www.halcyon.ai Open in urlscan Pro
63.35.51.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Submission: On August 02 via api (August 2nd 2023, 3:44:43 pm UTC) from TR — Scanned from DE

Summary HTTP 50 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 23 IPs in 3 countries across 23 domains to perform 50 HTTP transactions. The main IP is 63.35.51.142, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is www.halcyon.ai.
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.

This is the only time www.halcyon.ai was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	63.35.51.142 63.35.51.142	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:210... 2600:9000:2104:600:12:9e5f:cac0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:5914	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:ba41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.222.137.148 52.222.137.148	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2600:9000:21c... 2600:9000:21c7:2e00:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6811:d3f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:780... 2a02:26f0:780::210:a40a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6812:893b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:20e... 2600:9000:20eb:1c00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:6cc7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:19c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8ace	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
50	23

1 63.35.51.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-51-142.eu-west-1.compute.amazonaws.com

www.halcyon.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:2104:600:12:9e5f:cac0:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5914 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:ba41 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.137.148 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-137-148.ams50.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:21c7:2e00:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:d3f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::210:a40a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:893b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:1c00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:6cc7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:19c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8ace (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 12898 assets.website-files.com — Cisco Umbrella Rank: 12616	2 MB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 384 www.linkedin.com — Cisco Umbrella Rank: 543 px4.ads.linkedin.com — Cisco Umbrella Rank: 5993	5 KB
4	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4306 forms-na1.hsforms.com — Cisco Umbrella Rank: 6975	7 KB
3	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2289	2 KB
3	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4477	3 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4784 forms.hscollectedforms.net — Cisco Umbrella Rank: 4884	26 KB
2	gstatic.com fonts.gstatic.com	44 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 73	155 KB
2	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 6927	329 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 372	21 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415 fonts.googleapis.com — Cisco Umbrella Rank: 79	7 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2215	21 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2221	20 KB
1	google.de www.google.de — Cisco Umbrella Rank: 5772	455 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	1 KB
1	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 55	1 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 1914	254 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 876	376 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2515	1 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 795	5 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 163	2 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	31 KB
1	halcyon.ai www.halcyon.ai	16 KB
50	23

	Domain	Requested by
11	assets-global.website-files.com	www.halcyon.ai assets-global.website-files.com
6	assets.website-files.com	assets-global.website-files.com
3	track.hubspot.com
3	px.ads.linkedin.com	3 redirects
3	forms.hsforms.com	js.hsforms.net www.halcyon.ai
3	ws.zoominfo.com	www.halcyon.ai ws.zoominfo.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	www.halcyon.ai www.googletagmanager.com
2	js.hsforms.net	www.halcyon.ai js.hsforms.net
2	cdn.jsdelivr.net	www.halcyon.ai
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	forms-na1.hsforms.com	www.halcyon.ai
1	www.google.de	www.halcyon.ai
1	www.google.com	1 redirects
1	googleads.g.doubleclick.net	1 redirects
1	region1.google-analytics.com	www.googletagmanager.com
1	px4.ads.linkedin.com	www.halcyon.ai
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	js.hs-scripts.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	fonts.googleapis.com	ajax.googleapis.com
1	d3e54v103j8qbb.cloudfront.net	www.halcyon.ai
1	ajax.googleapis.com	www.halcyon.ai
1	www.halcyon.ai
50	29

This site contains links to these domains. Also see Links.

Domain
ransomwareattacks.halcyon.ai
cloudzy.com
20688644.fs1.hubspotusercontent-na1.net
halcyon.ai
www.linkedin.com
twitter.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
www.halcyon.ai R3	`2023-06-11` - `2023-09-09`	3 months	crt.sh
*.website-files.com Amazon RSA 2048 M01	`2023-02-23` - `2023-11-09`	9 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Frame ID: BBBE0B6C4F8476197A512EF85420803B
Requests: 48 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 67EE25760655BF0DB9C33ADC1A03FECE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Report: Ransomware Command-and-Control Providers Unmasked by Halcyon Researchers

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

50
Requests

96 %
HTTPS

85 %
IPv6

23
Domains

29
Subdomains

23
IPs

3
Countries

2301 kB
Transfer

4995 kB
Size

20
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://ransomwareattacks.halcyon.ai/
Title: Recent Ransomware AttacksStay up to date with our watchtower. We provide near real-time ransomware tracking of attacks, groups, and their victims.

Search URL Search Domain Scan URL

URL: https://cloudzy.com/
Title: Cloudzy

Search URL Search Domain Scan URL

URL: https://20688644.fs1.hubspotusercontent-na1.net/hubfs/20688644/Website%20Collateral%20-%20Static/Halcyon_Cloudzy_C2P_Report.pdf

Search URL Search Domain Scan URL

URL: http://halcyon.ai/contact
Title: talk to a Halcyon expert today

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/halcyonai

Search URL Search Domain Scan URL

URL: https://twitter.com/HalcyonAi

Search URL Search Domain Scan URL

URL: https://www.instagram.com/halcyon_ai/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@halcyonsecurity

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 34

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3998756%26time%3D1690991077460%26url%3Dhttps%253A%252F%252Fwww.halcyon.ai%252Fblog%252Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXqO0YRE6kDwAAAYm27CsuZnEpPQmhViJXYWPpDwWtCTwUUWD1DCfv9z_16mIr6wDjfB33NOavKV5SmW-WcFcQhSJPzQ

Request Chain 37

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&auid=1728467829.1690991077&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=5XnKZMPwGtnv6gTijJnwBQ&sscte=1&crd=&eitems=ChEI8P2npgYQ0rj6l7-EhvnvARIdAPvj3UOlgM02ijD1GtIdn_bP7UXp68oHEpvKfLs&pscrd=Ek5DaEFJOFAybnBnWVFyNDdXamNYaWpiZGFFaVlBQkdxMlByQXkxalFTNTVpSlRsamNkUkg0eTFPUW44cTFwUHh6U0RRSW5SVUs3SHJQcFEaWkNoRUk4UDJucGdZUXBMRFQyX3FNN2ZqZEFSSXVBTlpQRjJ1NjB5Z2FEY3pzLTl3YTRkSVl4Y01SMEV6Y29CcU91Q1V0ZkI0TklQOU0tc2dpR3NsU09yN1UydyITCIP39NOovoADFdm3mgodYkYGXg HTTP 302
https://www.google.com/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&auid=1728467829.1690991077&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOFAybnBnWVFyNDdXamNYaWpiZGFFaVlBQkdxMlByQXkxalFTNTVpSlRsamNkUkg0eTFPUW44cTFwUHh6U0RRSW5SVUs3SHJQcFEaWkNoRUk4UDJucGdZUXBMRFQyX3FNN2ZqZEFSSXVBTlpQRjJ1NjB5Z2FEY3pzLTl3YTRkSVl4Y01SMEV6Y29CcU91Q1V0ZkI0TklQOU0tc2dpR3NsU09yN1UydyITCIP39NOovoADFdm3mgodYkYGXg&is_vtc=1&ocp_id=5XnKZMPwGtnv6gTijJnwBQ&eitems=ChEI8P2npgYQ0rj6l7-EhvnvARIdAPvj3UOkCimY5qKGNpxu3BH3bXZZK1g_4mWA9RA&random=2009806794 HTTP 302
https://www.google.de/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&auid=1728467829.1690991077&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOFAybnBnWVFyNDdXamNYaWpiZGFFaVlBQkdxMlByQXkxalFTNTVpSlRsamNkUkg0eTFPUW44cTFwUHh6U0RRSW5SVUs3SHJQcFEaWkNoRUk4UDJucGdZUXBMRFQyX3FNN2ZqZEFSSXVBTlpQRjJ1NjB5Z2FEY3pzLTl3YTRkSVl4Y01SMEV6Y29CcU91Q1V0ZkI0TklQOU0tc2dpR3NsU09yN1UydyITCIP39NOovoADFdm3mgodYkYGXg&is_vtc=1&ocp_id=5XnKZMPwGtnv6gTijJnwBQ&eitems=ChEI8P2npgYQ0rj6l7-EhvnvARIdAPvj3UOkCimY5qKGNpxu3BH3bXZZK1g_4mWA9RA&random=2009806794&ipr=y

