www.group-ib.com Open in urlscan Pro
3.72.181.255 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.group-ib.com/blog/0ktapus/
Submission: On December 06 via api (December 6th 2023, 3:19:28 pm UTC) from IN — Scanned from DE

Summary HTTP 122 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 34 IPs in 4 countries across 23 domains to perform 122 HTTP transactions. The main IP is 3.72.181.255, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.group-ib.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 26th 2023. Valid for: a year.

This is the only time www.group-ib.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	3.72.181.255 3.72.181.255	16509 (AMAZON-02) (AMAZON-02)
2	159.69.140.80 159.69.140.80	24940 (HETZNER-AS) (HETZNER-AS)
26	2600:9000:25a... 2600:9000:25a2:e000:9:7af6:1700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	172.65.255.172 172.65.255.172	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.208.22 172.65.208.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	172.65.232.43 172.65.232.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6812:b07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.202.201 172.65.202.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.65.192.122 172.65.192.122	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.236.181 172.65.236.181	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.238.60 172.65.238.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.219.229 172.65.219.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:320... 2a06:98c1:3200::90:1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.198.159 172.65.198.159	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2.17.147.200 2.17.147.200	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
1	18.244.155.54 18.244.155.54	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:880f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700:440... 2606:4700:4400::6812:2b1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
5	3.213.69.187 3.213.69.187	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
9	172.65.240.166 172.65.240.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
122	34

26 3.72.181.255 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

www.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.69.140.80 (Falkenstein, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.80.140.69.159.clients.your-server.de

fhp-de-js.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2600:9000:25a2:e000:9:7af6:1700:93a1 (United States)

ASN16509 (AMAZON-02, US)

website.cdn.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.255.172 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.208.22 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.65.232.43 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
perf-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:b07d (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.202.201 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.65.192.122 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms-eu1.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.236.181 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.238.60 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.219.229 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3200::90:1 (United States)

ASN13335 (CLOUDFLARENET, US)

api-eu1.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.198.159 (United States)

ASN13335 (CLOUDFLARENET, US)

cta-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.17.147.200 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-200.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.244.155.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-155-54.lhr50.r.cloudfront.net

cdn.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:880f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:4400::6812:2b1f (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.213.69.187 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-69-187.compute-1.amazonaws.com

api.neverbounce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.65.240.166 (United States)

ASN13335 (CLOUDFLARENET, US)

track-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	group-ib.com www.group-ib.com fhp-de-js.group-ib.com — Cisco Umbrella Rank: 405486 website.cdn.group-ib.com	1 MB
11	hubspot.com js-eu1.hubspot.com — Cisco Umbrella Rank: 28974 cta-eu1.hubspot.com — Cisco Umbrella Rank: 28543 track-eu1.hubspot.com — Cisco Umbrella Rank: 16152	33 KB
9	hsforms.com forms-eu1.hsforms.com — Cisco Umbrella Rank: 29802 forms.hsforms.com — Cisco Umbrella Rank: 4435 perf-eu1.hsforms.com — Cisco Umbrella Rank: 29084	71 KB
7	6sc.co j.6sc.co — Cisco Umbrella Rank: 5657 c.6sc.co — Cisco Umbrella Rank: 8715 ipv6.6sc.co — Cisco Umbrella Rank: 5852 b.6sc.co — Cisco Umbrella Rank: 3994	20 KB
6	neverbounce.com cdn.neverbounce.com — Cisco Umbrella Rank: 61110 api.neverbounce.com — Cisco Umbrella Rank: 142730	30 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6419	5 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	345 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6765	670 B
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2693 www.google.com — Cisco Umbrella Rank: 2	809 B
3	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8744	3 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	127 KB
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75	4 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	216 B
2	hscollectedforms.net js-eu1.hscollectedforms.net — Cisco Umbrella Rank: 27654 forms-eu1.hscollectedforms.net — Cisco Umbrella Rank: 28279	26 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1387	637 B
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4490	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1266	8 KB
1	hubapi.com api-eu1.hubapi.com — Cisco Umbrella Rank: 24856	1 KB
1	hsadspixel.net js-eu1.hsadspixel.net — Cisco Umbrella Rank: 23532	4 KB
1	hs-analytics.net js-eu1.hs-analytics.net — Cisco Umbrella Rank: 15614	21 KB
1	hs-banner.com js-eu1.hs-banner.com — Cisco Umbrella Rank: 15405	20 KB
1	hs-scripts.com js-eu1.hs-scripts.com — Cisco Umbrella Rank: 14564	1 KB
1	hsforms.net js-eu1.hsforms.net — Cisco Umbrella Rank: 56780	179 KB
122	23

	Domain	Requested by
26	website.cdn.group-ib.com	www.group-ib.com website.cdn.group-ib.com
26	www.group-ib.com	fhp-de-js.group-ib.com www.group-ib.com website.cdn.group-ib.com
9	track-eu1.hubspot.com
7	forms-eu1.hsforms.com	fhp-de-js.group-ib.com www.group-ib.com
5	api.neverbounce.com	cdn.neverbounce.com
4	b.6sc.co	www.group-ib.com
4	px.ads.linkedin.com	3 redirects www.group-ib.com
4	www.googletagmanager.com	www.group-ib.com js-eu1.hsadspixel.net www.googletagmanager.com
3	www.google.de	www.group-ib.com
3	tracking.g2crowd.com	www.group-ib.com
3	connect.facebook.net	www.group-ib.com connect.facebook.net
2	www.google.com	www.group-ib.com
2	www.facebook.com	www.group-ib.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	fhp-de-js.group-ib.com	www.group-ib.com
1	ipv6.6sc.co	fhp-de-js.group-ib.com
1	c.6sc.co	fhp-de-js.group-ib.com
1	stats.g.doubleclick.net	fhp-de-js.group-ib.com
1	region1.analytics.google.com	fhp-de-js.group-ib.com
1	alb.reddit.com	www.group-ib.com
1	perf-eu1.hsforms.com	www.group-ib.com
1	px4.ads.linkedin.com	www.group-ib.com
1	www.linkedin.com	1 redirects
1	ws.zoominfo.com	www.group-ib.com
1	cdn.neverbounce.com	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	j.6sc.co	www.group-ib.com
1	cta-eu1.hubspot.com	fhp-de-js.group-ib.com
1	forms-eu1.hscollectedforms.net	fhp-de-js.group-ib.com
1	api-eu1.hubapi.com	fhp-de-js.group-ib.com
1	js-eu1.hsadspixel.net	js-eu1.hs-scripts.com
1	js-eu1.hs-analytics.net	js-eu1.hs-scripts.com
1	js-eu1.hubspot.com	js-eu1.hs-scripts.com
1	js-eu1.hscollectedforms.net	js-eu1.hs-scripts.com
1	js-eu1.hs-banner.com	js-eu1.hs-scripts.com
1	forms.hsforms.com	www.group-ib.com
1	js-eu1.hs-scripts.com	www.group-ib.com
1	js-eu1.hsforms.net	www.group-ib.com
122	38

This site contains links to these domains. Also see Links.

Domain
trebuchet.gibthf.com
github.com
sso.group-ib.com
twitter.com
www.facebook.com
t.me
www.linkedin.com
api.whatsapp.com
support.signal.org
www.twilio.com
blog.cloudflare.com
www.bleepingcomputer.com
mailchimp.com
www.digitalocean.com
instagram.com
group-ib.medium.com

Subject Issuer	Validity	Valid
www.group-ib.com Sectigo RSA Domain Validation Secure Server CA	`2023-06-26` - `2024-06-28`	a year	crt.sh
*.group-ib.com Sectigo RSA Domain Validation Secure Server CA	`2023-06-30` - `2024-07-04`	a year	crt.sh
website.cdn.group-ib.com Amazon RSA 2048 M02	`2023-08-01` - `2024-08-30`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-16` - `2024-05-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh
6sc.co R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
neverbounce.com Amazon RSA 2048 M02	`2023-02-13` - `2024-03-12`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-14` - `2023-12-13`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh
www.google.de GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.group-ib.com/blog/0ktapus/
Frame ID: 9CD44F78B9BAF0185848F06B92CDD6C8
Requests: 145 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog

Page URL History Show full URLs

https://www.group-ib.com/blog/0ktapus/ Page URL
https://www.group-ib.com/blog/0ktapus/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

122
Requests

98 %
HTTPS

48 %
IPv6

23
Domains

38
Subdomains

34
IPs

4
Countries

2160 kB
Transfer

5280 kB
Size

35
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://trebuchet.gibthf.com/?tab=email&__hstc=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&__hssc=84897990.1.1701875967492&__hsfp=881765916
Title: Email Security Assessment

Search URL Search Domain Scan URL

URL: https://trebuchet.gibthf.com/?tab=network&__hstc=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&__hssc=84897990.1.1701875967492&__hsfp=881765916
Title: Network Protection Assessment

Search URL Search Domain Scan URL

URL: https://github.com/Group-IB/cloud_sherlock
Title: Cloud Recon Tool

Search URL Search Domain Scan URL

URL: https://sso.group-ib.com/
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Roasting%200ktapus:%20The%20phishing%20campaign%20going%20after%20Okta%20identity%20credentials&url=https://www.group-ib.com/blog/0ktapus/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.group-ib.com/blog/0ktapus/&quote=Roasting%200ktapus:%20The%20phishing%20campaign%20going%20after%20Okta%20identity%20credentials

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=https://www.group-ib.com/blog/0ktapus/&text=Roasting%200ktapus:%20The%20phishing%20campaign%20going%20after%20Okta%20identity%20credentials

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://www.group-ib.com/blog/0ktapus/

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=https://www.group-ib.com/blog/0ktapus/

Search URL Search Domain Scan URL

URL: https://support.signal.org/hc/en-us/articles/4850133017242
Title: Signal reported

Search URL Search Domain Scan URL

URL: https://www.twilio.com/blog/august-2022-social-engineering-attack
Title: Twilio

Search URL Search Domain Scan URL

URL: https://blog.cloudflare.com/2022-07-sms-phishing-attacks/
Title: Cloudflare

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/email-marketing-firm-hacked-to-steal-crypto-focused-mailing-lists/
Title: Klaviyo

Search URL Search Domain Scan URL

URL: https://mailchimp.com/newsroom/august-2022-security-incident/
Title: Mailchimp

Search URL Search Domain Scan URL

URL: https://www.digitalocean.com/blog/digitalocean-response-to-mailchimp-security-incident
Title: DigitalOcean

Search URL Search Domain Scan URL

URL: https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know-
Title: Signal

Search URL Search Domain Scan URL

URL: https://twitter.com/GroupIB

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/organization/1382013/

Search URL Search Domain Scan URL

URL: https://instagram.com/groupibhq/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groupibHQ

Search URL Search Domain Scan URL

URL: https://t.me/Group_IB

Search URL Search Domain Scan URL

URL: https://group-ib.medium.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.group-ib.com/blog/0ktapus/ Page URL
https://www.group-ib.com/blog/0ktapus/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 106

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1701875966546%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252F0ktapus%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIkNTfivn6WfgAAAYw_tmS6lMO6sjTlm5F5S-5ViCldMXEZF_fnencaRGw0nQwIl4F1d7CD

