Submitted URL: http://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Effective URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Submission: On August 21 via api from DE — Scanned from DE

Summary

This website contacted 60 IPs in 5 countries across 45 domains to perform 159 HTTP transactions. The main IP is 104.26.3.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 245319.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 9th 2023. Valid for: a year.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 34 2620:12a:8001::2 54113 (FASTLY)
22 24 104.26.3.18 13335 (CLOUDFLAR...)
7 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 23.201.248.34 16625 (AKAMAI-AS)
7 104.17.70.206 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:303... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2620:12a:8000::2 54113 (FASTLY)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 4 2a00:1450:400... 15169 (GOOGLE)
1 52.222.139.116 16509 (AMAZON-02)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a04:4e42::396 54113 (FASTLY)
1 151.101.192.65 54113 (FASTLY)
2 104.102.38.132 16625 (AKAMAI-AS)
1 18.154.63.124 16509 (AMAZON-02)
1 162.159.152.17 13335 (CLOUDFLAR...)
2 2600:9000:210... 16509 (AMAZON-02)
1 2600:9000:231... 16509 (AMAZON-02)
1 108.157.1.118 16509 (AMAZON-02)
1 146.75.120.157 54113 (FASTLY)
6 18.193.228.227 16509 (AMAZON-02)
1 2600:9000:231... 16509 (AMAZON-02)
1 151.101.65.140 54113 (FASTLY)
2 13.227.219.71 16509 (AMAZON-02)
6 9 52.215.59.161 16509 (AMAZON-02)
1 5 2a00:1450:400... 15169 (GOOGLE)
1 52.21.20.174 14618 (AMAZON-AES)
1 104.244.42.69 13414 (TWITTER)
2 104.244.42.195 13414 (TWITTER)
1 192.28.144.124 15224 (OMNITURE)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.185.130 15169 (GOOGLE)
1 2 216.58.212.134 15169 (GOOGLE)
1 13.107.42.14 8068 (MICROSOFT...)
1 108.156.60.59 16509 (AMAZON-02)
1 18.158.205.16 16509 (AMAZON-02)
8 2.20.143.57 20940 (AKAMAI-ASN1)
1 3.71.149.231 16509 (AMAZON-02)
1 34.98.64.218 396982 (GOOGLE-CL...)
1 69.173.144.138 26667 (RUBICONPR...)
1 1 172.217.23.98 15169 (GOOGLE)
1 2 185.89.210.82 29990 (ASN-APPNEX)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 52.59.25.18 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 151.101.66.137 54113 (FASTLY)
1 52.223.40.198 16509 (AMAZON-02)
1 162.247.241.14 23467 (NEWRELIC-...)
159 60
Apex Domain
Subdomains
Transfer
66 sentinelone.com
sentinelone.com — Cisco Umbrella Rank: 147746
www.sentinelone.com — Cisco Umbrella Rank: 245319
de.sentinelone.com
go.sentinelone.com
797 KB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6799
c.6sc.co — Cisco Umbrella Rank: 10460
ipv6.6sc.co — Cisco Umbrella Rank: 7094
b.6sc.co — Cisco Umbrella Rank: 4579
17 KB
9 prfct.co
pixel-geo.prfct.co — Cisco Umbrella Rank: 20378
4 KB
9 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 122
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
13115870.fls.doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 261
7 KB
8 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 611
26 KB
7 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2706
www.google.com — Cisco Umbrella Rank: 3
adservice.google.com — Cisco Umbrella Rank: 126
1 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 406
114 KB
6 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 3603
11 KB
6 google.de
www.google.de — Cisco Umbrella Rank: 5345
817 B
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 421
www.linkedin.com — Cisco Umbrella Rank: 686
px4.ads.linkedin.com — Cisco Umbrella Rank: 6363
5 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 4123
onesignal.com — Cisco Umbrella Rank: 1421
img.onesignal.com — Cisco Umbrella Rank: 7659
85 KB
6 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 76
491 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 412
13 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 62
83 KB
4 gstatic.com
fonts.gstatic.com
79 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 991
script.hotjar.com — Cisco Umbrella Rank: 1166
62 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 55891
e.calibermind.com — Cisco Umbrella Rank: 55110
60 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 11450
575 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 542
2 KB
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 87
67 KB
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 949
820 B
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1743
insight.adsrvr.org — Cisco Umbrella Rank: 749
3 KB
2 abrankings.com
cdn.abrankings.com — Cisco Umbrella Rank: 77243
8 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 10692
q.quora.com — Cisco Umbrella Rank: 4586
15 KB
2 brightfunnel.com
munchkin.brightfunnel.com — Cisco Umbrella Rank: 57022
api.brightfunnel.com — Cisco Umbrella Rank: 62000
7 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 4367
6 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 320
468 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 388
239 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 605
273 B
1 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 356
125 B
1 clearbit.com
ga.clearbit.com — Cisco Umbrella Rank: 69708
1 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 157
2 KB
1 mktoresp.com
327-mnm-087.mktoresp.com
318 B
1 t.co
t.co — Cisco Umbrella Rank: 631
376 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1702
637 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1154