50 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers Show response
www.halcyon.ai/blog/ 57 KB
16 KB 185ms
61ms Document
text/html 63.35.51.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

63.35.51.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-35-51-142.eu-west-1.compute.amazonaws.com

Software

Resource Hash

db101260a655a6af84739ca51919e478b6b79379c4cac5169cd12f54a5639981

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1341
content-encoding: gzip
content-length: 16140
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Wed, 02 Aug 2023 15:44:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, HIT
x-cache-hits: 5, 3
x-cluster-name: eu-west-1-prod-hosting-red
x-frame-options: SAMEORIGIN
x-lambda-id: d61282a5-a1db-416a-b152-d650562f8ef2
x-served-by: cache-iad-kiad7000030-IAD, cache-dub4347-DUB
x-timer: S1690991077.761012,VS0,VE0

GET
H2 200 halcyon-ai.242ed1e6d.min.css
assets-global.website-files.com/6177ed260c37e1240b010cdf/css/ 379 KB
62 KB 86ms
28ms Stylesheet
text/css 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86e61f27756a3414b4d7a96254c2185e6d8bbea3ae6ccdd9b49694738349eb3a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: DJtxU48GJJzvhN2JOLZfm6P5j2e_JC1R
content-encoding: gzip
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
date: Wed, 02 Aug 2023 13:59:13 GMT
age: 6732
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 63012
last-modified: Mon, 31 Jul 2023 13:48:08 GMT
server: AmazonS3
etag: "e6004f14b806c0fbf3b01c41d78665af"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 6WJ5sRNb9NMOwdDoydFi5gd1FcwZuZrBKoyj3vE8WcxEzK4u85G3Eg==

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 13 KB
6 KB 48ms
7ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 08:02:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Aug 2024 08:02:36 GMT

GET
H2 200 fs-cc.js Show response
cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/ 28 KB
11 KB 42ms
18ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41dc8819eef4f6d417ece78a49dd125b561a04ac5d3a60ad426bbd33edb692d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 28408
x-jsd-version: 1.13.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230135-FRA, cache-yyz4558-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"6f98-JaCTdWHT47U4LbgOccbccIAF1bE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2FJaWus6VorC52nnhgSDKJaddN51o7ziQo0VqWiPrsx9yzXtqy4WBHtJfDgNX1hwF0Qzkx1DGKQzsjferXjq3aA%2BNQiyE6JS9Hd%2Bc8fZBO%2Bfg3JW1x6bfjQfem5TmfVj8O90R46qMAURmT9qajc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7f0771771d471e6e-FRA

GET
H2 200 64c87548ede42b0941c28425_halcyon-cloudzy-report-1200x628-thumbnail.jpg
assets-global.website-files.com/617aaa169e39900cd43288be/ 307 KB
308 KB 27ms
26ms Image
image/jpeg 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/617aaa169e39900cd43288be/64c87548ede42b0941c28425_halcyon-cloudzy-report-1200x628-thumbnail.jpg
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9be6c02ca9a6aacd7695f8b1a778d67a24a036df7d7882ecca335583e6e8d1a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 10:51:54 GMT
x-amz-version-id: yg9fFqWVNEkYWpQuTC9f1EHJROAY_HNg
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 103963
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 314482
last-modified: Tue, 01 Aug 2023 03:00:25 GMT
server: AmazonS3
etag: "4adcd29f819618da66784d8203f52ef3"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: JiF2MYaCdpuEBGqjLShxAZ2bgkYG_kG4qEe5Q-CCZO98BK-l-FKLRA==

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 526 KB
165 KB 59ms
17ms Script
application/javascript 2606:4700::6810:ba41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:ba41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-encoding: br
age: 190
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3512/bundles/project-v2.js&cfRay=7f076cd2dee4367b-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"c93e66dd60926c55c794dc765ffe6c1a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.3512/bundles/project-v2.js
date: Wed, 02 Aug 2023 15:44:36 GMT
x-amz-version-id: ti0_iiw7PITtrft.AIEOPeRnP3ag2uRE
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 760e1caa-02cb-499a-920a-6e45e81dc4f5
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 760e1caa-02cb-499a-920a-6e45e81dc4f5
last-modified: Tue, 01 Aug 2023 10:17:49 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K3ZbnE8LDNyObnAKCgizmOv18tMpJ7bYJljCkY6q3jBfL2h2LsJioUadGoyK7V4rKZDhQa330KAg0N66kdvTVexrcxkeClSquin5McDMVKV%2FqNJOHE9Blr3EFBgZXnZiXoCoYgstM0d%2BolB7"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray: 7f077176ab9a18e0-FRA
x-amz-cf-id: HTvgkUysMnV4IrXPfcjGWI6vDwts-62y12JlMm7W_3lzUJbD_9BCXQ==

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
31 KB 48ms
16ms Script
application/javascript 52.222.137.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6177ed260c37e1240b010cdf
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.137.148 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-137-148.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.halcyon.ai/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 17:37:16 GMT
content-encoding: gzip
via: 1.1 24562ce7bb1d06e6505e84aac2d66ac6.cloudfront.net (CloudFront)
age: 83863
x-amz-cf-pop: AMS50-C1
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: GFNSasmnHBSlDVs1G4geFYCywU4WdJBM6L8NGlJFaT4j_Zb22V522Q==

GET
H2 200 halcyon-ai.c0ea680da.js Show response
assets-global.website-files.com/6177ed260c37e1240b010cdf/js/ 1 MB
335 KB 27ms
26ms Script
text/javascript 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/js/halcyon-ai.c0ea680da.js
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6e67d3a6ebd151a0754608fde4e38860a42c2658be8a23d6b938621fc11be9f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: w81jg6bD7FnVD5s6EdsYLeNWs3_rmQjx
content-encoding: gzip
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
date: Wed, 02 Aug 2023 15:23:42 GMT
age: 1373
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 342610
last-modified: Mon, 31 Jul 2023 15:39:21 GMT
server: AmazonS3
etag: "cfd0bcf08b0fdddbb77b2c47ac36cc05"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: IW0rnWZzTI9tAfofXpSBrTE4Q1xWoiqCTk2mPcsg_1I9LRtKTbu0Eg==