122 HTTP transactions
23 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 403 / Show response
www.group-ib.com/blog/0ktapus/ 7 KB
7 KB 154ms
29ms Document
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/blog/0ktapus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 9ee83dd8e7d6473537da1ec4d4b59ceb6833131082c524901facffc83aa68aeb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-type: text/html
date: Wed, 06 Dec 2023 15:19:24 GMT

GET
H/1.1 200
OK bt-autoinject.js Show response
fhp-de-js.group-ib.com/d/ 343 KB
135 KB 147ms
66ms Script
text/javascript 159.69.140.80
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.69.140.80 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.80.140.69.159.clients.your-server.de
Software: nginx /
Resource Hash: 90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:24 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Methods: GET, POST, OPTIONS
x-envoy-upstream-service-time: 0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
DATA 200
OK truncated
/ 485 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 221af8225744c4deb4a3a339b4e8fe799f9907e71f562db3080ab4cca89c3922

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d15c3e4346002a96d56d907fd660b03ec79e03ebc2a0d2965a54441caa73fe0e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response
www.group-ib.com/api/fl/ 205 B
654 B 37ms
37ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a3031b345ef4296d625301c0f8e142223f66e39acfad9eb438a86862db1e609a

Request headers

Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
x-cfids: -

Response headers

date: Wed, 06 Dec 2023 15:19:24 GMT
content-encoding: gzip
server: nginx
etag: W/"WEWD3QVRbFKfyWyDgOThb/VbakBskFQSGOk/iRjuW38+FKRxF49SlwpO2spc++WYPsxVb3+H0K5gP3cHGdurR//oNobP8oguQE7ZsyiHmsO52ikTNQrv2ZE7r5vqw+D9apm1oA/xK2rwpb7y11MdlcF/"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache
x-envoy-upstream-service-time: 1

POST
H2 200 fl Show response
www.group-ib.com/api/ 669 B
979 B 73ms
72ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=WEWD3QVRbFKfyWyDgOThb%2FVbakBskFQSGOk%2FiRjuW38%2BFKRxF49SlwpO2spc%2B%2BWYPsxVb3%2BH0K5gP3cHGdurR%2F%2FoNobP8oguQE7ZsyiHmsO52ikTNQrv2ZE7r5vqw%2BD9apm1oA%2FxK2rwpb7y11MdlcF%2F
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3cf5d8e01040ecef0e0d4d1cdf1b7867861e215b27c596f7181c72f3d8667360

Request headers

Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 06 Dec 2023 15:19:25 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 Primary Request / Show response
www.group-ib.com/blog/0ktapus/ 91 KB
21 KB 46ms
45ms Document
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/blog/0ktapus/

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

61f841c4b7568586768cca6eae2f11c4ccde6d6782d4872a945cad5976f2f88a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/blog/0ktapus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
content-encoding: gzip
content-length: 21339
content-security-policy: frame-ancestors 'self';
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 15:19:25 GMT
etag: "52a5-60bd7f8a3f693"
last-modified: Wed, 06 Dec 2023 14:14:37 GMT
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: X-Forwarded-Proto,Accept-Encoding,Cookie
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block

POST
H2 200 fl
www.group-ib.com/api/ 685 B
702 B 43ms
43ms Ping
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=FYWtQm%2FwuOSfE8F7vV1%2BQlM6UCiuXQzJDPjYC1vrquWhOeNmnqhDZG%2FKmcrhmdD7%2FKkXP1B%2Fv7Q1lKB%2B8aOwPZQG7X1MUqn7ZmmAc2VpEh6NBekeiId8YD4cVaNq%2BHT9XHJOyWhi%2FtHMq%2BPnadQgopkUjusMyuOx%2Fl%2Bh
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 06 Dec 2023 15:19:25 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 6
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H/1.1 200
OK bt-autoinject.js Show response
fhp-de-js.group-ib.com/d/ 343 KB
135 KB 69ms
67ms Script
text/javascript 159.69.140.80
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.69.140.80 Falkenstein, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.80.140.69.159.clients.your-server.de
Software: nginx /
Resource Hash: 90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:25 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Methods: GET, POST, OPTIONS
x-envoy-upstream-service-time: 0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 lazyload.min.js Show response
www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/ 6 KB
2 KB 47ms
45ms Script
application/javascript 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2356
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 14:26:03 GMT
server: nginx
etag: "1883-609a4ddf5c0f8-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 swiper-bundle.min.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 140 KB
39 KB 225ms
115ms Script
application/javascript 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 39504
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Sep 2022 07:41:14 GMT
server: nginx
etag: "22ede-5e7e9344df9f2-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: yCUNYNLXEJRi9CRgSSFVm3Lf1opq-9rbv58yJL_sgXmr0rfZ8iGaKg==

GET
H2 200 classic-themes.min.css
website.cdn.group-ib.com/wp-includes/css/ 217 B
955 B 219ms
110ms Stylesheet
text/css 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 189
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 11 Nov 2022 11:58:50 GMT
server: nginx
etag: "d9-5ed309cf15c82-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: cDb-vIm-3lj3_3EDzeO3iSw76iGen0_26pKnlsFvPtygV1fHj80Wqw==

GET
H2 200 dashicons.min.css
website.cdn.group-ib.com/wp-includes/css/ 58 KB
36 KB 210ms
101ms Stylesheet
text/css 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 35730
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 10 Jun 2022 07:03:36 GMT
server: nginx
etag: "e688-5e112897ec200-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 9BDrA-Bl9FfLQDThsreS3uJtAtU_2u_GNI8a3gVsATutmEuPQsJKXQ==

GET
H2 200 frontend.min.css
www.group-ib.com/wp-content/plugins/post-views-counter/css/ 217 B
274 B 39ms
38ms Stylesheet
text/css 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 158
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 30 Oct 2023 14:47:57 GMT
server: nginx
etag: "d9-608f01fb0af1e-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 jquery.min.js Show response
website.cdn.group-ib.com/wp-includes/js/jquery/ 88 KB
31 KB 181ms
72ms Script
application/javascript 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 30995
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 11 Nov 2022 11:58:50 GMT
server: nginx
etag: "15e54-5ed309cf21802-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: P-yIeeZAjfz0Y6Imq7qq9Y7byyvVQXR5oyBF-jk7nAF-hBnAr4dp-A==

GET
H2 200 single-blog-post.css
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/ 276 KB
39 KB 241ms
132ms Stylesheet
text/css 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

87d38642d78fa749cb0df755e063a4f179ed117e8351a10cfb167b15a51f49f0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 39532
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 06 Dec 2023 15:19:21 GMT
server: nginx
etag: "450a9-60bd8e01bb64e-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: h65NbTcXHoWIMbmrwht_wB3Tt3ozat0m8190yCpQxXFU9cpwYwAGtA==

GET
H2 200 v2.js Show response
js-eu1.hsforms.net/forms/ 560 KB
179 KB 176ms
97ms Script
application/javascript 172.65.255.172
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsforms.net/forms/v2.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a6f97a4d70cf511db8cc68b5545a68c5bf198f63d8ee45d825e843d8f8cbaf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.4255/bundles/project-v2.js&cfRay=83157bb57e6535c6-WAW
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"9a7f761c2f8fc22720fbb5f9991cf1ba"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.4255/bundles/project-v2.js
date: Wed, 06 Dec 2023 15:19:25 GMT
x-amz-version-id: UkR7FhOCqJESuOa050nj1Esxl4Bi1KZb
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
x-hubspot-correlation-id: f7ad4d09-8a48-4b11-9e05-0f80b3a74561
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 12
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: f7ad4d09-8a48-4b11-9e05-0f80b3a74561
last-modified: Wed, 06 Dec 2023 14:26:24 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L0YXL0Kri40u3NcIm%2BRoJkL8lvxuUJvNI8T2ewmRvFpgTtJxHo3niwkBhJAHe0sV90pTbJ8PsohOazKDb2qfMgns0%2F%2FZkpJo1G6Rp7t5%2BYSA6G7c8xw0eaBc7i0J0ijFdkmKfA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-756sw
cf-ray: 831581d17da344f2-TXL
x-amz-cf-id: h-nb_mFnxEceeLtsqJ9yqfxBkC_lt5VX-gUfTm5BRHXx3_x0IagxMA==

GET
H2 200 main.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 212 KB
46 KB 64ms
62ms Script
application/javascript 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

29e48325886d199e892e02e54548232cda07bc28c09f998dccec5b995d7aed62

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 45896
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 04 Dec 2023 22:12:49 GMT
server: nginx
etag: "34e4d-60bb66b1fed8a-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: UxEEXwQOnYrU0e68FgCELrCm2Yzxo588wP7idSDcYmV2iGVK0tJrSQ==

GET
H2 200 fancybox.umd.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/ 103 KB
30 KB 259ms
150ms Script
application/javascript 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 29634
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Sep 2022 07:24:28 GMT
server: nginx
etag: "19ca6-5e7e8f85cb376-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: MGxHwcriERhwYcHFMaaAmOkFQvsbyzyGkYFFQFO64JXtEuvLRPrQcg==

GET
H2 200 frontend.min.js Show response
www.group-ib.com/wp-content/plugins/post-views-counter-pro/js/ 3 KB
1 KB 47ms
46ms Script
application/javascript 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter-pro/js/frontend.min.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c75ce78367d99e641567420678abf3731c7bd570cdaa84457d6eebc47f00d76c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1338
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 31 Oct 2023 13:34:29 GMT
server: nginx
etag: "ae8-6090336cbb5a7-gzip"
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 25755956.js Show response
js-eu1.hs-scripts.com/ 2 KB
1 KB 203ms
145ms Script
application/javascript 172.65.208.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hs-scripts.com/25755956.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3afb3ffd03d43181f9bcd35f362e27358e4678267031642b22018276f8e4107

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 726e38ec-9e38-48f5-ba63-f813829e8f52
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 726e38ec-9e38-48f5-ba63-f813829e8f52
last-modified: Wed, 06 Dec 2023 15:15:16 GMT
server: cloudflare
x-trace: 2BE82689ACB1543871B81656DF6BF75FD6652CD23A000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=30
access-control-allow-credentials: true
x-evy-trace-served-by-pod: fra04/hubapi-td/envoy-proxy-75bd7484f7-8kfdj
cf-ray: 831581d2faea6a75-TXL

GET
DATA 200
OK truncated
/ 488 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08986972b97dfc6d20d6b8ffd5dff272e1526cdfa09925d59f83c2a8597e742f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d1c15176159ca6f41e009898335b34dd7bb45e8af050be96501c6758261258e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response
www.group-ib.com/api/fl/ 217 B
616 B 39ms
38ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 57294f8d03e35910075209512f8db019a88525dddbecf04b24b686a5457c8cc5

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: NK1svl8p9JgG78HOG0W5d/LC6bU6FbIMBgHsd+CW7fKAWK5iItCfQ0BEKMR9M3aRyo04RKN4xjCdA8gmsyiwSMD3XF16hC2zE0V1bsGI8OlPaM4JwnC8s1UQc7psPXOWjQPCj14TSNX03vlUi3itqRxEozgUKWr5u4gZ6hYRDB9fOBSX8dSpX7/8xlmpOUW/BW/oq9ZSrofYuj4k779Pb1/Hhl6tp3d6+ogS/DlRcQobPQx+x+U0jl0C6cPNsWcaNg==
Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: Cyla441ba28dc3c20527bf4f5c58d2434b2a151f
x-cfids: FYWtQm/wuOSfE8F7vV1+QlM6UCiuXQzJDPjYC1vrquWhOeNmnqhDZG/KmcrhmdD7/KkXP1B/v7Q1lKB+8aOwPZQG7X1MUqn7ZmmAc2VpEh6NBekeiId8YD4cVaNq+HT9XHJOyWhi/tHMq+PnadQgopkUjusMyuOx/l+h