378 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 978
15 KB
1 clickcease.com
www.clickcease.com — Cisco Umbrella Rank: 12365
54 KB
1 marinsm.com
tag.marinsm.com — Cisco Umbrella Rank: 49936
4 KB
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1500
8 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1072
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 785
315 B
1 typography.com
cloud.typography.com — Cisco Umbrella Rank: 8656
445 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 73
1 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1419
48 KB
159 45
Domain Requested by
33 de.sentinelone.com 2 redirects www.sentinelone.com
de.sentinelone.com
24 www.sentinelone.com 22 redirects www.sentinelone.com
9 pixel-geo.prfct.co 6 redirects www.sentinelone.com
8 js-agent.newrelic.com www.sentinelone.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
7 cdn.cookielaw.org www.sentinelone.com
cdn.cookielaw.org
6 b.6sc.co www.sentinelone.com
6 tags.srv.stackadapt.com www.sentinelone.com
tags.srv.stackadapt.com
munchkin.brightfunnel.com
6 www.google.de www.sentinelone.com
6 www.googletagmanager.com www.sentinelone.com
www.googleoptimize.com
www.googletagmanager.com
5 www.google.com 1 redirects www.sentinelone.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.sentinelone.com
4 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.sentinelone.com
4 px.ads.linkedin.com 3 redirects www.sentinelone.com
4 fonts.gstatic.com fonts.googleapis.com
3 onesignal.com cdn.onesignal.com
2 epsilon.6sense.com munchkin.brightfunnel.com
2 secure.adnxs.com 1 redirects www.sentinelone.com
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 analytics.twitter.com www.sentinelone.com
2 script.hotjar.com static.hotjar.com
script.hotjar.com
2 cdn.abrankings.com www.googletagmanager.com
munchkin.brightfunnel.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
2 cdn.calibermind.com www.sentinelone.com
2 sentinelone.com 2 redirects
1 bam.nr-data.net munchkin.brightfunnel.com
1 insight.adsrvr.org js.adsrvr.org
1 img.onesignal.com www.sentinelone.com
1 adservice.google.com 13115870.fls.doubleclick.net
1 ipv6.6sc.co munchkin.brightfunnel.com
1 c.6sc.co munchkin.brightfunnel.com
1 cm.g.doubleclick.net 1 redirects
1 pixel.rubiconproject.com www.sentinelone.com
1 us-u.openx.net www.sentinelone.com
1 ups.analytics.yahoo.com www.sentinelone.com
1 j.6sc.co www.sentinelone.com
1 ga.clearbit.com www.googletagmanager.com
1 api.brightfunnel.com munchkin.brightfunnel.com
1 px4.ads.linkedin.com www.sentinelone.com
1 www.linkedin.com 1 redirects
1 www.googleadservices.com www.googletagmanager.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 t.co www.sentinelone.com
1 q.quora.com www.sentinelone.com
1 alb.reddit.com www.sentinelone.com
1 cdn.linkedin.oribi.io snap.licdn.com
1 static.ads-twitter.com www.sentinelone.com
1 js.adsrvr.org www.googletagmanager.com
1 www.clickcease.com www.sentinelone.com
1 a.quora.com www.sentinelone.com
1 munchkin.brightfunnel.com www.sentinelone.com
1 tag.marinsm.com www.sentinelone.com
1 www.redditstatic.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 e.calibermind.com cdn.calibermind.com
1 snap.licdn.com www.sentinelone.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cloud.typography.com 1 redirects
1 fonts.googleapis.com www.sentinelone.com
1 www.googleoptimize.com www.sentinelone.com
159 65
Subject Issuer Validity Valid
sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-09 -
2024-04-08
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
go.sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-22 -
2024-04-21
a year crt.sh
calibermind.com
E1
2023-06-26 -
2023-09-24
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-03 -
2024-05-02
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
attivonetworks.com
R3
2023-08-08 -
2023-11-06
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2023-06-02 -
2023-12-02
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
www.google.de
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01
2023-03-09 -
2024-04-06
a year crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-04-12 -
2023-10-08
6 months crt.sh
tag.marinsm.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-01 -
2024-08-01
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
*.brightfunnel.com
Amazon RSA 2048 M02
2023-02-28 -
2024-02-12
a year crt.sh
quora.com
R3
2023-06-21 -
2023-09-19
3 months crt.sh
cdn.abrankings.com
Amazon RSA 2048 M02
2023-03-19 -
2024-04-16
a year crt.sh
clickcease.com
Amazon RSA 2048 M02
2022-10-27 -
2023-11-25
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M02
2023-02-14 -
2023-11-07
9 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
www.google.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
*.quora.com
R3
2023-08-08 -
2023-11-06
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.google.de
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.google.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
www.googleadservices.com
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2023-07-31 -
2023-10-23
3 months crt.sh
clearbit.com
Amazon RSA 2048 M02
2023-03-17 -
2024-04-14
a year crt.sh
6sc.co
R3
2023-08-19 -
2023-11-17
3 months crt.sh
*.prfct.co
GlobalSign RSA OV SSL CA 2018
2022-10-28 -
2023-11-29
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-11-18 -
2023-12-19
a year crt.sh

