-5d99-4389-bd42-5728a22f757d

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.126.74.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-74-189.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 07 Jun 2024 12:51:34 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://www.mitiga.io
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
95 KB 47ms
45ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-YPRQFQ1Z06&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TFP6DDP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

deb7e20677b44b52322fa201c1e9255dc78e393a42ea7fcb5a245fa580af38de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96663
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 07 Jun 2024 12:51:34 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 47 KB
17 KB 81ms
29ms Script
application/javascript 2a02:26f0:480:f::213:7edd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TFP6DDP

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 06 May 2024 17:20:18 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=42103
accept-ranges: bytes
content-length: 16683

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 115ms
71ms Script
text/javascript 2606:4700:4400::ac40:973c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 75691
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 8900c63e38b135ec-FRA
expires: Fri, 07 Jun 2024 13:11:34 GMT

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
815 B 844ms
812ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: *
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: E75583B1C3C6493EB131B2E9E556E9A6 Ref B: DUS30EDGE0311 Ref C: 2024-06-07T12:51:34Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lor1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYaTEJ70Rg4z3PTUDJQ5Q==
x-fs-uuid: 00061a4c427bd11838cf73d3503250e5

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D5564689%26time%3D1717764694782%26url%3Dhttps%253A%252F%252Fwww.mitiga.io%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSyn...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSy...

0
267 B

234ms
194ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSync=true&e_ipv6=AQIs9ZVoytvjJgAAAY_ywSYAki3rHmd1WkOc5v6ACuqb2UKfn_EsBSesfludbf_h
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mitiga.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: EE0FC6D7CDAE41CC96510B65EB9F44AD Ref B: DUS30EDGE0920 Ref C: 2024-06-07T12:51:35Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYaTEJ/62xVoEzLxV5XzQ==

Redirect headers

date: Fri, 07 Jun 2024 12:51:34 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 59A23BA4597840EB8E2F958BFFD1510A Ref B: FRAEDGE1312 Ref C: 2024-06-07T12:51:35Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5564689&time=1717764694782&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&cookiesTest=true&liSync=true&e_ipv6=AQIs9ZVoytvjJgAAAY_ywSYAki3rHmd1WkOc5v6ACuqb2UKfn_EsBSesfludbf_h
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYaTEJ7gaO0rP7aY5aD/A==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
253 B 75ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-YPRQFQ1Z06&gtm=45je4650v9117298777z89122700189za200zb9122700189&_p=1717764694547&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&cid=511563292.1717764695&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.141%7CChromium%3B125.0.6422.141%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1717764694&sct=1&seg=0&dl=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&dt=Advanced%20BEC%20Scam%20Campaign%20Targeting%20Executives%20on%20O365&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=560
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-YPRQFQ1Z06&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 07 Jun 2024 12:51:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mitiga.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
451 B 122ms
121ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=22369847&r=1717764694897&ref=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 22369847
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPppMuSg2M74X8RGHCRP6C7r97LdD0PeUBzGgDAL6BrM0ovFuhgVqNgOqFYEWlgE2cVRN6A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Fri, 07 Jun 2024 13:51:35 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 143ms
106ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=22369847&r=1717764694897&ref=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.mitiga.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 07 Jun 2024 12:51:34 GMT
expires: Fri, 07 Jun 2024 12:51:34 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPqIcAiqC52_mH0qr9XOoVR7Z9SInP04nyNLSMP_OHnUnzDCcO67q5MVUKP4TLANR9XAxYQ

GET
H2 200 getForm Show response
go.mitiga.io/index.php/form/ 7 KB
2 KB 123ms
123ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.mitiga.io/index.php/form/getForm?munchkinId=422-DJP-161&form=1292&url=https%3A%2F%2Fwww.mitiga.io%2Fblog%2Fadvanced-bec-scam-campaign-targeting-executives-on-o365&callback=jQuery3710859295864331634_1717764694892&_=1717764694893
Requested by: Host: go.mitiga.io
URL: https://go.mitiga.io/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf9af5a8672decce7891262d492ce3a26a3cb2e2c70d8127fcec5997fcb6553f