Response headers

date: Wed, 06 Dec 2023 15:19:25 GMT
content-encoding: gzip
server: nginx
etag: W/"l7VB4jYhQ4uZ+TeDgv07PZoNEQH+hOZ+/uURNSU6xbyRdNpZcJ2zTMtXXznFZZytKFraljwjuvTYqVOVlwbyvAi3gpgqq/Vo37nueHUWjykm55F+R6X+daVZA5+Jse5DEGc7VS3bsbbJ27i04gfd1JXNmi+DJLr8pljD"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache
x-envoy-upstream-service-time: 1

GET
H2 200 G-font-Medium.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 60 KB
35 KB 184ms
102ms Font
font/otf 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ff571229df9f46b01b0e434bcb36f9e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"eed4-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: miYDr62W9vVbt4n1w6-18j0xZAHREVerD6-giwtk4nd_q0_DhOcL6A==

GET
H2 200 G-font-Regular.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 47 KB
31 KB 176ms
94ms Font
font/otf 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ff571229df9f46b01b0e434bcb36f9e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"bbf8-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: ZtuXFk-kiL59ubL3zkYWT6mqzPGxlXaG-oZiLett8vhjuWF_hL0qkg==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/ 9 KB
3 KB 140ms
81ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.4255&X-HubSpot-Static-App-Info=forms-embed-1.4255

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31909267200ecc43fd4a03c7b847d6c6665da55f3b58138f6e02f49aaaeb6fee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 4070db41-bd6e-4d61-b816-5fccb59ba200
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 6
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4070db41-bd6e-4d61-b816-5fccb59ba200
Server: cloudflare
X-Trace: 2B66772842F4DA3E494AC196DB6D9E8DF0370DB8BC000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 831581d35bc16a75-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-lqkh5

GET
H2 200 cross.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 342 B
980 B 58ms
57ms Image
image/svg+xml 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 207
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "156-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: DXVz4SFWHsgzqJXNoWc1_7_G2G4iM0Zk6MK3dnEuZFwNgahxy2lgAA==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/ 112 KB
30 KB 140ms
95ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.4255&X-HubSpot-Static-App-Info=forms-embed-1.4255

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

708e9cd99371f440fe5193c2a3bf7869a217c1313cf3d18cf9b56109c1290b51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 33cece35-49c5-4bba-ba9f-d48124a332bc
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 18
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 33cece35-49c5-4bba-ba9f-d48124a332bc
Server: cloudflare
X-Trace: 2BE83DFE091C49E71E2010557C147FB039A5CADBF4000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 831581d35e8b58ea-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-lqkh5

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/ 105 KB
29 KB 175ms
132ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3/json?hs_static_app=forms-embed&hs_static_app_version=1.4255&X-HubSpot-Static-App-Info=forms-embed-1.4255

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6018e695dc7c7d48207114827ac9f208b47b991064a82d328617de7fc41c92ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: dedf381f-b06d-40e4-8f96-b409a1c357bb
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 23
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: dedf381f-b06d-40e4-8f96-b409a1c357bb
Server: cloudflare
X-Trace: 2B6624A44F37839E1196DD75B8EB747EF6E0D9036B000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 831581d35c6044f8-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-lqkh5

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a56317b5f4b428a54d0d54dfc7b81791b4e69a4dfab5e8d55f97c042fd5ae600

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f7e5001985baf7245081f9ed83837f4bcad555c807a103199b19788fed2cc6f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b545c52b1fe2fce1a7cca8ec378d9d4acf89e642c2f6978a8f7af3e971f159fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6b7b898d67eb55d105dd0239a5cd648d22797db648ae4173f25dbf7ecbdfbf1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bf862f3586f612ddb5751eb35d4e67ea6719bd5049fd103a606f303a025ca1e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a020ce26514e3bbb18ff49392f40090410f68fce7af7c5bbdd007422681214c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d73267e9e376e6d6843fc7b579e87aed300e4b15d9e5344e2dcf751f79d1c89a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a2f0dbaf513106f77b2b51f6abd54e62f41aa28f6a9a7285edab31747529bd2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c992cc7e9dfbbe71a8591d0d960bac2e651c2f4663f43e03497178d60d57408

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 548a7cf3c1f1288382772d6f67d0e44aa6c13843f96eebc7e81387f6f474c077

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02173693ab18db294c9ca8ecc08ceef379c5d42d98a6d4209e7a836c912479a3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4ac69976dec9506875b3e321930cb6299cc31f8241dea52e17b6b90623d2dbd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b5bdfc272bc76511ade5472eee6d71a83692dc1ceb315718ebcd9005566050a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 820b3c72707d9917f2085cc7ab892b237e567f0fc4d5e7dc36e8a5100cb0d8f1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d33bb1cf44a5e08cdb65cf2dcf890d34560f59e7c8fb15084157d65a958aaac

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3fa0cdab251bde3aa01cd652082ae63fa52b1883b6ee1f48c170959825413de

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/ 8 KB
3 KB 96ms
59ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.4255&X-HubSpot-Static-App-Info=forms-embed-1.4255

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4ca941570c9b64ef4d24dd0ef8e84e21dd2debd389d504aa1a34025f6d34405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: e058982f-4224-47bf-a8df-c9092d05c337
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 9
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e058982f-4224-47bf-a8df-c9092d05c337
Server: cloudflare
X-Trace: 2BDA5F1921CE280C61B2DBFFDCF79738F72A18784A000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 831581d36f7458f0-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-6xgzb

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 295 KB
93 KB 397ms
103ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fc0cf5b6bf412f99ba1978aee6505974fa8df6c167cfcf59b006e88d8a270f7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94816
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2 200 insight.min.js Show response
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/ 8 KB
4 KB 65ms
65ms Script
application/javascript 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 3085
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 15 Jul 2022 14:12:57 GMT
server: nginx
etag: "1e5a-5e3d89d6a8c40-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: OzVCioPl1woRQRpAdK2yLLVw20usSDDWfx5yjL5Ah7IskpxKT1xegw==

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/ 7 KB
3 KB 114ms
68ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.4255&X-HubSpot-Static-App-Info=forms-embed-1.4255

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

539862103ab06a44b1a45c860f4198299451f3d3926dbfc9fdc689cd31a58034

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

X-Origin-Hublet: eu1
Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 0e735a11-918c-431f-86a0-652d988ca8e6
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 8
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0e735a11-918c-431f-86a0-652d988ca8e6
Server: cloudflare
X-Trace: 2B2C989FBF724A167424BAE437B004BC254D665969000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 831581d38ee458ea-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-6xgzb

GET
H2 200 dropdown_before.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 154 B
923 B 68ms
68ms Image
image/svg+xml 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 150
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "9a-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: M0C2rqXYprvYFdfMfpbtdiIpLdzzIvL5YWRUEetrP_ymTHKL_y-TwA==

GET
H2 200 link-arrow.svg
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/ 409 B
1 KB 58ms
58ms Image
image/svg+xml 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 267
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "199-5e27d5c025780-gzip"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: fCrga9Pjnf3PkXapwrC7HjRGb1igtf08z9ndaM7RPgL6wcbSPXK67A==

GET
H2 200 Close.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 227 B
262 B 48ms
47ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 180
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 12:14:21 GMT
server: nginx
etag: "e3-5ee9aed8bc981-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 file_copy.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 668 B
478 B 49ms
48ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 352
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 28 Nov 2022 13:01:55 GMT
server: nginx
etag: "29c-5ee8779d1a6cb-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 success.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 386 B
338 B 40ms
39ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 254
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 11:07:05 GMT
server: nginx
etag: "182-5ee99fd05f106-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 list-dot.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 313 B
321 B 40ms
39ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 205
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 08 Sep 2022 12:02:57 GMT
server: nginx
etag: "139-5e82935d2238c-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 G-font-Bold.otf
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/ 49 KB
32 KB 87ms
60ms Font
font/otf 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ff571229df9f46b01b0e434bcb36f9e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Nov 2023 11:44:59 GMT
server: nginx
etag: W/"c320-60b20d4ef6694"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: font/otf
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-amz-cf-id: HXEKKtfzXajfSvgSUP7Rp5SQDofvlfiIgHTTwNjzWgvvV7LawUI7Ag==

GET
H2 200 main-logo.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 4 KB
2 KB 60ms
48ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fffe17f6fe0ca9bf2e69d087a687c9d2340f67d742a70a810a57ef3c7d17cefe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2025
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 02 Nov 2023 07:29:29 GMT
server: nginx
etag: "116f-6092659219013-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 ti.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 91ms
80ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 5919
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "171f-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: cREjHl1EJKkFNdDC26m-152P44gQE6AIuzqXAzwaXYpqn570_NYRow==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 asm.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 144ms
133ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 5941
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1735-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: SzVt4rjtQxXq7npB46gQ_aJKLJu-ILStn61UYmhn2E2uyw82Hg4kwQ==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 fp.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 8 KB
8 KB 122ms
111ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 7844
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1ea4-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: fC-t04x9M83WQUkrnL35f7vkU-oXCWD_uRo0WnAdwpCk6hx5fLt1Cg==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 drp.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 5 KB
6 KB 110ms
99ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 5398
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "1516-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: bH_jQ6FWVi722UL0v_r0f0cUd7bDnfiSNTqcdLVfzjeVgwNKJP-y_w==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 mxdr.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 163ms
152ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 6506
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "196a-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: CdBGLDzDsZfJEx0oAwjroBmhJzWg4zXuvfs266jazMgaebGW929t8g==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 bep.png
website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ 6 KB
7 KB 142ms
132ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 6362
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Jun 2022 07:55:26 GMT
server: nginx
etag: "18da-5e27d5c025780"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: qXO43HfSA4DUioXslTR3iNKSPEkXELBqPi4Zpj66ZixM-lVrsgQwMg==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 twitter-64.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 1 KB
661 B 55ms
45ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 554
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "426-5ee9716179e8a-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 facebook-64.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 627 B
503 B 87ms
77ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 376
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "273-5ee9716178eea-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 telegram-64.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 1 KB
848 B 87ms
78ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 787
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "5fc-5ee9716179e8a-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 linkedin-64.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 919 B
818 B 81ms
73ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 470
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "397-5ee9716179e8a-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 whatsapp-64.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/ 2 KB
1 KB 109ms
101ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-64.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1046
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 29 Nov 2022 07:39:21 GMT
server: nginx
etag: "7e8-5ee9716179e8a-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 share-black.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 1 KB
559 B 92ms
85ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 500
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 22 Nov 2022 11:16:45 GMT
server: nginx
etag: "468-5ee0d4eb0feca-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 wb_sunny-black.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 724 B
468 B 69ms
62ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 385
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 22 Nov 2022 11:16:45 GMT
server: nginx
etag: "2d4-5ee0d4eb0feca-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 moon.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 627 B
445 B 79ms
71ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg?x86474