This page contains 4 frames:

Primary Page: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Frame ID: 17A18008B153207881E4E77E86F2F6EB
Requests: 158 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: F5CCC2776575E50C49E266786ABA3BFC
Requests: 2 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F
Frame ID: B6FB34462AFB81CBBBCD09FF2B604996
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&upid=jskiafk&upv=1.1.0
Frame ID: 618F9861CE466FD6A63322FA45044011
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector - SentinelOneBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

  1. http://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ HTTP 301
    https://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ HTTP 302
    https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

159
Requests

79 %
HTTPS

46 %
IPv6

45
Domains

65
Subdomains

60
IPs

5
Countries

2116 kB
Transfer

6148 kB
Size

58
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ HTTP 301
    https://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ HTTP 302
    https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818 HTTP 302
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
Request Chain 3
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 HTTP 302
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Request Chain 5
  • https://cloud.typography.com/7197018/6979812/css/fonts.css HTTP 302
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css HTTP 302
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Request Chain 6
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Request Chain 7
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Request Chain 9
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746
Request Chain 11
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Request Chain 12
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Request Chain 13
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Request Chain 14
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Request Chain 15
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Request Chain 16
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Request Chain 17
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
Request Chain 18
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg
Request Chain 20
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
Request Chain 21
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
Request Chain 22
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
Request Chain 24
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11 HTTP 302
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Request Chain 25
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
Request Chain 43
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Request Chain 44
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Request Chain 52
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
Request Chain 53
  • https://www.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
Request Chain 54
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
Request Chain 91
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag HTTP 302
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Request Chain 107
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F
Request Chain 108
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D432890%26conversionId%3D2402852%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQKrFPKIhY_pCAAAAYoYl0Y9YnnyE2EsnfvF1Dci25BJ3FqBqLmW8gj355OnYEEILQ
Request Chain 124
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_Vk9HkAOUjJ1cG4o7N
Request Chain 125
  • https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_Vk9HkAOUjJ1cG4o7N&_origin=1
Request Chain 126
  • https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_Vk9HkAOUjJ1cG4o7N
Request Chain 127
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_Vk9HkAOUjJ1cG4o7N
Request Chain 128
  • https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfVms5SGtBT1VqSjFjRzRvN04 HTTP 302
  • https://pixel-geo.prfct.co/cb?partnerId=goo
Request Chain 130
  • https://secure.adnxs.com/seg?t=2&add=4530935 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Request Chain 132
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&auid=1120668519.1692629681&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=sXrjZOi9BLPo6gSMmbDwDA&sscte=1&crd=&eitems=ChAI8JaMpwYQ4rfw4r3-__gmEh0AHQBIfEWlvHH4du3OM0ds-ELdx5mZzVXTx-zDMA&pscrd=Ek5DaEFJOEphTXB3WVF0ZkxtNVk2TjFlSUlFaVlBNDB1YWh1bGhUcE5PZ0pVaHI2Y0FFMTVhZDlVaEE2MkVlQ0RXaDZxTVl4STd6UjcwWVEaWkNoRUk4SmFNcHdZUWpfMmN6WTd5MjRYWkFSSXVBREtSMkNody11OWhVQXhId3B0am1WZU5pVlVQSmNZa29FUERRMmFIUWpjbjdkNjdZc2UxMTRZd1R4bkhyQSITCKjagfeA7oADFTO0mgodjAwMzg HTTP 302
  • https://www.google.com/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&auid=1120668519.1692629681&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOEphTXB3WVF0ZkxtNVk2TjFlSUlFaVlBNDB1YWh1bGhUcE5PZ0pVaHI2Y0FFMTVhZDlVaEE2MkVlQ0RXaDZxTVl4STd6UjcwWVEaWkNoRUk4SmFNcHdZUWpfMmN6WTd5MjRYWkFSSXVBREtSMkNody11OWhVQXhId3B0am1WZU5pVlVQSmNZa29FUERRMmFIUWpjbjdkNjdZc2UxMTRZd1R4bkhyQSITCKjagfeA7oADFTO0mgodjAwMzg&is_vtc=1&ocp_id=sXrjZOi9BLPo6gSMmbDwDA&cid=CAQSKQBpAlJW80vdhkPbO5dR_GPSLbCK2DwLvd1Be7SU6uQZjEhNCMURc-_t&eitems=ChAI8JaMpwYQ4rfw4r3-__gmEh0AHQBIfJasRvkSBP2bjSzR6Yj6PZjTyntA26SvCQ&random=3109511788 HTTP 302
  • https://www.google.de/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&auid=1120668519.1692629681&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOEphTXB3WVF0ZkxtNVk2TjFlSUlFaVlBNDB1YWh1bGhUcE5PZ0pVaHI2Y0FFMTVhZDlVaEE2MkVlQ0RXaDZxTVl4STd6UjcwWVEaWkNoRUk4SmFNcHdZUWpfMmN6WTd5MjRYWkFSSXVBREtSMkNody11OWhVQXhId3B0am1WZU5pVlVQSmNZa29FUERRMmFIUWpjbjdkNjdZc2UxMTRZd1R4bkhyQSITCKjagfeA7oADFTO0mgodjAwMzg&is_vtc=1&ocp_id=sXrjZOi9BLPo6gSMmbDwDA&cid=CAQSKQBpAlJW80vdhkPbO5dR_GPSLbCK2DwLvd1Be7SU6uQZjEhNCMURc-_t&eitems=ChAI8JaMpwYQ4rfw4r3-__gmEh0AHQBIfJasRvkSBP2bjSzR6Yj6PZjTyntA26SvCQ&random=3109511788&ipr=y