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 8900c63f2b235d74-FRA
cached: true
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8

GET
H2 200 forms2.css
go.mitiga.io/js/forms2/css/ 13 KB
3 KB 60ms
59ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.mitiga.io/js/forms2/css/forms2.css

Requested by

Host: go.mitiga.io
URL: https://go.mitiga.io/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 23 Apr 2024 04:13:58 GMT
server: cloudflare
age: 5553
etag: "340035e-3437-616bbc873ed80"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8900c63ffc5f5d74-FRA
content-length: 2623
expires: Fri, 07 Jun 2024 16:51:35 GMT

GET
H2 200 forms2-theme-plain.css
go.mitiga.io/js/forms2/css/ 828 B
332 B 99ms
98ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.mitiga.io/js/forms2/css/forms2-theme-plain.css

Requested by

Host: go.mitiga.io
URL: https://go.mitiga.io/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 23 Apr 2024 04:13:58 GMT
server: cloudflare
age: 5554
etag: "340035c-33c-616bbc873ed80"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8900c63ffc6b5d74-FRA
content-length: 246
expires: Fri, 07 Jun 2024 16:51:35 GMT

GET
H2 200 XDFrame Show response
go.mitiga.io/index.php/form/ Frame 72BD 2 KB
863 B 194ms
194ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.mitiga.io/index.php/form/XDFrame

Requested by

Host: go.mitiga.io
URL: https://go.mitiga.io/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb987d2d66449ff6832c48297a73b679270e359a83aadd5d2ae5c96353a9d43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.mitiga.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8900c640ddb05d74-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 07 Jun 2024 12:51:35 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
BLOB 200
OK d73a4e98-24ec-4c4c-90ec-5b1cb70bd19d
https://www.mitiga.io/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.mitiga.io/d73a4e98-24ec-4c4c-90ec-5b1cb70bd19d
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H3 200 64dc58c710991839faba648a_share-arrow.svg
cdn.prod.website-files.com/64cbff9066188efae900985b/ 1 KB
990 B 31ms
30ms Image
image/svg+xml 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/64dc58c710991839faba648a_share-arrow.svg
Requested by: Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2a8463aab9bdf4c013a5342d299c86657ef893c268d3eb701b6b1934fd22a0c

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
x-amz-version-id: sqIpd0tCku2mlM6dfnWBOuhCy18ce6Tx
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: WJ6YED232W0077TS
age: 66676
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: leFfTVeCHifAKKnK/rJ7ytR20CIc9KvY0UZd4yzWRPPrpMAl0qA2nw6uzCWRlv+B/+uBujAz5TE=
last-modified: Wed, 16 Aug 2023 05:04:09 GMT
server: cloudflare
etag: W/"1e7be317b95bd47be4a9b4bd91129684"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8900c64158a23731-FRA
expires: Sat, 07 Jun 2025 12:51:35 GMT

GET
H2 200 linkedin.svg
platform-cdn.sharethis.com/img/ 456 B
902 B 66ms
14ms Image
image/svg+xml 2600:9000:2090:c200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/linkedin.svg

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2090:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 19 May 2024 04:16:53 GMT
via: 1.1 d86b0ef5c17f755a14a26fbae67aba4e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS58-P1
age: 1672483
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 456
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
etag: "fa43b4ede18498b114fc7185993f6da7"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
x-amz-cf-id: kyQlKeZK8DCLq5uuPjwl2EOfQ8TXgguywGexrQrGRe4esuzN3tLHVg==

GET
H2 200 sharethis.svg
platform-cdn.sharethis.com/img/ 514 B
937 B 68ms
16ms Image
image/svg+xml 2600:9000:2090:c200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/sharethis.svg

Requested by

Host: www.mitiga.io
URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2090:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 25 May 2024 10:01:19 GMT
via: 1.1 d86b0ef5c17f755a14a26fbae67aba4e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P1
age: 1133416
etag: "deecdaa377907db5cc1722fc831670a1"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 514
x-amz-cf-id: 8-Vp1q2No8w6qh6Wd0epv_ZpeHNxE57jc66ffavOZZsHOefxjiuJjQ==