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 361
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 24 Nov 2022 12:37:03 GMT
server: nginx
etag: "273-5ee36a9860213-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 img-1440-29-min.jpg
website.cdn.group-ib.com/wp-content/uploads/ 133 KB
134 KB 108ms
101ms Image
image/jpeg 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/img-1440-29-min.jpg

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b8f2045d7b8c3dbb6c9570d861b0572eccb73e0b1a1eb93f509c472492e38361

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 136135
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 14 Dec 2022 13:34:27 GMT
server: nginx
etag: "213c7-5efc9cb9d6b24"
x-frame-options: sameorigin
content-type: image/jpeg
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: chOeYbT6i6e2xhu4DoYqhxFHcYRFqHA87UKLJtwbaond1OE9UqeFpw==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 mirkasymov-1.png
website.cdn.group-ib.com/wp-content/uploads/ 47 KB
48 KB 160ms
153ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/mirkasymov-1.png

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8bebf5aaac8d483cbf86f9116aeed3e2e8f29dd2bcaead145f67f4c439167863

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 48416
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 14 Apr 2023 07:51:04 GMT
server: nginx
etag: "bd20-5f9471a6110b2"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: TdW0ySGk7W6i3GlLah3hXzrbbj_jZait9JTNXo4LNg_OcxPNb75ItQ==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 martinez.png
website.cdn.group-ib.com/wp-content/uploads/ 48 KB
49 KB 142ms
135ms Image
image/png 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/martinez.png

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7265686cd81635ef54fdeae9505c0b1c74ee94cd6661bd5f48846f6209bb30bc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 49080
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 14 Apr 2023 08:59:14 GMT
server: nginx
etag: "bfb8-5f9480e360521"
x-frame-options: sameorigin
content-type: image/png
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: u_ApKrveZUL9da-htS63x-uk0bf06UsGHBZ3Ioyi7qh3nawXKENfbg==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 hunting-rituals_red.jpg
website.cdn.group-ib.com/wp-content/uploads/ 127 KB
128 KB 88ms
82ms Image
image/jpeg 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/hunting-rituals_red.jpg

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 129927
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 16 Aug 2023 12:43:11 GMT
server: nginx
etag: "1fb87-60309a367a354"
x-frame-options: sameorigin
content-type: image/jpeg
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: KoUOZSlrVZRHlo-tKfeDVL_rzeQ-XuZI0riXlF23m2MmJUg_dzeHJg==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 cover-farnetwork-1.webp
website.cdn.group-ib.com/wp-content/uploads/ 81 KB
82 KB 123ms
116ms Image
image/webp 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/cover-farnetwork-1.webp

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

26d28830df1e9958b86a59aca1a51fb51f06392698f90fd02d1341294b32d998

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 82776
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 02 Nov 2023 11:07:22 GMT
server: nginx
etag: "14358-6092964645bc4"
x-frame-options: sameorigin
content-type: image/webp
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: h6oOhFzMxGqdHZHdjm27Rc_U9pTfG4Ts4N7VHNAQlyildy0Fko1K3Q==
expires: Wed, 06 Dec 2023 15:19:25 GMT

GET
H2 200 insiders-gambit-2.jpg
website.cdn.group-ib.com/wp-content/uploads/ 136 KB
137 KB 148ms
142ms Image
image/jpeg 2600:9000:25a2:e000:9:7af6:1700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://website.cdn.group-ib.com/wp-content/uploads/insiders-gambit-2.jpg

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:e000:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d5e95d6adf11e4a630265f96a786ee7278a3bc6244e0d66a89f71fb337f6a73a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f6d3d027dc70c7291c2f685efb187ab2.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-length: 139409
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 23 Oct 2023 11:40:32 GMT
server: nginx
etag: "22091-60860b090fbca"
x-frame-options: sameorigin
content-type: image/jpeg
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes
x-amz-cf-id: 5_CCquOOffa5x1zSr19hgQJxWpOCEggkspt1w6-EAH0uSTBX5GvRuw==
expires: Wed, 06 Dec 2023 15:19:25 GMT

POST
H2 200 ajax.php Show response
www.group-ib.com/wp-content/plugins/post-views-counter-pro/includes/ 307 B
391 B 104ms
99ms Fetch
text/html 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/wp-content/plugins/post-views-counter-pro/includes/ajax.php

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c028bc41657b3c6a30a7b7746ee37484c02e725b808a3ef6a333ed156ad3882f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff, nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 238
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: X-Forwarded-Proto,Accept-Encoding
x-frame-options: sameorigin
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, must-revalidate, max-age=0, private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 check-icon--lbg.svg
www.group-ib.com/wp-content/themes/gib-theme/assets/images/ 772 B
466 B 77ms
74ms Image
image/svg+xml 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/check-icon--lbg.svg

Requested by

Host: website.cdn.group-ib.com
URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-181-255.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

44338445c0ea67505f36e42a481bc4625633b613b50bdb57c073993b596c3328

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://website.cdn.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self';
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 382
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 25 Nov 2022 14:17:28 GMT
server: nginx
etag: "304-5ee4c2e7788b2-gzip"
vary: Accept-Encoding
x-frame-options: sameorigin
content-type: image/svg+xml
access-control-allow-origin: https://www.group-ib.com
cache-control: private, max-age=3600
permissions-policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=()
accept-ranges: bytes

GET
H2 200 collect
px.ads.linkedin.com/ 0
532 B 229ms
168ms Image
application/javascript 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1701875966017&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:25 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 26187C89F9D34B31AD86B02E341DE797 Ref B: FRAEDGE1912 Ref C: 2023-12-06T15:19:26Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYL2OBqKmDIiutsE6D2pQ==

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1016 B 330ms
175ms Image
image/gif 2606:4700::6812:b07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:b07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 0b3978dc-8453-4cf6-a780-1dd35c40c999
x-envoy-upstream-service-time: 19
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0b3978dc-8453-4cf6-a780-1dd35c40c999
Server: cloudflare
X-Trace: 2B7A692BC5471AD84FFED8671BDCADBEF8B37B814D000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-fc678f645-mmr2z
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 831581d51b313bbb-WAW

GET
H/1.1 200
OK counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
1016 B 103ms
62ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 3724361c-a345-4202-b5ad-4a15ead946ea
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3724361c-a345-4202-b5ad-4a15ead946ea
Server: cloudflare
X-Trace: 2B6C3FCB0BC6DBD06BDCBBA56A3DC50472E335C0DA000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-lqkh5
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 831581d508ff6a78-TXL

GET
H2 200 banner.js Show response
js-eu1.hs-banner.com/v2/25755956/ 66 KB
20 KB 109ms
70ms Script
text/javascript 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/v2/25755956/banner.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x86474
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
x-amz-version-id: k.vw21NpSh7kRqhHX0xaReU0fWn_9Gg5
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: CNHC54E4B2VPJ6BF
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 78e880eb-dce4-44c0-b54b-bacaf32be647
x-envoy-upstream-service-time: 47
x-amz-id-2: SVmHzovAMCqrLM5PdLoxiUTA2KYm+NstZAeCJ2zDWorDCMWS7zd6aQAyeLBjRQisMTNwMeykjUQ=
x-evy-trace-listener: listener_https
x-request-id: 78e880eb-dce4-44c0-b54b-bacaf32be647
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 18 Oct 2023 17:20:52 GMT
server: cloudflare
etag: W/"0fe58bfdba164c72145bf56fb55fa2bb"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.facct.ru
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-7cfbc6c7f8-bfklt
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 831581d508f958d8-TXL
expires: Wed, 06 Dec 2023 15:20:16 GMT

GET
H2 200 collectedforms.js Show response
js-eu1.hscollectedforms.net/ 69 KB
25 KB 124ms
50ms Script
application/javascript 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hscollectedforms.net/collectedforms.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ad17c7d661733bbf1cfe9bc6e85033bfed43c87c94cb72ba02f484adf1593c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.group-ib.com/
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
x-amz-version-id: qOShuUL.zI.RMIWwukZE0taADNX_1wuf
via: 1.1 75f70026bed8fa7e14f645c02f074728.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: FRA60-P6
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ce50190b-72fa-42e7-86a6-f6a181bfac8a
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.444/bundles/project.js&cfRay=83043d5dae2baca9-WAW
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ce50190b-72fa-42e7-86a6-f6a181bfac8a
last-modified: Mon, 04 Dec 2023 12:10:50 UTC
server: cloudflare
etag: W/"109b7665e389a0b17fbf732bf7a02089"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-756sw
cf-ray: 831581d548632675-TXL
x-amz-cf-id: z9ucgxruIoZZi1ckxerzg_B24T51wU8DhJg6eyu109juIeOrqdsaXA==
x-hs-target-asset: collected-forms-embed-js/static-1.444/bundles/project.js

GET
H2 200 web-interactives-embed.js Show response
js-eu1.hubspot.com/ 78 KB
23 KB 149ms
92ms Script
application/javascript 172.65.236.181
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hubspot.com/web-interactives-embed.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.236.181 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

252e228a388a88d71beddc8eb163c3112b6856d0f44c40cb35e6fbfecc4a4c1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.group-ib.com/
Origin: https://www.group-ib.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.727/bundles/project.js&cfRay=830cc2982829c00d-WAW
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"2f59cb8e886eb54e0772cbb7c7591d18"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.727/bundles/project.js
date: Wed, 06 Dec 2023 15:19:26 GMT
x-amz-version-id: OTrPCrIE5NrD.KcatbkN9mvrrpaWpHi2
via: 1.1 997d50190609a53c76124b45ad43b3ec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P6
x-hubspot-correlation-id: 6f2ef6ed-6113-4d59-877e-9281eb56970b
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 6f2ef6ed-6113-4d59-877e-9281eb56970b
last-modified: Tue, 05 Dec 2023 12:50:29 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oYE4uAM928wUbTuRmLZ6s%2BiugJ3tRsT8NIT8XxwsQA%2Ff10%2BxgT8gVQTtwdp4Bo8U8C2T9ucSD%2B%2FfWbeVGFFY9Z6wlEwyanAXUECVDwSIt4ZuQdp1aHisMM16A4eRPRJxM8jFhw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-sxtv5
cf-ray: 831581d52e8f4541-TXL
x-amz-cf-id: qX0ZAoUFA59kiRrLDpX62Xfp8Bpjd5zSZMxHFcYdHuuvr0qJXTVdgQ==

GET
H2 200 25755956.js Show response
js-eu1.hs-analytics.net/analytics/1701875700000/ 66 KB
21 KB 106ms
67ms Script
text/javascript 172.65.238.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-analytics.net/analytics/1701875700000/25755956.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x86474
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5adb3b6debbbee4c4a326c9a32a24c7d6c4a6f99d78a8604bc0d635d1b04f20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: GE1MS2GVP195R341
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 98c924b2-711f-4ced-b9de-51cd2a2f0b3b
x-envoy-upstream-service-time: 21
x-amz-id-2: /6mICpF3+lWUqg1kWI3duvlVaJYQK3H5eoHM3RK2/V3b3uekMmfVFtgjYetvIXk14KsHESpcNE8=
x-evy-trace-listener: listener_https
x-request-id: 98c924b2-711f-4ced-b9de-51cd2a2f0b3b
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 15 Nov 2023 17:23:01 GMT
server: cloudflare
etag: W/"56b300e73e9fcf76e46547446fd25cff"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-54d97ddf9c-srs49
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 831581d5094d58f6-TXL
expires: Wed, 06 Dec 2023 15:20:16 GMT