159 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Redirect Chain
  • http://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
  • https://sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
  • https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
111 KB
35 KB
Document
General
Full URL
https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de7fc77fa47baa443846b4f13232d122f4c5b8436d5d359b12b01f8629b0586b
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
7fa3b6662eca906a-FRA
content-encoding
br
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
content-type
text/html; charset=UTF-8
date
Mon, 21 Aug 2023 14:54:39 GMT
expect-ct
enforce; max-age=2592000;
last-modified
Mon, 21 Aug 2023 14:54:19 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/labs/83550>; rel="alternate"; type="application/json", <https://www.sentinelone.com/?p=83550>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Se%2FDu4Zean%2FftJiNIPkyjZORxV9e0TwfNDbW0IjsuwGj3ONnKzh%2FWgsysemG3rSEqSAP2yKeZ7biRVC1E%2FKfI%2BYTskaa7uQZziS8jtAVwBG4lBKwS1eWGnjOLZP1LPXSgCewbPc%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
HIT, HIT, MISS, MISS
x-cache-hits
5, 8, 0, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-b-76757478-2tgr7
x-served-by
cache-chi-kigq8000114-CHI, cache-fra-etou8220094-FRA, cache-fra-eddf8230025-FRA, cache-fra-eddf8230025-FRA
x-styx-req-id
ab36775d-4031-11ee-acaa-2e9072b022ab
x-timer
S1692629679.091133,VS0,VE4
x-xss-protection
1; mode=block