GET
H2 200 forms2.min.js Show response
go.mitiga.io/js/forms2/js/ Frame 72BD 199 KB
0 0ms
0ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.mitiga.io/js/forms2/js/forms2.min.js

Requested by

Host: go.mitiga.io
URL: https://go.mitiga.io/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://go.mitiga.io/index.php/form/XDFrame
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 23 Apr 2024 04:13:58 GMT
server: cloudflare
age: 5554
etag: "34003a1-31af8-616bbc873ed80"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 8900c63e492f5d74-FRA
expires: Fri, 07 Jun 2024 16:51:34 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
194 B 190ms
190ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.mitiga.io/
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 1F3AC94155B1435C9F4B5D0E7167201E Ref B: FRAEDGE1312 Ref C: 2024-06-07T12:51:35Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://www.mitiga.io
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYaTEKC5ytz7Ck8CzX+gg==

GET
H3 200 64cbff9066188efae9009b38_Mitiga_Fav_32x32.png
cdn.prod.website-files.com/64cbff9066188efae900985b/ 1 KB
1 KB 22ms
21ms Other
image/png 172.64.153.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64cbff9066188efae900985b/64cbff9066188efae9009b38_Mitiga_Fav_32x32.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.153.29 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f2289beea9ab7fbbff5d6cb30b3b8f2ef3ea6169563456de7550e7ad685ddb9

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.mitiga.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 07 Jun 2024 12:51:35 GMT
x-amz-version-id: RFp4eoUE9XDYpykxCUx3Fk9vi_wxEPeR
cf-cache-status: HIT
x-amz-request-id: PVQ4A8AMP3B5KPSG
age: 663774
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 1076
x-amz-id-2: +d7FUMHyT2WEgwXdq/U+t4BZY3Btb/Fk+lz5VkRIzYuc59kTKrab/qc4JuY8R/gsh+OLQbJdOoo=
last-modified: Thu, 03 Aug 2023 19:27:16 GMT
server: cloudflare
etag: "d214beae3b2e100f7899018d72cee451"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8900c6455ee83731-FRA
expires: Sat, 07 Jun 2025 12:51:35 GMT