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 38ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Inconsolata:400,700%7CPress+Start+2P:regular

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f975895a46361d05753419f5d1b73db850a89a2a94125cedf470689da36e331

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 02 Aug 2023 15:44:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 02 Aug 2023 15:44:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 02 Aug 2023 15:44:36 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 209 KB
75 KB 46ms
22ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PHKHQBQ

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

350a51f14aa6b786255a95ef0e322504548e37b3ab0e0115e69ca0bac7f6efcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76064
x-xss-protection: 0
last-modified: Wed, 02 Aug 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 02 Aug 2023 15:44:36 GMT

GET
H2 200 642ee38dcd85c73c9e38cd89 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 164ms
147ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/642ee38dcd85c73c9e38cd89

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

399259c0aa9c3c2ce1a31fcfc13842e443d8f9d98f571fd7d6080cc022375fd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7f0771771def2baf-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
alt-svc: h3=":443"; ma=86400

GET
H2 200 61784c3784593c6aa2162069_CabinetGrotesk-Medium.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 20 KB
20 KB 120ms
36ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61784c3784593c6aa2162069_CabinetGrotesk-Medium.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b641ecaaeda27cf0d560bf26058e9bc9997ac7bfdc58414f9df2d4d58a32c34b

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 07:43:10 GMT
x-amz-version-id: rNm2HkZSbgyeKSRt.vSpG5gNMxJQZWV5
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 201687
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20260
last-modified: Tue, 26 Oct 2021 18:43:05 GMT
server: AmazonS3
etag: "aece21a384a3950de499549e7a571bda"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: kTYIIp3n17VP8uK4jAmK7tIAvPAWyTwK8EHOrXV6_ZEkZ1c9_Rh1fA==

GET
H2 200 61b4224a8c79365588d7cd08_Halcyon%20Logo.png
assets-global.website-files.com/6177ed260c37e1240b010cdf/ 1 KB
2 KB 94ms
94ms Image
image/png 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/61b4224a8c79365588d7cd08_Halcyon%20Logo.png
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a598acdb34e6c0d45a7d631039c8a1daf4b3ca5a9fd80486a3627daa0273103b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 17 Jul 2023 09:05:58 GMT
x-amz-version-id: jOmNcXbc0tYlcIQkkn7ZCw6nYQ4M2ojG
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 1406318
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1493
last-modified: Sat, 11 Dec 2021 04:00:11 GMT
server: AmazonS3
etag: "6b96bf43a3dc2c282ae083596837e87e"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 2iZoFl5hArePjAYzyyiuo097nPL3SIiIUQ2rzPrJoOvvCuqT3byWkg==

GET
H2 200 61784abb27b4572ab6194949_Gradient%20Mesh%201.jpg
assets-global.website-files.com/6177ed260c37e1240b010cdf/ 423 KB
424 KB 93ms
93ms Image
image/jpeg 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/61784abb27b4572ab6194949_Gradient%20Mesh%201.jpg
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a7d9576a7a471f949956a2efb7483081968cfd94654cfb3bf74f445179825409

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 15:53:14 GMT
x-amz-version-id: x9qnh9CVHAtOmxDCmV0U61Q3RJZbkgrc
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 258683
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 433483
last-modified: Tue, 26 Oct 2021 18:36:44 GMT
server: AmazonS3
etag: "e7dccf53e57426000cf1dea017a5d708"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: lh65dQjXk4-ZB-EFyIx3NcgIyN0Ujg2riGDziNKghawpnS-IsHbJwQ==

GET
H2 200 61784c3706d3142da5bf774d_CabinetGrotesk-Bold.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 20 KB
20 KB 153ms
71ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61784c3706d3142da5bf774d_CabinetGrotesk-Bold.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 52208453fddad17efb2ec2d98729e18556d6c5b64ad22171f8e8b071802314d3

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 07:43:10 GMT
x-amz-version-id: lCZbgOte7VL90b7ycdFKydQfJ1HZMzP.
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 201687
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20300
last-modified: Tue, 26 Oct 2021 18:43:04 GMT
server: AmazonS3
etag: "859bd02cd6a8f6f2827c33fb94b48f1d"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: oqCAgM0G6bAum7eFMlWVckEGFKMk56zbeBCw15wS_gtFfYcJWHm_KQ==

GET
H2 200 61784c375e2b988a453d796c_CabinetGrotesk-Regular.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 20 KB
20 KB 153ms
71ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61784c375e2b988a453d796c_CabinetGrotesk-Regular.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 90ef3ec3532a1ba9c6809fe97bb991d90fa0466e56697ba28370209410fd7e3d

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 07:43:10 GMT
x-amz-version-id: fGwAKbQFXnIBeqK3CaO9.YjxKIRrLkfv
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 201687
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20332
last-modified: Tue, 26 Oct 2021 18:43:05 GMT
server: AmazonS3
etag: "119dd09615302a47abc84021cdd99e08"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: hNl4oElHc8j6W-SrRv9wTjuH2R91hYo7_-BB9XaiL9KNGm3cXVvTsQ==

GET
H2 200 61b21ff4016df97f0ffbad99_Morion%20Bold.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 34 KB
35 KB 175ms
93ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61b21ff4016df97f0ffbad99_Morion%20Bold.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 770c4b6f65fa12c9241c937f7562bc92fba9d95f47ca19a1caf6f9af9f7905c0

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 20:46:42 GMT
x-amz-version-id: DF_.1MRrjbqtqI66u8dDNTi5DhJFTQou
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 413876
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 35136
last-modified: Thu, 09 Dec 2021 15:25:41 GMT
server: AmazonS3
etag: "408e5fc2926bf6ac3bc6cd1cc1db9496"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: zoTygaLcATjGIC9Zr9mxgRgpn_0dlRarJADIfEUr2bkUqVqza6_tvA==

GET
H2 200 61b21ff620c127c6c9164b2b_Morion%20Semibold.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 34 KB
35 KB 154ms
73ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61b21ff620c127c6c9164b2b_Morion%20Semibold.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a309cad583bd9597e074400a76cb668e9b06d50df3273d2fff6d2bf5d34870d0

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 00:58:20 GMT
x-amz-version-id: ce.Cgr2eeh3_Dx9X5_klAueVuxi20hQN
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 225978
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 35208
last-modified: Thu, 09 Dec 2021 15:25:43 GMT
server: AmazonS3
etag: "f4565ee3e85f21692f6dc3d1e7d1b176"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 4nPXsvOK45xqDpVr9VWd88oyHUms70VmEegEYROgW9NIhN_S_bYELw==