GET
H2 200 fb.js Show response
js-eu1.hsadspixel.net/ 6 KB
4 KB 69ms
29ms Script
application/javascript 172.65.219.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsadspixel.net/fb.js

Requested by

Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25755956.js?x86474

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df998f2ab79818d229edfab989eb187dd3d94f0f40377fde4f5f97e08b691ecf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
x-amz-version-id: XlFw32Cnxu8ZjnNH.SH7ungVy3g8LtQG
via: 1.1 cba0902b20d884568adf673bab9438e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: FRA60-P6
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 82ad7d56-c350-4d5c-ad10-05c45ce8c223
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.501/bundles/pixels-release.js&cfRay=8304be088cb5bfc1-WAW
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
age: 241
x-envoy-upstream-service-time: 59
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 82ad7d56-c350-4d5c-ad10-05c45ce8c223
last-modified: Mon, 04 Dec 2023 14:19:28 UTC
server: cloudflare
etag: W/"ed930579444c6c7c0292363361667508"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-sxtv5
cf-ray: 831581d50b184522-TXL
x-amz-cf-id: Xx8RCs73JofNyI1o1Xpkm5j4u87qtEXOwu-hYE1xAPJhKzAtnUz42g==
x-hs-target-asset: adsscriptloaderstatic/static-1.501/bundles/pixels-release.js

GET
H2 200 json Show response
api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 250 B
1 KB 177ms
137ms XHR
application/json 2a06:98c1:3200::90:1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3200::90:1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 62b967ea-a2fb-4a6d-822e-58b05c04b1c7
content-encoding: br
x-envoy-upstream-service-time: 30
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 62b967ea-a2fb-4a6d-822e-58b05c04b1c7
server: cloudflare
x-trace: 2B42DCDC07C1567908AD9D4A043BE26EE42DE803C6000000000000000000
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-served-by-pod: fra04/hubapi-td/envoy-proxy-75bd7484f7-9ff9w
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Upsb%2BXQllslruO%2Fu0JIXVwPS6vgRpoOnddVdrmKRfrlmJmFhXQYqQbw1ySRLuEYKXUS%2BOxr%2Bw7ekfC3a3RiMv5PqBhZULSWaFnljNYgIYR6gFwQmqP%2BzHliYzIF6LTNh%2FNegvs1JtGQl4P4LJtO7jg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 831581d5caa9266d-TXL
access-control-allow-headers: *

GET
H2 200 json Show response
forms-eu1.hscollectedforms.net/collected-forms/v1/config/ 116 B
434 B 71ms
49ms XHR
application/json 172.65.192.122
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk=

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.group-ib.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: eb85dfea-8d8c-4788-a988-993a965ec294
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: eb85dfea-8d8c-4788-a988-993a965ec294
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-9bbd8cb6-sxtv5
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 831581d5d9742675-TXL

GET
H2 200 combinedConfigs Show response
cta-eu1.hubspot.com/web-interactives/public/v1/embed/ 369 B
1 KB 223ms
155ms Fetch
application/json 172.65.198.159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-eu1.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=25755956&currentUrl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&referrer=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F

Requested by

Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.198.159 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 65cfc4e4-57ab-487c-a017-e9a69c257e73
content-encoding: br
x-envoy-upstream-service-time: 15
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 65cfc4e4-57ab-487c-a017-e9a69c257e73
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.group-ib.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mKqKOiB%2BN7ZBjgFEspFUKoxXpiWnFuR6rt1DC4hn3Hfh5VLsUlFCEi5MGjMdYIAkmH7gqPJxPvL41FotDNFyBbfFMcyyQdenZsqkKJzRDZVPg5ljc0FtEijSCxhpw61dl9O%2FvPA%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 831581d63d9a4504-TXL
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-lqkh5

GET
H/1.1 200
OK counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
1016 B 63ms
62ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=5

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 2159dbbb-197a-424b-83a5-229bd69077f3
x-envoy-upstream-service-time: 6
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2159dbbb-197a-424b-83a5-229bd69077f3
Server: cloudflare
X-Trace: 2B358795852221B7F68470A1C8AA9315756D806DBD000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-vx2fr
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 831581d62bac6a78-TXL

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
79 KB 97ms
95ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Requested by

Host: js-eu1.hsadspixel.net
URL: https://js-eu1.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cd20ec3a2801d539f721825372d5db085c90a81578bca2457a72301a736cd571

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80792
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 290 KB
94 KB 97ms
97ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

39cfdab33d04ffe244a5a4e0570154a150d126799cf2a13c041a91f8cc214f0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96444
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 63 KB
17 KB 185ms
46ms Script
application/javascript 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-200.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

a9e9d5d62bdbbe46fee9a3a0ba4c2d7fe5a6f4b53c10df3ac7d34796ffb7c96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 29 Nov 2023 18:58:50 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "656789ea-fdc2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17428
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/ 3 KB
2 KB 267ms
114ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1701875966543&cv=11&fst=1701875966543&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&hn=www.googleadservices.com&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&auid=1938080932.1701875967&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4389cbe6be7ac05db678a9a167f1a9da6976b19579e0e9f9324c94dd714d0f34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 86ms
28ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 NeverBounce.js Show response
cdn.neverbounce.com/widget/dist/ 96 KB
29 KB 158ms
42ms Script
application/javascript 18.244.155.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.155.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-155-54.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 02:25:58 GMT
content-encoding: gzip
via: 1.1 dbeea278d9cc0659ab002a66cfdb03f8.cloudfront.net (CloudFront)
last-modified: Mon, 02 Mar 2020 18:37:33 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-P8
age: 46409
etag: W/"c1e06621030dfcba15b88abbcaa546eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: jmcu0_PloGqR1IqFXdJhcSZNPz_uyJQCQCzt65QSQTvR_Kiaha7LDg==

GET
H2 200 63e267f61a03d71ea3df5fe7 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 391ms
325ms Script
text/javascript 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

f49eda72b54bbdfe91695e7741106cbdc4b84fc903616e2e47b1bbf5de8f52fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/blog/0ktapus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 831581d76ec5bf94-WAW
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 86ms
29ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 06 Dec 2023 15:19:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: /R5OQf83+C0Ikgnv01Rz+F5D4GXyxkkIoV6WvJfeGLVt0NPGYufc6Xfn1W3TuiwkynsoOnLXpU3ji5AjHLTYKg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 1010045.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
2 KB 199ms
153ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010045.js?p=https://www.group-ib.com/blog/0ktapus/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: ca8a048b-2112-41fa-b217-1444d4d7fc47
x-runtime: 0.003366
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"d4c9ffda6ca556f36f402f6d1131a4f3"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 831581d749156a73-TXL

GET
H2 200 1010056.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
912 B 217ms
171ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010056.js?p=https://www.group-ib.com/blog/0ktapus/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: 132a121c-e3f8-46cc-823d-fbcea9b587d8
x-runtime: 0.003765
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"085d5ab7549bcb7c4e86df292e05e2e5"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 831581d749146a73-TXL

GET
H2 200 1010057.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 958 B
912 B 202ms
156ms Script
text/javascript 2606:4700:4400::6812:2b1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/1010057.js?p=https://www.group-ib.com/blog/0ktapus/&e=

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection: 1; mode=block
x-request-id: 24b70146-0f68-401c-9289-1cbc99135367
x-runtime: 0.004034
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"1d26a8b07287923bfa829132476a39ef"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
cf-ray: 831581d749166a73-TXL

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
79 KB 125ms
125ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b4c6b790ecf9bc143aec9c171531984a1c0b0da4d9aeddd0a054ebc5973e18e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80925
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1701875966546%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIkNTfivn6WfgAAAY...

0
265 B

238ms
175ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIkNTfivn6WfgAAAYw_tmS6lMO6sjTlm5F5S-5ViCldMXEZF_fnencaRGw0nQwIl4F1d7CD
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 3E93F2B188064F46A65FB96D401C0130 Ref B: FRAEDGE1315 Ref C: 2023-12-06T15:19:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYL2OB9DqVPf7QTzvR/Bw==

Redirect headers

date: Wed, 06 Dec 2023 15:19:26 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: E5903A492ADD4749917D223C140FC27B Ref B: FRAEDGE1912 Ref C: 2023-12-06T15:19:27Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1701875966546&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIkNTfivn6WfgAAAYw_tmS6lMO6sjTlm5F5S-5ViCldMXEZF_fnencaRGw0nQwIl4F1d7CD
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYL2OB5WSHpyvcL4iQSJg==

GET
H/1.1 200
OK counters.gif
perf-eu1.hsforms.com/embed/v3/ 35 B
1 KB 139ms
84ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-eu1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 15:19:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: bfc26775-9c9d-4a32-890c-4bfc694c2a04
x-envoy-upstream-service-time: 5
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: bfc26775-9c9d-4a32-890c-4bfc694c2a04
Last-Modified: Wed, 06 Dec 2023 15:19:26 GMT
Server: cloudflare
X-Trace: 2B5640C29C8D089C55CED103F0872C79FFE8D92ECF000000000000000000
Vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-7b5f5fb655-vx2fr
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
X-Robots-Tag: none
CF-RAY: 831581d79ef26a78-TXL

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 97ms
32ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1701875966638&id=a2_du2owjr6f67j&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=b8741d1f-cdac-49c3-ae74-a9c8bdc028a2&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/ 3 KB
1 KB 117ms
115ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1701875966653&cv=11&fst=1701875966653&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&hn=www.googleadservices.com&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1938080932.1701875967&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

540c7c1dfe8c8305f6a7eb45d2b07d84cf54985eb6c176acc0d8759338a246e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1368
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 649324202964935 Show response
connect.facebook.net/signals/config/ 143 KB
37 KB 88ms
88ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/649324202964935?v=2.9.138&r=stable&domain=www.group-ib.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0a014f28d198eaf2dbc55fd97dcde352e47f6519bccd6f2570e3d8f1874ab5bf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 06 Dec 2023 15:19:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: utBSX2KrUWl0MCi9yuD/ORfdybeuh87CLAXB+vcxo8gNhbKBIVhSCkmbgAoQ4/P1L9ryjBSJuVvtpThdItGgVA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 62 B
281 B 434ms
146ms Script
application/javascript 3.213.69.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_26383

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.69.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-69-187.compute-1.amazonaws.com

Software

nginx /

Resource Hash

5dbfa12c955441c024c16d5e3e3f7d1238f4abace04c204bce91f49e65d80cd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 428ms
149ms Script
application/javascript 3.213.69.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_121895

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.69.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-69-187.compute-1.amazonaws.com

Software

nginx /

Resource Hash

0fb1d35ea25c4d8fecdfe49c1083f194a9f85d9f400038057d05a3d0ed8901e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 62 B
281 B 517ms
243ms Script
application/javascript 3.213.69.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_71451

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.69.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-69-187.compute-1.amazonaws.com

Software

nginx /

Resource Hash

5c4d2b1f727e235352d89225b4596c8b36821cf5c3187dd0aa807b9254933e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 62 B
282 B 394ms
134ms Script
application/javascript 3.213.69.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_201670

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.69.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-69-187.compute-1.amazonaws.com

Software

nginx /

Resource Hash

32b7ce4d15dd8662933b21085fa77165bb16800fb7cd849fee4778466c628dee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