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mitiga.io/	1970-01-20 23:19:00	Name: _gcl_au Value: 1.1.1035809633.1717764695
.techtarget.com/	1970-01-20 21:09:26	Name: __cf_bm Value: DM7BPJB6JHNqLK_rd2lZb2jzgAJFOjF4v0Zw7Ch3usA-1717764694-1.0.1.1-jeaSkctb.qevawiqd2rqYE1JaJTMslWvi1EhlC3XMl8ZcetQG4BwsUw4L8Ze.w7QLoDl8RrZ_qCUDmCpuFrZ3w
.mitiga.io/	1970-01-21 06:45:24	Name: _ga_YPRQFQ1Z06 Value: GS1.1.1717764694.1.0.1717764694.0.0.0
.mitiga.io/	1970-01-21 06:45:24	Name: _ga Value: GA1.1.511563292.1717764695
.go.mitiga.io/	1970-01-20 21:09:26	Name: __cf_bm Value: 9t.SW6Yv1e_nN5GrDBQa_iZA_viTwL.GV5Pxm77plJk-1717764694-1.0.1.1-WQ9TovAxUygrD1TFqiCl22DMxB6CnbM2h4i734uNE1DodI5JJsdRN31CdTG7TGO2o1rX11z4.m8Ro_MyqhIyPw
.linkedin.com/	1970-01-20 23:19:00	Name: li_sugr Value: 399621bb-6ade-4b49-ac6f-90ba0e83155d
.linkedin.com/	1970-01-21 05:55:00	Name: bcookie Value: "v=2&c3a175fd-2aed-4941-8d64-fce4c0d88663"
.linkedin.com/	1970-01-20 21:10:51	Name: lidc Value: "b=OGST01:s=O:r=O:a=O:p=O:g=3304:u=1:x=1:i=1717764694:t=1717851094:v=2:sig=AQFVq0HcZdLQRQ_2E4u45-KhVlI8Kkr8"
.adnxs.com/	1970-01-20 23:19:00	Name: XANDR_PANID Value: VwtoSAN2w_gcgE5KPHqE9pb531oy3USuSJqoNQ5VdL_WnmJJBR2dZDaWMvZ0eHbPhQr2ZuC9a4p-sPoWcBSMLd7DXnHlcMtzkQJFAk4ToK0.
.adnxs.com/	1970-01-21 06:45:24	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 23:19:00	Name: uuid2 Value: 4189995192717254415
.linkedin.com/	1970-01-20 21:52:36	Name: UserMatchHistory Value: AQK8aEsX2FNiOgAAAY_ywSQ-WV8pN5FYEi4gBqEip9VRvH_5BNkSeytQ5b4uUL-AJJJSnQ1AL-rwIQ
.linkedin.com/	1970-01-20 21:52:36	Name: AnalyticsSyncHistory Value: AQKBS_R8QNPcYQAAAY_ywSQ-gzaddFVr0kYB9CenWiVcL18vjvG-DOTlbSqLz2KKktbUugjMXiqEsSFQ04dkwQ
go.mitiga.io/	1969-12-31 23:59:59	Name: BIGipServersj39web-nginx-app_https Value: !7PDj2tABqdbYyQQRgS7A5F9dNDOAZDIwZx/6H21ksUJQE/ftMdWifqFqIbPWpddEZ+ufaDRA+TMJ4ao=
.www.linkedin.com/	1970-01-21 05:55:00	Name: bscookie Value: "v=1&202406071251356bcd514c-6b61-4542-8d4d-acc55059d1c8AQF8Zxj0ZaOkhE5Yo-RM92vMPzKDPBzx"
.linkedin.com/	1970-01-21 01:28:36	Name: li_gc Value: MTswOzE3MTc3NjQ2OTU7MjswMjErbCJdQQptYDeIICqfgWGG2khB9CuoXZRx2eY5DsTQpA==