GET
H2 200 61784c375e2b98d6023d796b_CabinetGrotesk-Light.woff2
assets.website-files.com/6177ed260c37e1240b010cdf/ 20 KB
20 KB 178ms
98ms Font
application/octet-stream 2600:9000:21c7:2e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/6177ed260c37e1240b010cdf/61784c375e2b98d6023d796b_CabinetGrotesk-Light.woff2
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/css/halcyon-ai.242ed1e6d.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:2e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7c2620fedf2bc5d3a70b21b1fd1e52e1549b94f61d6af78684b8ff4a41a4f6df

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 00:58:20 GMT
x-amz-version-id: fjEBCGqoeKP6ZXzXk9GheraK4noOt3QR
via: 1.1 c149c6b8a4d6f497cac6f2d9e9e6be40.cloudfront.net (CloudFront)
age: 225978
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20332
last-modified: Tue, 26 Oct 2021 18:43:05 GMT
server: AmazonS3
etag: "075bba7146a0dd3b936b4c1081e44b89"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: mkUanf6kSjREtGI731uaZm46qFlb4Ku3DXlMNcmO77UVd20BtYqzrA==

GET
H2 200 61b39eb11777e4417e265a0f_halcyon%20horizontal%20positive.svg
assets-global.website-files.com/6177ed260c37e1240b010cdf/ 4 KB
2 KB 98ms
97ms Image
image/svg+xml 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/61b39eb11777e4417e265a0f_halcyon%20horizontal%20positive.svg
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2fbf1537801efea7e176d934b4d3c9c8c83768415761450c0dfce3341ce56ba9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 14:25:50 GMT
x-amz-version-id: vHJ_vkFyKyM9IV69y1W6Zw5caKUr6aHz
content-encoding: br
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 782327
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 10 Dec 2021 18:38:43 GMT
server: AmazonS3
etag: W/"ef50b60d28d392b8dadc0f8ce79b1b8c"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: U8oBtZlzIVNL2Er7LFfhkQ0Tpe1L6p-wUbhb9blU5u8wjEkP7g3j1w==

GET
H2 200 621f859fd98f3e2724133adc_menu%20chevron%201.svg
assets-global.website-files.com/6177ed260c37e1240b010cdf/ 208 B
667 B 99ms
98ms Image
image/svg+xml 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/621f859fd98f3e2724133adc_menu%20chevron%201.svg
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6307d1736b31a32180a4259684b531a2e27cd04f7660f571fc40d6d2689b9e38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 07:43:10 GMT
x-amz-version-id: MvVEZyT62fuFymR7CYQyxzEzvo8mypUi
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 201687
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 208
last-modified: Wed, 02 Mar 2022 14:56:32 GMT
server: AmazonS3
etag: "cff0476a4930be33da4306a6ce2fb95f"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: VWXOLhs-tEDbFq1b_By65QJhtZwzSZFnqpH0yqxqPAtytrqA0ALI4Q==

GET
H2 200 64c898624e2d02e9c0e5c5e3_halcyon-cloudzy-report-blog-inset-download-banner.jpg
assets-global.website-files.com/617aaa169e39900cd43288be/ 320 KB
320 KB 98ms
98ms Image
image/jpeg 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/617aaa169e39900cd43288be/64c898624e2d02e9c0e5c5e3_halcyon-cloudzy-report-blog-inset-download-banner.jpg
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7edcb3d3097c1674320771894ca2ad6814f1568f5cfa347143579fe4af5892bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 10:14:02 GMT
x-amz-version-id: brZl3_fI9yivgeLj1RVvZF9TcOzVYQPe
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 106235
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 327301
last-modified: Tue, 01 Aug 2023 05:30:12 GMT
server: AmazonS3
etag: "2b7445731e3ee505f9d586bfb8f4895e"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: yygaK12YHr39Jc7i5jcbqE1Ark6dQ4wp612bBSbihRlZNgLpKS-EjA==

GET
H/1.1 200
OK json Show response
forms.hsforms.com/embed/v3/form/20688644/fca53bc8-bc74-4dda-89fe-f186f9430b73/ 16 KB
5 KB 177ms
145ms XHR
application/json 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/20688644/fca53bc8-bc74-4dda-89fe-f186f9430b73/json?hs_static_app=forms-embed&hs_static_app_version=1.3512&X-HubSpot-Static-App-Info=forms-embed-1.3512

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82048a10670381709e533dd0b5da1ab3dfa5e46ff52560e1f4e5da44eeeba211

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.halcyon.ai/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

X-Origin-Hublet: na1
Date: Wed, 02 Aug 2023 15:44:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: fb319b33-4be1-4945-9d67-bf1864411617
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 17
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fb319b33-4be1-4945-9d67-bf1864411617
Server: cloudflare
X-Trace: 2BA2DA16EE8E6DA1A722165BF27327FE051D308261000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.halcyon.ai
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 7f077177bde9699f-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls

GET
H2 200 QlddNThLqRwH-OJ1UHjlKENVzkWGVkL3GZQmAwLyya15.woff2
fonts.gstatic.com/s/inconsolata/v31/ 31 KB
31 KB 32ms
9ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inconsolata/v31/QlddNThLqRwH-OJ1UHjlKENVzkWGVkL3GZQmAwLyya15.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Inconsolata:400,700%7CPress+Start+2P:regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d5476afa39f08490e9c4e1844eb25fd5c1fd71169e360b44e1398ee5ecece40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 21:16:38 GMT
x-content-type-options: nosniff
age: 498479
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31760
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:59:15 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jul 2024 21:16:38 GMT

GET
H2 200 e3t4euO8T-267oIAQAu6jDQyK3nVivM.woff2
fonts.gstatic.com/s/pressstart2p/v15/ 12 KB
13 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/pressstart2p/v15/e3t4euO8T-267oIAQAu6jDQyK3nVivM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Inconsolata:400,700%7CPress+Start+2P:regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bd44fee71c38c481d5b546bf29a65b6a6e69dd4ab89acd8de2d49baeebb8317

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 17:57:48 GMT
x-content-type-options: nosniff
age: 337609
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12480
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:30:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jul 2024 17:57:48 GMT

GET
H2 200 fs-cc.js Show response
cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/ 28 KB
10 KB 17ms
17ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41dc8819eef4f6d417ece78a49dd125b561a04ac5d3a60ad426bbd33edb692d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 28409
x-jsd-version: 1.13.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230135-FRA, cache-yyz4558-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"6f98-JaCTdWHT47U4LbgOccbccIAF1bE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gy3YRMPQGRTf6cLIWsyBfPwu2fM%2BlNRL1MFbTBZS7SfAhsB%2FL3S%2B6%2FGAH39oVFrDCcNUn03%2BEEL2X4vnzoeMOVFXKkAhIzA9mLJS%2BcfT2mvwLAR8yK6TXlO%2B3dau5WXG6efTuZcYnlQmcxruLTg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7f07717988611e6e-FRA

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/10792552678/ 3 KB
2 KB 79ms
45ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/10792552678/?random=1690991077381&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&bttype=purchase&auid=1728467829.1690991077&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PHKHQBQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