Redirect headers

accept-ranges
bytes
age
9
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 21 Aug 2023 14:54:38 GMT
location
https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
server
nginx
strict-transport-security
max-age=31622400; includeSubDomains; preload
vary
Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, HIT, MISS, MISS
x-cache-hits
0, 3, 0, 0
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-tbmwp
x-served-by
cache-chi-kigq8000068-CHI, cache-maa10222-MAA, cache-maa10224-MAA, cache-maa10224-MAA
x-styx-req-id
a1c44629-4032-11ee-bcfc-ca3ae9bad1ed
x-timer
S1692629679.940185,VS0,VE3
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b97b49ee323dbccf9a13f15fa3d93188d01681652d52b1ed40ad00c32dfb0513
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
X1C0PY0lSDg1JSpsyFxfYA==
age
69941
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6837
x-ms-lease-status
unlocked
last-modified
Thu, 17 Aug 2023 19:31:03 GMT
server
cloudflare
etag
0x8DB9F587E9B1B98
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
bef2d7ac-a01e-0054-6b43-d176d4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b666bd5dbbcb-FRA
optimize.js
www.googleoptimize.com/
123 KB
48 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1e05b9ea0b011538c18894c754a623c15fff99f0e6bc4cc641628890c6367a10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48790
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 21 Aug 2023 14:54:39 GMT
classic-themes.min.css
de.sentinelone.com/wp-includes/css/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
291 B
551 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 22, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
324837
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-7w54k
content-length
211
x-served-by
cache-chi-kigq8000094-CHI, cache-maa10248-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629679.258973,VS0,VE3
etag
W/"64de8196-123"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
549d633f-3d3e-11ee-8f0b-d67fb4423af1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:41 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDS4TPmKXDoDgq3%2FSgxsEQoenjq4IbegOUtG66tmsHVDoejbx5cBV2eaVyt13%2B2cFEgMzetnUf%2B7A2TP6DpJ9Z%2BVgb4WxuLvT3WMYmGY1Wrp4%2FPnbfDBHE2agWyxdcUjC8%2FASTk%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
cf-ray
7fa3b6667f27906a-FRA
content-length
0
tp_twitter_plugin.css
de.sentinelone.com/wp-content/plugins/recent-tweets-widget/
Redirect Chain
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
529 B
583 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 22, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
324837
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-xhm6z
content-length
286
x-served-by
cache-chi-klot8100145-CHI, cache-maa10225-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:43 GMT
server
nginx
x-timer
S1692629679.259468,VS0,VE3
etag
W/"64de8193-211"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
549df301-3d3e-11ee-9bbd-92ab6d10cb3c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:41 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NnqaQbIGTUJBsmLHBLw6PYmtPvKvbUy2UEb0fUg5cbHYB%2BIiR4ETnKBttNVPK3VwUDzyZrluMNhUkHF7qRcX0mopZ6uMELtSR3s4s3RXcleUEA%2Ffx%2BfD%2BcmYnLkPAXNDp4SYuaw%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
cf-ray
7fa3b6667f28906a-FRA
content-length
0
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 21 Aug 2023 14:54:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 14:54:39 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 21 Aug 2023 14:54:39 GMT
2EC96BA1F5C4837D6.css
de.sentinelone.com/fonts/804059/
Redirect Chain
  • https://cloud.typography.com/7197018/6979812/css/fonts.css
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
104 KB
80 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 20, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
324704
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-7w54k
content-length
81369
x-served-by
cache-chi-kigq8000044-CHI, cache-maa10221-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:43 GMT
server
nginx
x-timer
S1692629680.931426,VS0,VE3
etag
W/"64de8193-1a12c"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
a4dbc9e3-3d3e-11ee-8f0b-d67fb4423af1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:55 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uG5a7y7PYo5EMPw2epnPJz41kVmVDch4w1E%2F%2BGpAbM%2FVZ5ZzycZQsCJn8RUh1X%2F6WlbFHn%2FKwvu5YXRnxgp6uplTPi58jo%2FDY5Rh5uFwDX2dD8wY3kIjpzze0rVu5lDhQNVmsm0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
cf-ray
7fa3b6674ff3906a-FRA
content-length
0
style.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
768 KB
123 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fc539e86a89fb1ac21634169076646278597f9b74cd5d5ca8aad35a3756e2ba4
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
11, 17, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
9915
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-ht9rw
content-length
125850
x-served-by
cache-chi-kigq8000052-CHI, cache-maa10238-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Mon, 21 Aug 2023 12:09:08 GMT
server
nginx
x-timer
S1692629679.259513,VS0,VE3
etag
W/"64e353e4-bfee5"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
9106a20e-401b-11ee-ab0f-7e4d7b1af4e2
cache-control
max-age=31622400
accept-ranges
bytes
expires
Wed, 21 Aug 2024 12:09:23 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QDLkkhii5I3F8tTtFj5tj%2BltfwEuu82t1Uiuj8Lo%2FFeAOsvhQcaeqUAIH46TYl%2BS7Luprfqpv1L5hQ2MYYjzn5tL%2BhxykJ12lL3J5sH1DJsSxxrEj4P3tJk9RTckpGw64VZO5Ho%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
cf-ray
7fa3b6667f29906a-FRA
content-length
0
jquery-3.5.1.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
87 KB
36 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 23, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
324837
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-7w54k
content-length
36067
x-served-by
cache-chi-kigq8000085-CHI, cache-maa10236-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:45 GMT
server
nginx
x-timer
S1692629679.259455,VS0,VE3
etag
W/"64de8195-15d84"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