GET
H2 200 notify Show response
api.neverbounce.com/v4/poe/ 63 B
282 B 407ms
150ms Script
application/javascript 3.213.69.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_577195

Requested by

Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.69.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-69-187.compute-1.amazonaws.com

Software

nginx /

Resource Hash

a0a03aeedd5b9ffbafa569db88058b55496a237833fd2e686e09c7750124f0a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, private
x-ua-compatible: IE=Edge

POST
H2 204 collect
region1.analytics.google.com/g/ 0
246 B 166ms
59ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je3bt0v9101996448z872040694&_p=1701875965947&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=881886769.1701875967&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&sid=1701875966&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&dt=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1250
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
246 B 223ms
75ms Ping
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=881886769.1701875967&gtm=45je3bt0v9101996448z872040694&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 261ms
102ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=881886769.1701875967&gtm=45je3bt0v9101996448z872040694&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=868985489

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 46ms
45ms XHR
text/html 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-147-200.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.group-ib.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
311 B 112ms
28ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: eca911cde383d98bf0ebfaeae9ffcbf9a217014053c43f8a4206d325f4988a5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.group-ib.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a03:1b20:b:f011::1e
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701875966823_34901612_184507763_19_796_27_56_219";dur=1
content-length: 20
expires: Wed, 06 Dec 2023 15:19:26 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 254ms
254ms Image
image/gif 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=80a6e8c7-083f-4097-8356-6fb24dee8fbe&session=e68ef81a-b24d-44fc-8a60-26d827de28cc&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2006%20Dec%202023%2015%3A19%3A26%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Over%20130%20organizations%20have%20been%20compromised%20in%20a%20sophisticated%20attack%20using%20simple%20phishing%20kits.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pageViewId=a41ad4f4-0fc0-4e16-82a0-e71a16690057&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-200.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 332ms
332ms Image
image/gif 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=80a6e8c7-083f-4097-8356-6fb24dee8fbe&session=e68ef81a-b24d-44fc-8a60-26d827de28cc&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2006%20Dec%202023%2015%3A19%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2006%20Dec%202023%2015%3A19%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2006%20Dec%202023%2015%3A19%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Over%20130%20organizations%20have%20been%20compromised%20in%20a%20sophisticated%20attack%20using%20simple%20phishing%20kits.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pageViewId=a41ad4f4-0fc0-4e16-82a0-e71a16690057&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-200.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 85ms
28ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&if=false&ts=1701875966821&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701875966819.950126710&cs_est=true&it=1701875966710&coo=false&rqm=GET

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 06 Dec 2023 15:19:27 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/10897073384/ 42 B
455 B 247ms
89ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10897073384/?random=1701875966543&cv=11&fst=1701874800000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&cid=CAQSGwDICaaN25Sv265ayIwul2yhAY8PzntAUNoACg&random=4078371211&rmt_tld=0&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10897073384/ 42 B
455 B 90ms
90ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10897073384/?random=1701875966543&cv=11&fst=1701874800000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v72040694&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&cid=CAQSGwDICaaN25Sv265ayIwul2yhAY8PzntAUNoACg&random=4078371211&rmt_tld=1&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10882981508/ 42 B
108 B 170ms
91ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10882981508/?random=1701875966653&cv=11&fst=1701874800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNpQsGQb1i48kVnpEzB5AqVQDe6Ay2Ng&random=1475223608&rmt_tld=0&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10882981508/ 42 B
108 B 88ms
88ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10882981508/?random=1701875966653&cv=11&fst=1701874800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&frm=0&tiba=All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNpQsGQb1i48kVnpEzB5AqVQDe6Ay2Ng&random=1475223608&rmt_tld=1&ipr=y

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 15:19:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 fl Show response
www.group-ib.com/api/ 685 B
1004 B 95ms
95ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=l7VB4jYhQ4uZ%2BTeDgv07PZoNEQH%2BhOZ%2B%2FuURNSU6xbyRdNpZcJ2zTMtXXznFZZytKFraljwjuvTYqVOVlwbyvAi3gpgqq%2FVo37nueHUWjykm55F%2BR6X%2BdaVZA5%2BJse5DEGc7VS3bsbbJ27i04gfd1JXNmi%2BDJLr8pljD
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 325d23b126a047967213cb9f3fdf00ff0ef7895ab996498562158060b7348342

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: NK1svl8p9JgG78HOG0W5d/LC6bU6FbIMBgHsd+CW7fKAWK5iItCfQ0BEKMR9M3aRyo04RKN4xjCdA8gmsyiwSMD3XF16hC2zE0V1bsGI8OlPaM4JwnC8s1UQc7psPXOWjQPCj14TSNX03vlUi3itqRxEozgUKWr5u4gZ6hYRDB9fOBSX8dSpX7/8xlmpOUW/BW/oq9ZSrofYuj4k779Pb1/Hhl6tp3d6+ogS/DlRcQobPQx+x+U0jl0C6cPNsWcaNg==
Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: CXu9cc843ed4a5fb04daa76a1b357ac3f09feeb3
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 06 Dec 2023 15:19:26 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 281ms
281ms Image
image/gif 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=80a6e8c7-083f-4097-8356-6fb24dee8fbe&session=e68ef81a-b24d-44fc-8a60-26d827de28cc&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3Ab%3Af011%3A%3A1e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Over%20130%20organizations%20have%20been%20compromised%20in%20a%20sophisticated%20attack%20using%20simple%20phishing%20kits.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pageViewId=a41ad4f4-0fc0-4e16-82a0-e71a16690057&v=1.1.12

Requested by

Host: www.group-ib.com
URL: https://www.group-ib.com/blog/0ktapus/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-200.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 709834390277869 Show response
connect.facebook.net/signals/config/ 140 KB
36 KB 84ms
84ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/709834390277869?v=2.9.138&r=stable&domain=www.group-ib.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f5a5703710663d26cfdf94d6e3223d9a2be8979a603bb96e4779326277a230e3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 06 Dec 2023 15:19:27 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: pj+LVVMRDlBA4jtEO00DVvgTc7wmskwG1llUeGAS9B4Etjmpr2hv1HiPl+7QFKWgtuB5m6jwW906k4ysQTH1Yw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
741 B 164ms
125ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967495&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 91aab135-cf3b-4e0b-acc9-9fb764b2a703
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 91aab135-cf3b-4e0b-acc9-9fb764b2a703
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MouujJrm8gV4Im2yrzSjEF9TB0v%2BFc18uZREfZgOJXm9W27sUXybND7UdAtXjehE0%2FqMRf476hkgt3yNHu7FdJR6DJ2Un7%2FEIiZtfvddv%2BeSVxmzu65UDcien4ZplLtdT1nyDM%2BC%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-wj4r4
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e5baca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
704 B 133ms
118ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=9c8dcf4e-b8fb-415b-9de2-4d62193a927d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967497&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 44c8c6d1-2d3b-4bf0-b4e6-dce5e1b1bb0e
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 44c8c6d1-2d3b-4bf0-b4e6-dce5e1b1bb0e
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EHFXjFotAcXflqQkrKENKdzEFqtmv0NEmOoGnHH27bZ9aKVuKS%2FFFIPJKwaFHf%2FM7HfYJQXgXHOlU%2FJLJbDe%2Bonqc%2FgSuIiLu3IVQI2oFxCPQvGi%2BwCRTj0HiqyY8yx%2F40j3usZLRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-fcpg5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e66aca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 125ms
110ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=fdedca3d-3d41-42bf-9efb-85685cad0237&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967497&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 37d1342b-b694-450a-af8e-ade609003c5b
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 37d1342b-b694-450a-af8e-ade609003c5b
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SOmfCx3BGv3nYYCGkiqBD4u%2FJ%2FcEAmAFxhAxweOGkPuk4w%2BevJK4a%2FpaTaPrY8cA124wjrkaGgSXTazV8BlN1aWPvttQBebTQQn%2Bo3dOj5YUt8V9FmGfiJ0AixckkHyPLNe3sWkdLg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-fcpg5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e64aca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
631 B 137ms
122ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=65b6bdb9-fa20-4290-bd7d-e0b568c39d0c&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967498&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a2300c20-cefd-41db-9811-fd7fca9e38c8
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a2300c20-cefd-41db-9811-fd7fca9e38c8
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=edZmlBmt3BEE10ra3drqNimy0E3Ts%2BzG0tEvymmTJZ9eSqjtI%2F7KzNoZLE7grS2wg%2BhIWEb7bMSmM4fYPwrkC4DUquCK%2B%2B1Ut87S7ounVGwkjcva96bwNzYgOSYdi9Lohm0UIU3fXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-znz77
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e61aca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
747 B 126ms
111ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=a6a6f498-7a6b-4241-898f-31158e7b9494&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967498&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 19f7a7ac-b948-4bbd-aa3b-b9c3f20f10a3
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 2
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 19f7a7ac-b948-4bbd-aa3b-b9c3f20f10a3
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VXkmoQkPNxedGiq2%2FL%2Bv7kOmD0NBHT%2F36Eq%2BCZ7VAz0cePjC5KWkYc5Sk1BztvbM%2BEwo0fEqCucburYpDd%2FXQP3jZn3CFUSuOObStP1Xk%2F2%2FyOVQnac4h4TC9JmYj4kta2caX51EIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-gdz92
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e5daca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 136ms
121ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e2c524b2-80fc-40a6-ba4c-704a336fa412&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967499&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 04413b18-0b29-4010-a3f9-1a36cf02c606
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 04413b18-0b29-4010-a3f9-1a36cf02c606
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s1pkXkrc7c6h6SueC4fbSuYypDBs989IvKJp0jbbinWs9WFAuNWB3AU7zdMNHle7rVGPooEqxNZ9eIH1YjUSvNzUdwV1U52S5trvxbevHEN0kk88tdOwQ13sU0Xf5hGt1cMLSKnqeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-snkl8
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581dd2e67aca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
738 B 97ms
97ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=fdedca3d-3d41-42bf-9efb-85685cad0237&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967499&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: eb1f5b83-0686-4d94-aeed-4c79e2fbbd67
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: eb1f5b83-0686-4d94-aeed-4c79e2fbbd67
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9rM2UdYvHEirqgCI4GBLB2Kl%2BbtIuFeurrTcdY9BpWuKlSt6BwlEy83rwF7d5JfYcjhWkLue43ulsoM3PogvH20diey7eh3TWCKvy023WOCNKUNd8t%2BJY3FMvwBGGCaGh18xXFAbtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-fcpg5
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581ddaf49aca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 89ms
88ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=5a995f05-701c-48e3-b25a-d1548ba3c0b3&fci=e2c524b2-80fc-40a6-ba4c-704a336fa412&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967500&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 90026124-e76b-4a23-a62c-79e4aa1a24a2
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 4
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 90026124-e76b-4a23-a62c-79e4aa1a24a2
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E27lRZidZihYLPlRbk%2FLSDMchz4BXppzS3yo3Fe0HGo0MfDV5zHpO%2BKmI5dzCCbVuSwOTxouT2oyygO6mv%2FwHP%2Bz07JuCUlzJ9E4%2Fw903%2BeT1%2FclyUpx0hkDuCfPNgovxH34AFsE%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-wj4r4
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581ddaf4faca9-TXL
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
734 B 96ms
96ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=65b6bdb9-fa20-4290-bd7d-e0b568c39d0c&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=881765916&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&t=All+about+the+phishing+campaign+that+compromised+over+130+organizations+and+the+resources+involved+(phishing+domains%2C+kits%2C+and+tools%2C+and+more)+%7C+Group-IB+Blog&cts=1701875967500&vi=cf03bd549b506a60061d73de9b13a322&nc=true&u=84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1&b=84897990.1.1701875967492&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5fe52a99-84e0-411b-b61b-b2e4893cf3f2
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5fe52a99-84e0-411b-b61b-b2e4893cf3f2
last-modified: Wed, 06 Dec 2023 15:19:27 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6R4CJ5derhz8EoybzDpOiELltzsYOpdWKh84HRTdeaHj84Y0e59pz7KyrgbL5s7VenCNCs3ludTaprilwXHfLJA7tqNpHPmnzcHT2sI%2Fow7vFyd8lhYqnpUDoTEDwHQ8cg6aRgfsuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-85847fc4bc-kr47x
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 831581ddaf52aca9-TXL
x-robots-tag: none