39 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mitiga.io/blog/advanced-bec-scam-campaign-targeting-executives-on-o365 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
assets.website-files.com
attr.ml-api.io
buttons-config.sharethis.com
cdn.prod.website-files.com
cdnjs.cloudflare.com
d3e54v103j8qbb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
go.mitiga.io
ibc-flow.techtarget.com
l.sharethis.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.ml-attr.com
secure.adnxs.com
snap.licdn.com
tools.refokus.com
trk.techtarget.com
www.googletagmanager.com
www.linkedin.com
www.mitiga.io
104.17.24.14
104.17.70.206
108.156.61.211
13.107.42.14
172.64.153.29
18.239.94.91
185.89.210.46
2001:4860:4802:34::36
2600:9000:2090:c200:1d:85c3:6640:93a1
2600:9000:20ab:9400:11:3b84:d200:93a1
2600:9000:2394:5e00:5:7a81:86c0:93a1
2600:9000:25e8:de00:c:abe:f440:93a1
2606:4700:4400::ac40:973c
2620:1ec:21::14
2a00:1450:4001:803::200a
2a00:1450:4001:80b::2003
2a00:1450:4001:80e::2008
2a00:1450:4001:813::200a
2a02:26f0:480:f::213:7edd
3.126.74.189
34.111.208.231
52.17.119.105
68.67.153.60
76.76.21.61
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0ee5751877f93e6fb939ff14692e482427a1d301eae0243a5a5d4c408de859d8
1056f2b478d14d099dff9ef3dadde6009343f10b126566dd353621f74254cb42
10fefbe97500ccada8e9c76cd94d1a8c068e8d30e6d558bef36e6d3ed9671b6d
11a1b227a4f432bdc5587a529d34a46abbed7067b6e1fb913db0c489c7175828
1bfc227ba109b698a549875de4c139027b517fe331c7a000746eff75a39bbb4c
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
298de32c358fbdcf8cc819f5ce834c2a406514cd1dd7dfeb9baa63cbdd981fe2
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f2289beea9ab7fbbff5d6cb30b3b8f2ef3ea6169563456de7550e7ad685ddb9
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4789a0a9ddbfa051fbce10cc3b763e76f07462439d36435b920a656c9650f452
4b8b08dfe88bdad825eb249109cc44447aaf76eb4bfd8243b67445ea658105f7
4bc26a08c689de93c486947d1e9756da23919268f52a4a604ef7f1e8df7c06e0
4f2174ae4e5279fa76c3d3ae62350a5e262f7790241b615ed91de552e139c948
500f8aaf69ddcf71a16ceae58c927f03371b33665185e16df347b67f7f11bdb9
50ede0e2f1478b1fadfecec04bde0baeb16c1d061bc3c5606133c1b4c05a8d66
52e8daf71c4ff059c0c27f6edc1061060b4939c9b0d8717e58d5b7ddf7b97346
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
615acce4a85b96f9ed05a75e619f9208c5a543387984f9ca6520bc0766f2c548
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
7f08b4b4eecf5cff1b131a066d0e4e294e534322f59894b67ba3b25e0adb7329
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
822f53109d9d750a8c0c8c189ddb0175b5e0226b66cbaa6a699e78e0f512e2dd
893485d48fc8651981b4810fee0d92ebd7fd85baa7f362ad3934a2c652be8dc9
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
8c64ff48c675b06fa0fe0f561ede39aec9c2b26b6a1bc9f63385504f0c2b0ef5
92443d06835a28423649bca60e6d755e4a1bd09638443196d58e0dd1f06c827f
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9ccfa02743623e532ad0ac54e0e8b863d0b34ad8d004da1c3384f37ac8875929
9f82b0bf306b84a4d28140677db2f0be5c2e994139ba755e583b224680ebc22c
a3f2acc6e3ab71b13062d254c3cc9b882d5264a73e83ba882ed543f9f8e91bec
ab6ed58a96d321ec2b2ca92b92e26600d137264fddd69445eeac40a245249f40
aee584e3d58344a41b190bb7b6e550f98ad3bb8e28fbc7ea6ddca22f0ef97183
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8
c9c20004e1c917a87ec044eaafdc046fccac148ace63e2bb7d7740dff510a3f5
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
cf9af5a8672decce7891262d492ce3a26a3cb2e2c70d8127fcec5997fcb6553f
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
da8a8d0e6fdcbee7ee89c023e16232f374e8281960f79be04904266056b7be00
deb7e20677b44b52322fa201c1e9255dc78e393a42ea7fcb5a245fa580af38de
e2a8463aab9bdf4c013a5342d299c86657ef893c268d3eb701b6b1934fd22a0c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec190e2f6ca2b272958e593e24827f3e51d2352733b509cbe1e30868b875bb7f
ec3730cc77a62eca887107ca642d7d4c7db4e10290c62ca1005ac54b1e660d5b
f4db76afeb499d277603609152f9e382c0fe112d44c6f8db8c136a89d9bd7682
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa8b02c9650f9a85601637f53dc9b0a9d68773f360ba086ac86990f3f93a5c10
fb987d2d66449ff6832c48297a73b679270e359a83aadd5d2ae5c96353a9d43f
fbbc20ab2784a0349626bd51b6564b8cfad192972160fb852d38558e2ef30ff0

www.mitiga.io Open in urlscan Pro 52.17.119.105 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

64 Requests

95 %HTTPS

50 %IPv6

16 Domains

25 Subdomains

23 IPs

4 Countries

4789 kBTransfer

6677 kBSize

16 Cookies

4 Outgoing links

Redirected requests

64 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.mitiga.io Open in urlscan Pro
52.17.119.105 Public Scan

Screenshot
Live screenshot

Full Image

64
Requests

95 %
HTTPS

50 %
IPv6

16
Domains

25
Subdomains

23
IPs

4
Countries

4789 kB
Transfer

6677 kB
Size

16
Cookies

64 HTTP transactions
0 data transactions