549de3a0-3d3e-11ee-8f0b-d67fb4423af1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:41 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=peJoccPyXx7fdrQLlQO92ho3Is0HNbQ1PINiK1AR%2BdCNezP%2F9p4WiuiaT9UYM5vtqcldAeKnr9HUEb5GD%2BkAuzKE5bqVARSRkjlsHw%2B7IipemMhjGmh0%2Bz%2BOWTC2KayT0yd7DEU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
cf-ray
7fa3b6667f2a906a-FRA
content-length
0
forms2.min.js
go.sentinelone.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
4076
etag
"c807f5-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7fa3b666bdbf9142-FRA
expires
Mon, 21 Aug 2023 18:54:39 GMT
header.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746
164 KB
52 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0da08befe5a68eec43e1e5598ae8f09c574234a20c164c52c16ed0938712ca5e
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
3, 15, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:39 GMT
age
9577
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-tbmwp
content-length
52657
x-served-by
cache-chi-kigq8000137-CHI, cache-maa10223-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Mon, 21 Aug 2023 12:09:31 GMT
server
nginx
x-timer
S1692629679.259705,VS0,VE3
etag
W/"64e353fb-2903b"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
5a8df50b-401c-11ee-bcfc-ca3ae9bad1ed
cache-control
max-age=31622400
accept-ranges
bytes
expires
Wed, 21 Aug 2024 12:15:01 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOyQBFPKLnU8Ma7lTX%2B%2BkAhNYAfXTUGi%2BpK9sd9hax04r34DhVzxhCNpcnvk7Pggx7sY4rrm2g2yN0vK4xCyECr9%2BhdRgTDLufFyzdu%2FKKl1G8Xjn6qF3YlHwW0dTteU3zLaTRU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1692619746
cf-ray
7fa3b6667f2c906a-FRA
content-length
0
js
www.googletagmanager.com/gtag/
264 KB
87 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1fbe7203318a179068ef1d35f4e5bc2d7583b1c046dcda8e84159a528468f060
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88903
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 21 Aug 2023 14:54:40 GMT
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
681 B
737 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 1, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324748
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-mz8rt
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-maa10224-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:45 GMT
server
nginx
x-timer
S1692629680.474000,VS0,VE3
etag
W/"64de8195-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8ac49862-3d3e-11ee-9c5c-c2904b3aa328
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3zuv0dki1fS698ryY1k%2BSZTDp%2BTM863MuHGgO5lUHLudKEBi93KGeQyQH87%2F36y3ySPN3dVvv2HHMCiLacyRUkUfClKXeWKAEORdrIzIs5CEb20tlkJfiaJ%2Bb0c4GnnfCZYqmeg%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
cf-ray
7fa3b66d2ed4906a-FRA
content-length
0
search-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
681 B
613 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 89, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324748
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-xhm6z
content-length
385
x-served-by
cache-chi-klot8100085-CHI, cache-maa10242-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629680.474034,VS0,VE3
etag
W/"64de8196-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8aca7327-3d3e-11ee-9bbd-92ab6d10cb3c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2tzu2aRGNA6gbmp6S828%2F%2F2VfZ9Fh%2BE%2Fq3LdLU1vx8CkX7oSPYca9Cwhy7KcNdw7wPRbrCiAxa5mB%2F%2FjfJ8S1zYdG7UZev31dAuYJWbK9AJalvkPVEpd%2BNiAk6XiVL%2FprQXsyhU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
cf-ray
7fa3b66d2ed6906a-FRA
content-length
0
navigation-close.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
667 B
648 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 107, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324748
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-gxfl5
content-length
339
x-served-by
cache-chi-klot8100133-CHI, cache-maa10222-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629680.473917,VS0,VE3
etag
W/"64de8196-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8adde182-3d3e-11ee-825f-9249a20a9991
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yi%2BCpiuZ3UEXj44ow%2FZDYS1FEGr8X0q9vSLtO4Z88lvwlHNGaaSi4qsx%2FrO%2BmzvxcOWK4K12899HH9cHfv0ReSc0SCGFUZj9wD2PEFkoGVd4MEZx1cgz1GScVaeZn2K3zP7wLmo%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
cf-ray
7fa3b66d2ed7906a-FRA
content-length
0
navigation-close-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
667 B
640 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 22, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324748
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-gxfl5
content-length
339
x-served-by
cache-chi-kigq8000142-CHI, cache-maa10242-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:44 GMT
server
nginx
x-timer
S1692629680.473879,VS0,VE3
etag
W/"64de8194-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8ae3d477-3d3e-11ee-825f-9249a20a9991
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1jrhIGhzkNBvfGjE%2B3HTdtw3i34HpK%2BBYcl1yr7QLkApsG5Ixxl1O921eS%2B7ImiXm5HyrhOcAaT8Hvy2lT2hwzJacXvN9DZ8LjL%2BmXdLDGjw12rLFbSZxuVcb0CWf4zqi3T4mr0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
cf-ray
7fa3b66d2ed8906a-FRA
content-length
0
SentinelLabs_Logo_RGB_WhitePurp.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
2 KB
3 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
0, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
413213
x-cache
MISS, MISS, HIT, MISS
fastly-io-info
ifsz=5631 idim=566x102 ifmt=png ofsz=2400 odim=566x102 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-76757478-mz8rt
fastly-stats
io=1
content-length
2400
x-served-by
cache-chi-klot8100088-CHI, cache-maa10227-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.489768,VS0,VE2
etag
"RQu1dwEJtFWeuwfGEHe2Efz1p35b1Asg8OLjSirVS3k"
vary
Accept
content-type
image/webp
x-styx-req-id
91c8f6eb-3c70-11ee-9c5c-c2904b3aa328
cache-control
max-age=31622400
accept-ranges
bytes
expires
Fri, 16 Aug 2024 20:07:47 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e7cyNxkc0unv4wUxyjJB0ig27o1EpDb3GLSrIYWRmrb8l1gi8XnmnrHFw%2BUFGbwB4EemDXGBi8FbwoJ57PNPDRlxNIRanwW3UnKYQ95DI5JpBkGKIUV4A7umJ2PXLiKhgbxIxoI%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
cf-ray
7fa3b66d2eda906a-FRA
content-length
0
navigation-arrow-left.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
566 B
504 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 22, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324747