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 28ms
28ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&if=false&ts=1701875967616&sw=1600&sh=1200&ud[external_id]=cf03bd549b506a60061d73de9b13a322&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701875966819.950126710&cs_est=true&it=1701875966710&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 06 Dec 2023 15:19:27 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 252ms
251ms Image
image/gif 2.17.147.200
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=80a6e8c7-083f-4097-8356-6fb24dee8fbe&session=e68ef81a-b24d-44fc-8a60-26d827de28cc&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2006%20Dec%202023%2015%3A19%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2006%20Dec%202023%2015%3A19%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Over%20130%20organizations%20have%20been%20compromised%20in%20a%20sophisticated%20attack%20using%20simple%20phishing%20kits.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pageViewId=a41ad4f4-0fc0-4e16-82a0-e71a16690057&v=1.1.12

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.200 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-200.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 15:19:28 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 fl Show response
www.group-ib.com/api/ 685 B
786 B 40ms
39ms XHR
application/json 3.72.181.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.group-ib.com/api/fl?u=0085cb90-831e-11ee-9493-816cec585ffa&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=UaOZ5%2FAOsg53k62B2gZi4oGYOu%2BrrSivQOQb1dvBtgJLAIwBoQE2busHmG%2FUkvq%2FMEF4uAJG%2BnEan6pWDGtohVMwpmUaJ771UPwaehGNy4MPRdO%2BW8WXjqasNMfIgdyuerPnz%2Bzhpbak2HZCLv8XNdapoi7EUg5q8Iix
Requested by: Host: fhp-de-js.group-ib.com
URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-181-255.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9bcec7c02d4cd54a03a8f27f82f5072f8715f8a470a2e5f805c8e690ad673a21

Request headers

X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: SwpnV32QAg8DzpGl8DMhW2ddDS+XgOPNN9I685YaqLtmQwUqWzCRwGJI96TNkdh79rs3iWzlUnkLDOhE9qpLRXZJ+yT4FtGbkplYzeThL1+yXbWjLN7Lo1ps7pY+ooQkiQd36jN9NVAie/B2gt5MoEAfMWCXiTQA5mfyhJY/OOkTMiNPr9dWQp4F+vW2/fBWYhaEMWtwKG6JBR5NRALc/9TI+jq1jtBo+GP4pIWYdUDxrtCPA1TX639xEGRH19zG3hS5UFvrt45t2N3SdTU=
Referer: https://www.group-ib.com/blog/0ktapus/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24: vy5R38497503dfa0f76f39ae4cad0c3e666548ab
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 06 Dec 2023 15:19:27 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.group-ib.com
cache-control: no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
access-control-allow-headers: Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=80a6e8c7-083f-4097-8356-6fb24dee8fbe&session=e68ef81a-b24d-44fc-8a60-26d827de28cc&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2006%20Dec%202023%2015%3A19%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2006%20Dec%202023%2015%3A19%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Over%20130%20organizations%20have%20been%20compromised%20in%20a%20sophisticated%20attack%20using%20simple%20phishing%20kits.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22All%20about%20the%20phishing%20campaign%20that%20compromised%20over%20130%20organizations%20and%20the%20resources%20involved%20(phishing%20domains%2C%20kits%2C%20and%20tools%2C%20and%20more)%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2F0ktapus%2F&pageViewId=a41ad4f4-0fc0-4e16-82a0-e71a16690057&v=1.1.12

Verdicts & Comments Add Verdict or Comment

100 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.group-ib.com/	1970-01-21 01:30:11	Name: __zzatgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: MDA0dBA=Fz2+aQ==
.group-ib.com/	1970-01-21 01:30:11	Name: __zzatgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: MDA0dBA=Fz2+aQ==
.linkedin.com/	1970-01-21 01:30:11	Name: bcookie Value: "v=2&697dd181-889a-4161-8ce8-e0d5bfe194f2"
.linkedin.com/	1970-01-20 16:46:02	Name: lidc Value: "b=TGST05:s=T:r=T:a=T:p=T:g=2894:u=1:x=1:i=1701875966:t=1701962366:v=2:sig=AQEWTBb9LIyuJdNuYcdDPgCwvjmb9wC1"
.group-ib.com/	1970-01-20 18:54:11	Name: _gcl_au Value: 1.1.1938080932.1701875967
.group-ib.com/	1970-01-20 18:54:11	Name: _rdt_uuid Value: 1701875966637.b8741d1f-cdac-49c3-ae74-a9c8bdc028a2
.linkedin.com/	1970-01-20 18:54:11	Name: li_sugr Value: 35f27acb-218e-4e5f-8e8f-7f42135f40fe
.group-ib.com/	1970-01-21 02:20:35	Name: _ga_QMES53K3Y2 Value: GS1.1.1701875966.1.0.1701875966.60.0.0
.group-ib.com/	1970-01-21 02:20:35	Name: _ga Value: GA1.1.881886769.1701875967
tracking.g2crowd.com/	1970-01-20 17:04:45	Name: _session_id Value: 332156ec44dcd1ce53d7bfdb35837802
.g2crowd.com/	1970-01-20 16:44:37	Name: __cf_bm Value: I05LZdODag62c2YzosguV16OsjQL1c7QkE0T0uhiU00-1701875966-0-AZdW2BjEnjmgHKpa2gokJZZ24z2vR0xuqoAw59omEgWDL/HNP7SZgg45JWPEA8iWnfUjNVeJmwYBHArxFmqPuAQ=
www.group-ib.com/	1970-01-21 02:20:35	Name: _gd_visitor Value: 80a6e8c7-083f-4097-8356-6fb24dee8fbe
www.group-ib.com/	1970-01-20 16:44:50	Name: _gd_session Value: e68ef81a-b24d-44fc-8a60-26d827de28cc
.doubleclick.net/	1970-01-20 16:44:36	Name: test_cookie Value: CheckForPermission
.group-ib.com/	1970-01-20 18:54:11	Name: _fbp Value: fb.1.1701875966819.950126710
.linkedin.com/	1970-01-20 17:27:47	Name: UserMatchHistory Value: AQIpMgtnbS0AsQAAAYw_tmNcUu66AxE3n1WOW2L3_zKcbp20eZ7RmDWpfQQQvkAFrdBPgR23hbaykg
.linkedin.com/	1970-01-20 17:27:47	Name: AnalyticsSyncHistory Value: AQIceAcfBTnRlgAAAYw_tmNcpG_1R40PGmwXG3lCQn-ggD_HzZCK2d1lIk4suVRS-EVbHNYD7F150qAbaJGx6A
.ws.zoominfo.com/	1970-01-21 01:30:11	Name: visitorId Value: c30500a20863ef007fb46cbd015ea28cbb191bf1b26a4ada6d12b95c0c6ba24f
.zoominfo.com/	1970-01-20 16:44:37	Name: __cf_bm Value: u.aKGVf3cheU5K5S56NZbxDInldqxkytug_Suu983_M-1701875966-0-AVjYXdIr8fHfqHgUpUW6S6DbYHObTsUuC/g9A2IPqmpAonoXs2li+RT5yszsgvx2toMzPb2Cnbs477xlyVbe5mw=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: h.TX3humbrNCGcq7DKxLXrYgszcwWTZKMLlL8FhVQHc-1701875966922-0-604800000
.www.linkedin.com/	1970-01-21 01:30:11	Name: bscookie Value: "v=1&20231206151926ee3f2a0a-d737-4703-8bff-48ddcf7ac574AQGnJmkNjXXoqfniZJt5kipqonE_nOtN"
.linkedin.com/	1970-01-20 21:03:47	Name: li_gc Value: MTswOzE3MDE4NzU5NjY7MjswMjEyCh7REwQhE9TYBEB5XZMcz9KaOo8XDlFLdMvzbHwq0w==
.6sc.co/	1970-01-21 02:20:35	Name: 6suuid Value: c4931102e4921000ff90706525010000a6d04600
.group-ib.com/	1970-01-20 21:03:47	Name: __hstc Value: 84897990.cf03bd549b506a60061d73de9b13a322.1701875967492.1701875967492.1701875967492.1
.group-ib.com/	1970-01-20 21:03:47	Name: hubspotutk Value: cf03bd549b506a60061d73de9b13a322
.group-ib.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.group-ib.com/	1970-01-20 16:44:37	Name: __hssc Value: 84897990.1.1701875967492
.hubspot.com/	1970-01-20 16:44:37	Name: __cf_bm Value: 6lI3E8Q389OalvBFCPr5wkXfB6rQBzOkqAHJVC.LE4k-1701875967-0-AXunjzsmNFt6gtUGIuQZhQjd881WKXPk/v5SdpSfZG3PGrR44h/eaWT3oOb8N3CeYyFJB564/rtrI1dp51cHCPE=
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: uyKns0uqaMsSwXqmJ9VHnJZtGObQvuAe0ARgmo_a7o8-1701875967700-0-604800000
.www.group-ib.com/	1970-01-21 01:30:11	Name: cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: s9CiPopLAmNW8wiV2k5/AbeTojmJt+i28VCkLO9wlTX7KEWOzvIdefmtPKtdc3/tGEkI7tfrrJSUlf8BVFbSVUk70jnnTFwGFzhFB9VQbn9RvD7NMlwHA8XfJv6KOrtSf0RNp5vEOLOIaVfSD0u5+wQxnmNtOvnlYMaB
.group-ib.com/	1970-01-21 01:30:11	Name: cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: s9CiPopLAmNW8wiV2k5/AbeTojmJt+i28VCkLO9wlTX7KEWOzvIdefmtPKtdc3/tGEkI7tfrrJSUlf8BVFbSVUk70jnnTFwGFzhFB9VQbn9RvD7NMlwHA8XfJv6KOrtSf0RNp5vEOLOIaVfSD0u5+wQxnmNtOvnlYMaB
.www.group-ib.com/	1970-01-21 01:30:11	Name: gsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: bgWUXhIQfAkEOP1j1CIeaMo7eOvdRWXPTasS5Mb0yhpA7eJgV/C/MHdpspIu5jVwfwv6m2GEfQVeF1gxD0l08ZiF72rBgT9osoOYmhkGPCitNVX9Hdl3V6y/6yfeQNIxkEQEuWNc2+iFa8yU0TXvIqarlhIr5BEbmYwZT2701QL6+544Y/xbRZWoNt2ktDtUa4/GQ3Fup1a2V+y7WNS7cfomC2e+A0y7XjlOrDACitsGKJsk/xtfpWuN3PqSXHuGoSIyDyFL4dSif+Mp8U8=
.group-ib.com/	1970-01-21 01:30:11	Name: gsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: bgWUXhIQfAkEOP1j1CIeaMo7eOvdRWXPTasS5Mb0yhpA7eJgV/C/MHdpspIu5jVwfwv6m2GEfQVeF1gxD0l08ZiF72rBgT9osoOYmhkGPCitNVX9Hdl3V6y/6yfeQNIxkEQEuWNc2+iFa8yU0TXvIqarlhIr5BEbmYwZT2701QL6+544Y/xbRZWoNt2ktDtUa4/GQ3Fup1a2V+y7WNS7cfomC2e+A0y7XjlOrDACitsGKJsk/xtfpWuN3PqSXHuGoSIyDyFL4dSif+Mp8U8=
.www.group-ib.com/	1970-01-21 01:30:11	Name: fgsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: pwZi8175e70c9911754a84209511eb5ef140dbac
.group-ib.com/	1970-01-21 01:30:11	Name: fgsscgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Value: pwZi8175e70c9911754a84209511eb5ef140dbac