24a2c818ea48d4849c6f36af5624934ec70927eb58c0d56c6ca4a1dd702bdc5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Aug 2023 15:44:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1688
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 28ms
8ms Script
application/x-javascript 2a02:26f0:780::210:a40a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PHKHQBQ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:780::210:a40a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jul 2023 09:07:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=50806
accept-ranges: bytes
content-length: 4862

GET
H2 200 20688644.js Show response
js.hs-scripts.com/ 1 KB
1 KB 400ms
381ms Script
application/javascript 2606:4700::6812:893b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/20688644.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PHKHQBQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:893b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0cab18c9cbbc78afe51b96cd6e497cdcd2892446aebf1582439ae5ea803b41

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 18edc0ab-e9d2-430d-a65e-bdc7cb297f00
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 18edc0ab-e9d2-430d-a65e-bdc7cb297f00
last-modified: Wed, 02 Aug 2023 15:26:38 GMT
server: cloudflare
x-trace: 2B15A71F3DA916807925988B8218AF648E1B59CE66000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.halcyon.ai
x-evy-trace-virtual-host: all
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-jknpv
cf-ray: 7f077179dde73672-FRA
expires: Wed, 02 Aug 2023 15:45:37 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
80 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-B90832J8JH&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PHKHQBQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e248a7002c2fd740d78c7cd5125b2a4ac53edc0630461b8dbba5fd77638b46b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82239
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 02 Aug 2023 15:44:37 GMT

OPTIONS
H3 200 collect
ws.zoominfo.com/pixel/ Frame 0
0 163ms
147ms Preflight
text/html 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/collect

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,requestfromzitag,unifiedscriptverified,x-ws-collect-type
Access-Control-Request-Method: POST
Origin: https://www.halcyon.ai
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
access-control-allow-origin: https://www.halcyon.ai
allow: GET,HEAD,POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f077179eeb41a7d-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 02 Aug 2023 15:44:37 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express

POST
H3 200 collect Show response
ws.zoominfo.com/pixel/ 0
577 B 140ms
140ms XHR
text/plain 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/collect

Requested by

Host: ws.zoominfo.com
URL: https://ws.zoominfo.com/pixel/642ee38dcd85c73c9e38cd89

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

requestFromZITag: false
Referer: https://www.halcyon.ai/
x-ws-collect-type: xhr
unifiedScriptVerified: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
access-control-allow-origin: https://www.halcyon.ai
access-control-allow-credentials: true
cf-ray: 7f07717adfff1a7d-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ Frame 67EE 526 KB
164 KB 17ms
17ms Script
application/javascript 2606:4700::6810:ba41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:ba41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-encoding: br
age: 191
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3512/bundles/project-v2.js&cfRay=7f076cd2dee4367b-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"c93e66dd60926c55c794dc765ffe6c1a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.3512/bundles/project-v2.js
date: Wed, 02 Aug 2023 15:44:37 GMT
x-amz-version-id: ti0_iiw7PITtrft.AIEOPeRnP3ag2uRE
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 760e1caa-02cb-499a-920a-6e45e81dc4f5
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 760e1caa-02cb-499a-920a-6e45e81dc4f5
last-modified: Tue, 01 Aug 2023 10:17:49 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wnIWhIjU8K87GDPpUcs%2FE5oPNuz8%2B1hT90KGW6%2BO9HiyRl03bhd9DXu0J5N4ZxtSEy8VDKM8WF%2BVuJMh6EXmr6beCrflS6mwuoWbeIHsFmRqwCKwr5qxJeAr%2FqKgU%2B%2BRgOnIMtcnieuW2lIV"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray: 7f077179f8ad18e0-FRA
x-amz-cf-id: HTvgkUysMnV4IrXPfcjGWI6vDwts-62y12JlMm7W_3lzUJbD_9BCXQ==

GET
H2 200 62228f5bd2debc2ca6f4c8b2_menu%20open%20funky.json Show response
assets-global.website-files.com/6177ed260c37e1240b010cdf/ 5 KB
1 KB 68ms
23ms XHR
application/json 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/62228f5bd2debc2ca6f4c8b2_menu%20open%20funky.json
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/6177ed260c37e1240b010cdf/js/halcyon-ai.c0ea680da.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 96ccea69d83e4529436d29eaf89bb1a19251d795489b4a3415e1ce881444271c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 07:38:45 GMT
x-amz-version-id: MNNoql8jfzIrEkWFVKzQ.lqwC9S6zy0O
content-encoding: br
via: 1.1 8e4700eb43d0f5579f360cfc02e71fac.cloudfront.net (CloudFront)
age: 461153
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 04 Mar 2022 22:14:52 GMT
server: AmazonS3
etag: W/"cc1760a51f471dbb24bf3e6dbe13f973"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: Ro-vSeq3E7_uWbH7P_N_ox8KufO0XLLa4oupQrbO9PLjPM4EnKP4Ng==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/3998756/domain/halcyon.ai/ 36 B
376 B 47ms
8ms XHR
application/json 2600:9000:20eb:1c00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/3998756/domain/halcyon.ai/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1c00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.halcyon.ai/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 12:29:41 GMT
content-encoding: gzip
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 11696
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=17103
x-amz-cf-id: LdhqPJ37weFkTSGt19urnLDx4Cli8HZte7i7eJz95WShst19fbbttQ==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researche...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researche...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3998756%26time%3D1690991077460%26url%3Dhttps%253A%252F%252Fwww.halcyon.ai%252Fblo...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researche...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-research...

0
265 B

242ms
191ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXqO0YRE6kDwAAAYm27CsuZnEpPQmhViJXYWPpDwWtCTwUUWD1DCfv9z_16mIr6wDjfB33NOavKV5SmW-WcFcQhSJPzQ
Requested by: Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 40AFD6251F6946A6A437E38A185A63BB Ref B: DUS30EDGE0921 Ref C: 2023-08-02T15:44:38Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYB8oqMEs2CxcmBbp/4cg==

Redirect headers

date: Wed, 02 Aug 2023 15:44:37 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 5070ED687C834C83B3C73074FE10FC8E Ref B: FRAEDGE1515 Ref C: 2023-08-02T15:44:38Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3998756&time=1690991077460&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKXqO0YRE6kDwAAAYm27CsuZnEpPQmhViJXYWPpDwWtCTwUUWD1DCfv9z_16mIr6wDjfB33NOavKV5SmW-WcFcQhSJPzQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYB8oqIhmsBP/L3/BfZSA==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
254 B 39ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-B90832J8JH&gtm=45je37v0&_p=1366344528&cid=1459412370.1690991077&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1690991077&sct=1&seg=0&dl=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&dt=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B90832J8JH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Aug 2023 15:44:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.halcyon.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
628 B 350ms
180ms Image
image/gif 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: fc75fe95-b987-4288-8d75-eb379a0af699
x-envoy-upstream-service-time: 57
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fc75fe95-b987-4288-8d75-eb379a0af699
server: cloudflare
x-trace: 2B3947F7ACA5A13EB15D8C27069E49849478EF324C000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 7f07717bce713a5c-FRA

GET
H2

200

/
www.google.de/pagead/1p-conversion/10792552678/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fww...
https://www.google.com/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2...
https://www.google.de/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2F...