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-gxfl5
content-length
326
x-served-by
cache-chi-kigq8000162-CHI, cache-maa10222-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:44 GMT
server
nginx
x-timer
S1692629680.473982,VS0,VE3
etag
W/"64de8194-236"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8b15a443-3d3e-11ee-825f-9249a20a9991
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7fI5c3xtsyn1XgOQNlTk05N%2B71nAsU1%2FBrXNEQ2oOmJnw%2BwhI9xYyjgT0Uyd9j47gmSkjLc%2FAgUTVUIsdc1fuPfLs33LTWJ3Njvg5pJVtCTo%2BpXPmhyVuWDtLY9vqDBB4muzsRI%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
cf-ray
7fa3b66d3edb906a-FRA
content-length
0
Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
106 KB
106 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4ade995b30f0f423c698fd2e0a5f267a915afc89eb5706123646c97dd2d1d6cd
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
294587
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=560103 idim=1200x628 ifmt=jpeg ofsz=108390 odim=1200x628 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-7w54k
fastly-stats
io=1
content-length
108390
x-served-by
cache-chi-klot8100101-CHI, cache-maa10248-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.473977,VS0,VE2
etag
"4wmePkUuwl0RL8trCdaw8d+X1cSV7HQDvlDJv2TG63s"
vary
Accept
content-type
image/webp
x-styx-req-id
37b53151-3ce6-11ee-8f0b-d67fb4423af1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 10:09:56 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2B7YbKWnADSF%2BOV6FVDTHDCHvHfqNw95%2B6sDQwdronP2G1MrfbyiPfyse8lBYoiUj43igWOhT19WA1oKkio51lStqP7vifHSbMq2tU4TXhSTcccALHPKO%2BGUR%2BK489N5Zi82NyQ%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/Chinese-Entanglement-DLL-Hijacking-in-the-Asian-Gambling-Sector-By-Aleksandar-Milenkoski-and-Tom-Hegel-5.jpg
cf-ray
7fa3b66d3edd906a-FRA
content-length
0
ChinaEntangled_2.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg
11 KB
11 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
97e1df3e3c73e853a22806274887388de2becb5c7dcac68180a219d891e160e0
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
294588
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=23251 idim=363x275 ifmt=jpeg ofsz=11106 odim=363x275 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-76757478-2tgr7
fastly-stats
io=1
content-length
11106
x-served-by
cache-chi-kigq8000089-CHI, cache-maa10249-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.473946,VS0,VE2
etag
"JY+aA+ERWWbJf52qeU3wLOiuI4Oxszp8uGrMEveccww"
vary
Accept
content-type
image/webp
x-styx-req-id
c38df15e-3d84-11ee-a07d-2e9072b022ab
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sun, 18 Aug 2024 05:04:52 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDQAjOeYixyA0s9Ya2tNAxkfW%2BD4lKBA6LXC4Ds%2FZC2%2B4uUZHXMtRVfD7epiKpKkLtn7kxjKKMnTyTwOxREwKiHmPuh8%2FYUktL8zeiZNK3%2Bmg0%2FWXnfJ1NAUJ9gLwVZgGL5CTHA%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/ChinaEntangled_2.jpg
cf-ray
7fa3b66d3ede906a-FRA
content-length
0
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Thu, 17 Aug 2023 10:58:09 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
gzip
etag
W/"64ddfd41-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CBRUH5NwM4yXcYzU01PAjvO5mxSFGOV8KOmAJaYZsVw15F%2FyBpfR81GVQfUkTpqjW7ZESrQKVQaNxnJXQTxX%2FzoA9p6wwOPIKW8Ce54SibNYtoS1LSmpBO8RBR8%2FfhyS6cHyWSU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7fa3b66b9ce4906a-FRA
expires
Wed, 23 Aug 2023 14:54:39 GMT
Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
6 KB
6 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4486d08e581da7eb5267ca780ae7f6e28fe84082d7aa07ed0f1ef029c1b8aca4
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
294588
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=8978 idim=300x157 ifmt=jpeg ofsz=5652 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-67d675c8c9-l8swk
fastly-stats
io=1
content-length
5652
x-served-by
cache-chi-kigq8000053-CHI, cache-maa10250-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.473929,VS0,VE2
etag
"Q3iiDIcPmnOJIFhg8KBaOJiNIsMIqzS0RpMbpCZlfuE"
vary
Accept
content-type
image/webp
x-styx-req-id
d651a278-3ab5-11ee-9b1c-2ae590a16ca5
cache-control
max-age=31622400
accept-ranges
bytes
expires
Wed, 14 Aug 2024 15:18:35 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cgTSS7LWX59OSfkARcjRbTRAhdb1%2FPxoXC1V1N2raqajdI8X0u1elK8MAzBvGCWWI6p3Y4V4Cb44Wq8nP2XzS%2B41Rwl1PUPOcMv76juy0HnW5slmNWcYd2NixVQEQqyum7Z7bAE%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-300x157.jpg
cf-ray
7fa3b66d3ee0906a-FRA
content-length
0
Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
4 KB
4 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
47f08226ea71e159d8f9563f3041ac93e5699aa89031e3d071b05d5975ac8780
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
971904
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=5639 idim=300x157 ifmt=jpeg ofsz=4062 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-88d69667f-ltbw6
fastly-stats
io=1
content-length
4062
x-served-by
cache-chi-kigq8000171-CHI, cache-maa10248-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.473844,VS0,VE2
etag
"t3R3LRvvsAjVR0RYcsq45ET59ncxEgyyZpY/iXYr7FM"
vary
Accept
content-type
image/webp
x-styx-req-id
998435c8-2c6a-11ee-bd1f-12d24d393e12
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 27 Jul 2024 10:44:44 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VrlkmgpjRpIb5mqFEpTgGZ6fzC1JPZw93B6YqN6vTnIXyRzZRhZCqIUXJ%2B7TTmeIvqdN4ZxH2CeWOSCI70V94y5ha03z1zcFqE87qrRsF2CFbQqYcDBhTqJreowyJZmdLRNnjbk%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Operation-Magalenha-Long-Running-Campaign-Pursues-Portuguese-Credentials-and-PII-3-300x157.jpg
cf-ray
7fa3b66d4ef2906a-FRA
content-length
0
Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
7 KB
7 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
13b3e0774f34feff8af39c43e1466a1482b52a35fe32ce1e7a7b0fe85385e34e
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
971904
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=8450 idim=300x157 ifmt=jpeg ofsz=6716 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-5859bc6cc-9q9pt
fastly-stats
io=1
content-length
6716
x-served-by
cache-chi-kigq8000122-CHI, cache-maa10241-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.473891,VS0,VE3
etag
"yevqGUz+o/LkrjFjNnoWLSLTA4gLK4KJ3z4G7FuQXbA"