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.group-ib.com/blog/0ktapus/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
api-eu1.hubapi.com
api.neverbounce.com
b.6sc.co
c.6sc.co
cdn.neverbounce.com
connect.facebook.net
cta-eu1.hubspot.com
fhp-de-js.group-ib.com
forms-eu1.hscollectedforms.net
forms-eu1.hsforms.com
forms.hsforms.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hsadspixel.net
js-eu1.hscollectedforms.net
js-eu1.hsforms.net
js-eu1.hubspot.com
perf-eu1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
stats.g.doubleclick.net
track-eu1.hubspot.com
tracking.g2crowd.com
website.cdn.group-ib.com
ws.zoominfo.com
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
www.group-ib.com
www.linkedin.com
www.redditstatic.com
b.6sc.co
13.107.42.14
151.101.193.140
159.69.140.80
172.65.192.122
172.65.198.159
172.65.202.201
172.65.208.22
172.65.219.229
172.65.232.43
172.65.236.181
172.65.238.60
172.65.240.166
172.65.255.172
18.244.155.54
2.17.147.200
2001:4860:4802:34::36
2600:9000:25a2:e000:9:7af6:1700:93a1
2606:4700:4400::6812:2b1f
2606:4700::6810:880f
2606:4700::6812:b07d
2620:1ec:21::14
2a00:1450:4001:803::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:831::2004
2a00:1450:400c:c04::9d
2a02:26f0:ab00::214:8e70
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42:200::396
2a06:98c1:3200::90:1
3.213.69.187
3.72.181.255
01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c
02173693ab18db294c9ca8ecc08ceef379c5d42d98a6d4209e7a836c912479a3
085d5ab7549bcb7c4e86df292e05e2e579ec6ce11e052357110484554cdb12c1
08986972b97dfc6d20d6b8ffd5dff272e1526cdfa09925d59f83c2a8597e742f
0a014f28d198eaf2dbc55fd97dcde352e47f6519bccd6f2570e3d8f1874ab5bf
0a020ce26514e3bbb18ff49392f40090410f68fce7af7c5bbdd007422681214c
0a6f97a4d70cf511db8cc68b5545a68c5bf198f63d8ee45d825e843d8f8cbaf2
0ad17c7d661733bbf1cfe9bc6e85033bfed43c87c94cb72ba02f484adf1593c0
0d33bb1cf44a5e08cdb65cf2dcf890d34560f59e7c8fb15084157d65a958aaac
0fb1d35ea25c4d8fecdfe49c1083f194a9f85d9f400038057d05a3d0ed8901e8
14103b64df9857f9f7ad1f02efaafba97ce4772e8d8b448857de69c3537c338d
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9
1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367
1aa462865a143f6b053d5d1594aea3e38d36ebad2a23a7fcfdd84ba7a7a1fddb
1d26a8b07287923bfa829132476a39ef18a3d54142a095bead617044f2255eab
1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4
1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639
221af8225744c4deb4a3a339b4e8fe799f9907e71f562db3080ab4cca89c3922
252e228a388a88d71beddc8eb163c3112b6856d0f44c40cb35e6fbfecc4a4c1d
26d28830df1e9958b86a59aca1a51fb51f06392698f90fd02d1341294b32d998
29e48325886d199e892e02e54548232cda07bc28c09f998dccec5b995d7aed62
2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0
31909267200ecc43fd4a03c7b847d6c6665da55f3b58138f6e02f49aaaeb6fee
31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a
325d23b126a047967213cb9f3fdf00ff0ef7895ab996498562158060b7348342
32b7ce4d15dd8662933b21085fa77165bb16800fb7cd849fee4778466c628dee
34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e
3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880
39cfdab33d04ffe244a5a4e0570154a150d126799cf2a13c041a91f8cc214f0b
3cf5d8e01040ecef0e0d4d1cdf1b7867861e215b27c596f7181c72f3d8667360
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
4389cbe6be7ac05db678a9a167f1a9da6976b19579e0e9f9324c94dd714d0f34
43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf
44338445c0ea67505f36e42a481bc4625633b613b50bdb57c073993b596c3328
45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee
4bf862f3586f612ddb5751eb35d4e67ea6719bd5049fd103a606f303a025ca1e
539862103ab06a44b1a45c860f4198299451f3d3926dbfc9fdc689cd31a58034
540c7c1dfe8c8305f6a7eb45d2b07d84cf54985eb6c176acc0d8759338a246e8
548a7cf3c1f1288382772d6f67d0e44aa6c13843f96eebc7e81387f6f474c077
57294f8d03e35910075209512f8db019a88525dddbecf04b24b686a5457c8cc5
574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced
5a2f0dbaf513106f77b2b51f6abd54e62f41aa28f6a9a7285edab31747529bd2
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5c4d2b1f727e235352d89225b4596c8b36821cf5c3187dd0aa807b9254933e1b
5c992cc7e9dfbbe71a8591d0d960bac2e651c2f4663f43e03497178d60d57408
5d1c15176159ca6f41e009898335b34dd7bb45e8af050be96501c6758261258e
5dbfa12c955441c024c16d5e3e3f7d1238f4abace04c204bce91f49e65d80cd0
6018e695dc7c7d48207114827ac9f208b47b991064a82d328617de7fc41c92ca
61f841c4b7568586768cca6eae2f11c4ccde6d6782d4872a945cad5976f2f88a
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018
6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061
708e9cd99371f440fe5193c2a3bf7869a217c1313cf3d18cf9b56109c1290b51
7265686cd81635ef54fdeae9505c0b1c74ee94cd6661bd5f48846f6209bb30bc
7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6
820b3c72707d9917f2085cc7ab892b237e567f0fc4d5e7dc36e8a5100cb0d8f1
87d38642d78fa749cb0df755e063a4f179ed117e8351a10cfb167b15a51f49f0
8bebf5aaac8d483cbf86f9116aeed3e2e8f29dd2bcaead145f67f4c439167863
8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b
90feab54b3acd83fa6182b1099d882d4aa602ec61b8bcdfec8c3c8f413df5fe0
942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72
997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab
9b4c6b790ecf9bc143aec9c171531984a1c0b0da4d9aeddd0a054ebc5973e18e
9b5bdfc272bc76511ade5472eee6d71a83692dc1ceb315718ebcd9005566050a
9bcec7c02d4cd54a03a8f27f82f5072f8715f8a470a2e5f805c8e690ad673a21
9ee83dd8e7d6473537da1ec4d4b59ceb6833131082c524901facffc83aa68aeb
9f7e5001985baf7245081f9ed83837f4bcad555c807a103199b19788fed2cc6f
a0a03aeedd5b9ffbafa569db88058b55496a237833fd2e686e09c7750124f0a6
a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f
a3031b345ef4296d625301c0f8e142223f66e39acfad9eb438a86862db1e609a
a56317b5f4b428a54d0d54dfc7b81791b4e69a4dfab5e8d55f97c042fd5ae600
a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517
a9e9d5d62bdbbe46fee9a3a0ba4c2d7fe5a6f4b53c10df3ac7d34796ffb7c96b
ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc
b545c52b1fe2fce1a7cca8ec378d9d4acf89e642c2f6978a8f7af3e971f159fa
b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe
b8f2045d7b8c3dbb6c9570d861b0572eccb73e0b1a1eb93f509c472492e38361
c028bc41657b3c6a30a7b7746ee37484c02e725b808a3ef6a333ed156ad3882f
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c3fa0cdab251bde3aa01cd652082ae63fa52b1883b6ee1f48c170959825413de
c75ce78367d99e641567420678abf3731c7bd570cdaa84457d6eebc47f00d76c
c84eae5b234d8595c0318241296fe36e8a29f6f9077176a2b3f1c553b7ef823b
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb
cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cd20ec3a2801d539f721825372d5db085c90a81578bca2457a72301a736cd571
cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb
d15c3e4346002a96d56d907fd660b03ec79e03ebc2a0d2965a54441caa73fe0e
d4ac69976dec9506875b3e321930cb6299cc31f8241dea52e17b6b90623d2dbd
d4c9ffda6ca556f36f402f6d1131a4f3f567505320a9f60151023d4a8bbdb458
d5e95d6adf11e4a630265f96a786ee7278a3bc6244e0d66a89f71fb337f6a73a
d73267e9e376e6d6843fc7b579e87aed300e4b15d9e5344e2dcf751f79d1c89a
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708
df998f2ab79818d229edfab989eb187dd3d94f0f40377fde4f5f97e08b691ecf
dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c
e3afb3ffd03d43181f9bcd35f362e27358e4678267031642b22018276f8e4107
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4ca941570c9b64ef4d24dd0ef8e84e21dd2debd389d504aa1a34025f6d34405
e6b7b898d67eb55d105dd0239a5cd648d22797db648ae4173f25dbf7ecbdfbf1
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632
eca911cde383d98bf0ebfaeae9ffcbf9a217014053c43f8a4206d325f4988a5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba
f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314
f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f
f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28
f49eda72b54bbdfe91695e7741106cbdc4b84fc903616e2e47b1bbf5de8f52fd
f5a5703710663d26cfdf94d6e3223d9a2be8979a603bb96e4779326277a230e3
f5adb3b6debbbee4c4a326c9a32a24c7d6c4a6f99d78a8604bc0d635d1b04f20
fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43
fc0cf5b6bf412f99ba1978aee6505974fa8df6c167cfcf59b006e88d8a270f7b
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fffe17f6fe0ca9bf2e69d087a687c9d2340f67d742a70a810a57ef3c7d17cefe

www.group-ib.com Open in urlscan Pro 3.72.181.255 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

122 Requests

98 %HTTPS

48 %IPv6

23 Domains

38 Subdomains

34 IPs

4 Countries

2160 kBTransfer

5280 kBSize

35 Cookies

22 Outgoing links

Page URL History

Redirected requests

122 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 23 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.group-ib.com Open in urlscan Pro
3.72.181.255 Public Scan

Screenshot
Live screenshot

Full Image

122
Requests

98 %
HTTPS

48 %
IPv6

23
Domains

38
Subdomains

34
IPs

4
Countries

2160 kB
Transfer

5280 kB
Size

35
Cookies

122 HTTP transactions
23 data transactions