42 B
455 B

48ms
24ms

Image
image/gif

2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&auid=1728467829.1690991077&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOFAybnBnWVFyNDdXamNYaWpiZGFFaVlBQkdxMlByQXkxalFTNTVpSlRsamNkUkg0eTFPUW44cTFwUHh6U0RRSW5SVUs3SHJQcFEaWkNoRUk4UDJucGdZUXBMRFQyX3FNN2ZqZEFSSXVBTlpQRjJ1NjB5Z2FEY3pzLTl3YTRkSVl4Y01SMEV6Y29CcU91Q1V0ZkI0TklQOU0tc2dpR3NsU09yN1UydyITCIP39NOovoADFdm3mgodYkYGXg&is_vtc=1&ocp_id=5XnKZMPwGtnv6gTijJnwBQ&eitems=ChEI8P2npgYQ0rj6l7-EhvnvARIdAPvj3UOkCimY5qKGNpxu3BH3bXZZK1g_4mWA9RA&random=2009806794&ipr=y

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Aug 2023 15:44:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Aug 2023 15:44:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/10792552678/?random=1671592592&cv=11&fst=1690991077381&bg=ffffff&guid=ON&async=1&gtm=45He37v0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&label=1-NVCKGP67oDEOaRpZoo&hn=www.googleadservices.com&frm=0&tiba=Report%3A%20Ransomware%20Command-and-Control%20Providers%20Unmasked%20by%20Halcyon%20Researchers&value=0&auid=1728467829.1690991077&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOFAybnBnWVFyNDdXamNYaWpiZGFFaVlBQkdxMlByQXkxalFTNTVpSlRsamNkUkg0eTFPUW44cTFwUHh6U0RRSW5SVUs3SHJQcFEaWkNoRUk4UDJucGdZUXBMRFQyX3FNN2ZqZEFSSXVBTlpQRjJ1NjB5Z2FEY3pzLTl3YTRkSVl4Y01SMEV6Y29CcU91Q1V0ZkI0TklQOU0tc2dpR3NsU09yN1UydyITCIP39NOovoADFdm3mgodYkYGXg&is_vtc=1&ocp_id=5XnKZMPwGtnv6gTijJnwBQ&eitems=ChEI8P2npgYQ0rj6l7-EhvnvARIdAPvj3UOkCimY5qKGNpxu3BH3bXZZK1g_4mWA9RA&random=2009806794&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
1016 B 502ms
380ms Image
image/gif 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Wed, 02 Aug 2023 15:44:38 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 9b5194fc-75e4-4550-842f-34f078d4e08e
x-envoy-upstream-service-time: 4
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9b5194fc-75e4-4550-842f-34f078d4e08e
Server: cloudflare
X-Trace: 2B7B1B014892185F466CFC878304711B51DB84F174000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-cxrpn
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f07717bdd489226-FRA

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 139ms
118ms Script
application/javascript 2606:4700::6811:6cc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20688644.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6cc7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.halcyon.ai/
Origin: https://www.halcyon.ai
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
x-amz-version-id: 3rNMTio6eswfsQ6sgXOFNNmyULDAVi34
via: 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: d4a82b74-3fda-4412-86ff-68ba8708c79c
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.380/bundles/project.js&cfRay=7f07717c595a1db0-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 2
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d4a82b74-3fda-4412-86ff-68ba8708c79c
last-modified: Mon, 10 Jul 2023 09:43:19 UTC
server: cloudflare
etag: W/"85b7f9af32b27bd6cc93e80bfb2911df"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
cf-ray: 7f07717c595a1db0-FRA
x-amz-cf-id: CxFhEvaPjI2L4RxTIOsggIt16Lmo6nI0XiUr7J2NbhdSSsTpE_OXLw==
x-hs-target-asset: collected-forms-embed-js/static-1.380/bundles/project.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/20688644/ 66 KB
20 KB 39ms
18ms Script
text/javascript 2606:4700::6812:19c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/20688644/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20688644.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 924ca1f6856a01cf9afb7921a63ce070a9b0973ff3162d54d0b0eaf67c9754e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
x-amz-version-id: nW.NrGuwY3ucQsIsVhaHYdEUvkz6a.PD
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: GPS1HV1RKTWAWR4W
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 346cc474-a807-4bf1-ac8a-960f0599daae
age: 202
x-envoy-upstream-service-time: 32
x-amz-id-2: 8f3NpLdn2S8Lxjf1IQ2dx7hpy2mWpNfmCL5qcUSdEzN1VnRPQOzMng//Clbj/GqgZjemQA2sXxw=
x-evy-trace-listener: listener_https
x-request-id: 346cc474-a807-4bf1-ac8a-960f0599daae
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 31 Jul 2023 22:43:15 GMT
server: cloudflare
etag: W/"9c654a868cc7185e91b8db6114c955b6"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.halcyon.ai
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-ns2gd
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7f07717c594c366b-FRA
expires: Wed, 02 Aug 2023 15:46:15 GMT

GET
H2 200 20688644.js Show response
js.hs-analytics.net/analytics/1690990800000/ 66 KB
21 KB 178ms
157ms Script
text/javascript 2606:4700::6810:8ace
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1690990800000/20688644.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20688644.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8ace , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1517e6ee651114759e793ab6823b1762d8a028a41212b5783e53f9ca5bdb7bd0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:37 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: CMAW9GQ5NXM1E0HP
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 37ec7a04-679e-494e-b97b-5aa5f7ed2c32
x-envoy-upstream-service-time: 24
x-amz-id-2: /zpuwWvTJvafR++a3BV3zWN12wO8XqG7bcyQRwxtdL3oe25H9GPBgd2aZAN2sI2I3yQbKf32NqM=
x-evy-trace-listener: listener_https
x-request-id: 37ec7a04-679e-494e-b97b-5aa5f7ed2c32
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 20 Jul 2023 16:36:44 GMT
server: cloudflare
etag: W/"fa4fbbaec136468ac94ad47c7e25ec87"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-v9vn7
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7f07717c5b71bbda-FRA
expires: Wed, 02 Aug 2023 15:49:37 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 116 B
424 B 147ms
124ms XHR
application/json 2606:4700::6811:6cc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=20688644&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6cc7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ca0a1d6ad1ae4bcfa6b599d78f266604fab635b11207ef7156fb55f2d59bf8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.halcyon.ai/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d89f5bbb-0255-4867-a6f2-328448cb8e0d
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d89f5bbb-0255-4867-a6f2-328448cb8e0d
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.halcyon.ai
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 7f07717d7ac91db0-FRA

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
591 B 149ms
149ms Image
image/gif 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3

Requested by

Host: www.halcyon.ai
URL: https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 14963555-390a-4d94-a75b-bafca64cd952
x-envoy-upstream-service-time: 38
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 14963555-390a-4d94-a75b-bafca64cd952
server: cloudflare
x-trace: 2BB35E9501FF33F8AB98189157482779B3844F095D000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-44rkg
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 7f07717e49aa3a5c-FRA

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
636 B 168ms
149ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=600004306&v=1.1&a=20688644&rcu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&pu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&t=Report%3A+Ransomware+Command-and-Control+Providers+Unmasked+by+Halcyon+Researchers&cts=1690991078533&vi=6997bef72a3d977c6851bc6076f49a10&nc=true&u=81922697.6997bef72a3d977c6851bc6076f49a10.1690991078529.1690991078529.1690991078529.1&b=81922697.1.1690991078530&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 3bac26f6-959b-4545-b851-e49d4d089007
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 15
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3bac26f6-959b-4545-b851-e49d4d089007
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v0ungKKzJrcKMi2Vkq7863F2apy2UgIgoYspSfrHPl86daAvEotVymfh5L8LQzsXtmJBfX4mPtatKg02r1PoXcFwz8kvxOyD5ex661y%2FSWOM8ZxO7fLNAnITNE7Xgt7zTTKCSzkHP5rjht%2BAKVOx"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-j9299
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f077180fcb61cad-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
642 B 161ms
150ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=fca53bc8-bc74-4dda-89fe-f186f9430b73&fci=8f3a604d-ddc3-4c58-9f5f-e83828bd9e5b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=600004306&v=1.1&a=20688644&rcu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&pu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&t=Report%3A+Ransomware+Command-and-Control+Providers+Unmasked+by+Halcyon+Researchers&cts=1690991078534&vi=6997bef72a3d977c6851bc6076f49a10&nc=true&u=81922697.6997bef72a3d977c6851bc6076f49a10.1690991078529.1690991078529.1690991078529.1&b=81922697.1.1690991078530&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 52261067-4b4d-4c16-99f9-1a20be085e71
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 16
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 52261067-4b4d-4c16-99f9-1a20be085e71
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zoCnfWSjIyFjqnr09Dbei8kidxNXjKwHXayhkwvuG9V2xqU0BPRriPee4QAzmB2%2BSUZM7KsSFCk3wNAOieUwwynwxlwy3VuX%2Bh7I0PxfGc5Wgw2TOIw%2BMZ3TrmQuupAOuUFSjvgKh8%2BJd2bkyQIW"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-mc94g
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f077180fcb91cad-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 151ms
140ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=fca53bc8-bc74-4dda-89fe-f186f9430b73&fci=8f3a604d-ddc3-4c58-9f5f-e83828bd9e5b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=600004306&v=1.1&a=20688644&rcu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&pu=https%3A%2F%2Fwww.halcyon.ai%2Fblog%2Freport-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers&t=Report%3A+Ransomware+Command-and-Control+Providers+Unmasked+by+Halcyon+Researchers&cts=1690991078535&vi=6997bef72a3d977c6851bc6076f49a10&nc=true&u=81922697.6997bef72a3d977c6851bc6076f49a10.1690991078529.1690991078529.1690991078529.1&b=81922697.1.1690991078530&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 15:44:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 02f9c1eb-19a4-410f-aab1-413292859a4e
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 12
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 02f9c1eb-19a4-410f-aab1-413292859a4e
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxCQQVz3ozvtQiO2wsCxcXMoqSHahftE3nw9g6K8wPdmOcRlQ2su91%2BcGPFGbzyPmuYQ5xC0PwtHhQC75bufiG3X4mrcbOrMn4vigZn%2FSYmYjRPkfCNOUGFt4w2960Uz%2Fob6nkPFlazGLjkBmh%2Bw"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-pwxm2
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f077180fcba1cad-FRA
x-robots-tag: none

GET
H2 200 636255b1b3ae5550e2d9b295_allow-icon3.svg
assets-global.website-files.com/636255b0b3ae550146d9b27e/ 488 B
944 B 24ms
23ms Image
image/svg+xml 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/636255b0b3ae550146d9b27e/636255b1b3ae5550e2d9b295_allow-icon3.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01aafc27be13e2f996c51a96bdea5f7889302be1b6913f104ad397a1f8b444a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 07:43:12 GMT
x-amz-version-id: 1KD2XAWEVgEW7_nIE78aC_b7lh1JInvp
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 201687
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 488
last-modified: Wed, 02 Nov 2022 11:34:10 GMT
server: AmazonS3
etag: "5a6bbd01c68918eaf8e5a27ef72c06a8"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 2dP99Evr_1PYtyN9RBRg9FktBN1XGg-PGtSTfx1b03QIyPAqTvugKw==

GET
H2 200 636255b1b3ae55e872d9b296_deny-icon3.svg
assets-global.website-files.com/636255b0b3ae550146d9b27e/ 2 KB
972 B 24ms
24ms Image
image/svg+xml 2600:9000:2104:600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/636255b0b3ae550146d9b27e/636255b1b3ae55e872d9b296_deny-icon3.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e8d020a39b0032c385a5a801800f73742a27fbbba0c0dd954abc403acab1149

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.halcyon.ai/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 15:10:50 GMT
x-amz-version-id: B5EPObah2eHfZlfSE8wHjQT3Mn2kJ7MI
content-encoding: gzip
via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
age: 347629
x-amz-cf-pop: AMS1-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 02 Nov 2022 11:34:10 GMT
server: AmazonS3
etag: W/"d2736e52927199d20775ee17631cfc77"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: 9v6PhWGWXhm9TPs7UxGmXwwrC0IVd9dkH5b0yKzntbA33X5s3d2mNA==

Verdicts & Comments Add Verdict or Comment

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ws.zoominfo.com/	1970-01-20 22:28:47	Name: visitorId Value: 4c4fc39e22a9f0cc7fa011583c0300fdbcb0caea93277d3299ebc6a67a171539
.zoominfo.com/	1970-01-20 13:43:12	Name: __cf_bm Value: hJ9tt8xFDm2FlAniAOdyeIxKp2L90VYMqXaRZdyV1TY-1690991077-0-AfAF2eka9zfmgVeAil/z/eC82KYIj9tVirUGXaoYV16mNf1k82wKyciDX9uFWanRA648B+lPEOlcQKdgm2Hf9EU=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: yCEXaQlrTVYKjiRyra_y2bVLKYX4btK8EcRxGCfgXRo-1690991077110-0-604800000
.halcyon.ai/	1970-01-20 15:52:47	Name: _gcl_au Value: 1.1.1728467829.1690991077
.halcyon.ai/	1970-01-20 23:19:11	Name: _ga_B90832J8JH Value: GS1.1.1690991077.1.0.1690991077.0.0.0
.halcyon.ai/	1970-01-20 23:19:11	Name: _ga Value: GA1.1.1459412370.1690991077
www.halcyon.ai/	1970-01-20 13:44:37	Name: ln_or Value: eyIzOTk4NzU2IjoiZCJ9
.linkedin.com/	1970-01-20 15:52:47	Name: li_sugr Value: 5569b1ff-e083-445e-8faa-d897c7981c9c
.linkedin.com/	1970-01-20 22:28:47	Name: bcookie Value: "v=2&7de8316c-b431-4181-80ac-92a063c22560"
.linkedin.com/	1970-01-20 13:44:37	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=2699:u=1:x=1:i=1690991077:t=1691077477:v=2:sig=AQF1_533C89JRurmT6qIjAss8MqC8sEu"
.doubleclick.net/	1970-01-20 13:43:11	Name: test_cookie Value: CheckForPermission
.linkedin.com/	1970-01-20 14:26:23	Name: UserMatchHistory Value: AQK5z5F5GaHnoAAAAYm27CmZoi5jAvWWfWGGYKEDqXdrWO0P-UsSfPZDtxVI9bCG5mtEAFi-zJvxMQ
.linkedin.com/	1970-01-20 14:26:23	Name: AnalyticsSyncHistory Value: AQL6mN72gT-9bwAAAYm27CmZOsZ-Af6FNykyeWtMadJM4kwoBwv8sUmo2i8tK_fddWwXiuVWJohmiaX3_wSG0g
.www.linkedin.com/	1970-01-20 22:28:47	Name: bscookie Value: "v=1&2023080215443738de5deb-6f40-4b91-8c12-38fef63f2e26AQGGkdYzB6QmB4WNUmruV0Glfe8t7H-W"
.linkedin.com/	1970-01-20 18:02:23	Name: li_gc Value: MTswOzE2OTA5OTEwNzc7MjswMjFNUccsY5P4UufAjkV/Ms9rsJir4qtaUOcnNmc+MXtLQA==
.halcyon.ai/	1970-01-20 18:02:23	Name: __hstc Value: 81922697.6997bef72a3d977c6851bc6076f49a10.1690991078529.1690991078529.1690991078529.1
.halcyon.ai/	1970-01-20 18:02:23	Name: hubspotutk Value: 6997bef72a3d977c6851bc6076f49a10
.halcyon.ai/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.halcyon.ai/	1970-01-20 13:43:12	Name: __hssc Value: 81922697.1.1690991078530
.hubspot.com/	1970-01-20 13:43:12	Name: __cf_bm Value: K8nwoPPRjGYY0qrOX7O4XySWneW2Bqk1ttdlT4jfSSg-1690991078-0-AREQxlNRBNuAkZTYm3JOLB2mjDY/gaHxbr/t4Xs1nV0MpdgDMS/f+3uvvymhsZo4I3oLtqPTjL6ZfvNvXRsQHZE=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
assets-global.website-files.com
assets.website-files.com
cdn.jsdelivr.net
cdn.linkedin.oribi.io
d3e54v103j8qbb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
googleads.g.doubleclick.net
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hsforms.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
track.hubspot.com
ws.zoominfo.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.halcyon.ai
www.linkedin.com
13.107.42.14
142.250.185.130
2001:4860:4802:32::36
2600:9000:20eb:1c00:2:53b2:240:93a1
2600:9000:2104:600:12:9e5f:cac0:93a1
2600:9000:21c7:2e00:11:3b84:d200:93a1
2606:4700::6810:5914
2606:4700::6810:8ace
2606:4700::6810:a852
2606:4700::6810:ba41
2606:4700::6811:6cc7
2606:4700::6811:d3f3
2606:4700::6812:19c4
2606:4700::6812:893b
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:801::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:828::2004
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::200a
2a02:26f0:780::210:a40a
52.222.137.148
63.35.51.142
01aafc27be13e2f996c51a96bdea5f7889302be1b6913f104ad397a1f8b444a5
0ca0a1d6ad1ae4bcfa6b599d78f266604fab635b11207ef7156fb55f2d59bf8b
1517e6ee651114759e793ab6823b1762d8a028a41212b5783e53f9ca5bdb7bd0
1f975895a46361d05753419f5d1b73db850a89a2a94125cedf470689da36e331
24a2c818ea48d4849c6f36af5624934ec70927eb58c0d56c6ca4a1dd702bdc5f
2fbf1537801efea7e176d934b4d3c9c8c83768415761450c0dfce3341ce56ba9
350a51f14aa6b786255a95ef0e322504548e37b3ab0e0115e69ca0bac7f6efcf
399259c0aa9c3c2ce1a31fcfc13842e443d8f9d98f571fd7d6080cc022375fd9
3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b
3e8d020a39b0032c385a5a801800f73742a27fbbba0c0dd954abc403acab1149
41dc8819eef4f6d417ece78a49dd125b561a04ac5d3a60ad426bbd33edb692d2
52208453fddad17efb2ec2d98729e18556d6c5b64ad22171f8e8b071802314d3
5bd44fee71c38c481d5b546bf29a65b6a6e69dd4ab89acd8de2d49baeebb8317
5d5476afa39f08490e9c4e1844eb25fd5c1fd71169e360b44e1398ee5ecece40
6307d1736b31a32180a4259684b531a2e27cd04f7660f571fc40d6d2689b9e38
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6e67d3a6ebd151a0754608fde4e38860a42c2658be8a23d6b938621fc11be9f8
770c4b6f65fa12c9241c937f7562bc92fba9d95f47ca19a1caf6f9af9f7905c0
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7c2620fedf2bc5d3a70b21b1fd1e52e1549b94f61d6af78684b8ff4a41a4f6df
7edcb3d3097c1674320771894ca2ad6814f1568f5cfa347143579fe4af5892bc
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
82048a10670381709e533dd0b5da1ab3dfa5e46ff52560e1f4e5da44eeeba211
86e61f27756a3414b4d7a96254c2185e6d8bbea3ae6ccdd9b49694738349eb3a
90ef3ec3532a1ba9c6809fe97bb991d90fa0466e56697ba28370209410fd7e3d
924ca1f6856a01cf9afb7921a63ce070a9b0973ff3162d54d0b0eaf67c9754e8
96ccea69d83e4529436d29eaf89bb1a19251d795489b4a3415e1ce881444271c
9be6c02ca9a6aacd7695f8b1a778d67a24a036df7d7882ecca335583e6e8d1a4
a309cad583bd9597e074400a76cb668e9b06d50df3273d2fff6d2bf5d34870d0
a598acdb34e6c0d45a7d631039c8a1daf4b3ca5a9fd80486a3627daa0273103b
a7d9576a7a471f949956a2efb7483081968cfd94654cfb3bf74f445179825409
b641ecaaeda27cf0d560bf26058e9bc9997ac7bfdc58414f9df2d4d58a32c34b
db0cab18c9cbbc78afe51b96cd6e497cdcd2892446aebf1582439ae5ea803b41
db101260a655a6af84739ca51919e478b6b79379c4cac5169cd12f54a5639981
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e248a7002c2fd740d78c7cd5125b2a4ac53edc0630461b8dbba5fd77638b46b9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

www.halcyon.ai Open in urlscan Pro 63.35.51.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

50 Requests

96 %HTTPS

85 %IPv6

23 Domains

29 Subdomains

23 IPs

3 Countries

2301 kBTransfer

4995 kBSize

20 Cookies

8 Outgoing links

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.halcyon.ai Open in urlscan Pro
63.35.51.142 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

96 %
HTTPS

85 %
IPv6

23
Domains

29
Subdomains

23
IPs

3
Countries

2301 kB
Transfer

4995 kB
Size

20
Cookies

50 HTTP transactions
0 data transactions