vary
Accept
content-type
image/webp
x-styx-req-id
af7d32b7-2bd6-11ee-a294-cac4da3d5372
cache-control
max-age=31622400
accept-ranges
bytes
expires
Fri, 26 Jul 2024 17:05:56 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RCjTuN5rt0CJq5RwhfAE96onPl%2FscC2xheOmCBE3xo8aHSgmQAvZwCbqFLmhTj9FpJKorljBFnftUXHkM4cTXLOl08C7eTjZV8WltskAAAJ5QT6wAsE0Iy72EtuZ35w61UZToUw%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Ongoing-Campaign-Using-Tailored-Reconnaissance-Toolkit-1-300x157.jpg
cf-ray
7fa3b66d4ef3906a-FRA
content-length
0
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
1 KB
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
38128
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 30 Jun 2023 17:07:12 GMT
server
cloudflare
etag
W/"649f0bc0-346"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GT8SkjVwJ%2BU2p1%2BSQfjpZRNDr%2B2PN2uACVTipyLbHk2KqBubIJKJjqece5EmA%2BlobL9Y6OyJRjbsbyv8D9n3HNWHvfm4qLPQomMjHYHqKJj0L%2BL0m%2FihkQekO%2F4FigEsKaxQ2DpAd5tIlqHto5dPjyfQ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7fa3b66bc8ad91ea-FRA
clipboard.min.js
de.sentinelone.com/wp-includes/js/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
9 KB
4 KB
Script
General
Full URL
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 15, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324838
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-ht9rw
content-length
3466
x-served-by
cache-chi-klot8100072-CHI, cache-maa10244-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:47 GMT
server
nginx
x-timer
S1692629680.172454,VS0,VE11
etag
W/"64de8197-2331"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
54c5e375-3d3e-11ee-924d-7e4d7b1af4e2
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:41 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R6TNbRVUNP1%2FxCmBRkQQn92J8j3SSnCt1SPXpIDss39JyFrMoyJQRlO5TIZgTIRdAy9uzGtWwL%2BuzDJPLuD65kF%2BbgVYBDikRza439p%2B%2FOdqLtPrcY6hHOur9KR6iisPh4DZ6TM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
cf-ray
7fa3b66c2dd1906a-FRA
content-length
0
footer.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
127 KB
49 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
1f1b053798feca0d6310c9f463fa883f374d4ad73d5cc54e4d1160762a87ca96
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
3, 15, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
9578
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-2tgr7
content-length
50152
x-served-by
cache-chi-klot8100073-CHI, cache-maa10228-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Mon, 21 Aug 2023 12:09:05 GMT
server
nginx
x-timer
S1692629680.489758,VS0,VE3
etag
W/"64e353e1-1fc80"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
5ab635f4-401c-11ee-acaa-2e9072b022ab
cache-control
max-age=31622400
accept-ranges
bytes
expires
Wed, 21 Aug 2024 12:15:02 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MNJKI1MvbMLrsUJdKU5kE7UYG2gpIO5Zpn%2F%2FlHcsdLysa%2FSfyAcCiROulpRgM90%2B8xA0%2Fo%2FAuJQ9Wyxh%2BheSXFhArnSCSxUuUZ5TopSHpB7p63oh7S2ed2kTxP9ByuzGqFC0tzg%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
cf-ray
7fa3b66cee9d906a-FRA
content-length
0
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=12c9789c4528a9431963b4b52733d818
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
977
etag
W/"2a3bbde818bef34d53a0df862ead5d5f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7fa3b66de9105b80-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Thu, 24 Aug 2023 14:54:40 GMT
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
53557
content-md5
CqPSDQgRayZT5/dw1EENjQ==
content-length
1450
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:19 GMT
server
cloudflare
etag
0x8D97490BA2F1567
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2e907f89-801e-00a2-5be1-5a157a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b6671a383801-FRA
expires
Tue, 22 Aug 2023 14:54:39 GMT
a.js
cdn.calibermind.com/
213 KB
59 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
69574
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 30 Jun 2023 17:05:30 GMT
server
cloudflare
etag
W/"649f0b5a-354c2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2iPi8zhoanw7uLp1q5x75MeDlRuaThcchs7VVfqCHlE7xqbijjsqlD9AO2p%2FOQF2k%2BF3PKRQNOL35v4Q96xoRNjm3YZn3HQUCn2%2BF8HulXpCaOs5HXhMRq1WPtMpvAEPb1clEMsntpNpoSLHJFFOWhh%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7fa3b66d3ac191ea-FRA
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
68 B
315 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7fa3b6679e1d39bc-FRA
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.23.0/
312 KB
75 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
joMckLq8BtEunD8NH/4XVA==
age
37917
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
76366
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:58 GMT
server
cloudflare
etag
0x8D96DBF6CBEE741
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
90828af6-301e-00d6-58e1-5a933c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b66d3f30bbcb-FRA
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Fri, 18 Aug 2023 19:45:16 GMT
x-content-type-options
nosniff
age
241764
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19156
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 17 Aug 2024 19:45:16 GMT
js
www.googletagmanager.com/gtag/
264 KB
87 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP&l=dataLayer&cx=c
Requested by
Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4181a6741fbec0d7ef8536ac03badf16c41425821bc0355ca7800762e1a397b1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88808
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 21 Aug 2023 14:54:40 GMT
gtm.js
www.googletagmanager.com/
422 KB
112 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
183ee96c78d9aeae323ed8ff9630ffc5e2844227835f3e67bae5e9cf59aa575f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
114293
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 21 Aug 2023 14:54:40 GMT
labs-bg-light.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
34 KB
35 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/labs-bg-light.png
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc079836abe496d8cc3a3e2b5ec355195b2dc1cde665b6d1ea5996e04b930720
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
0, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
971905
x-cache
MISS, MISS, HIT, MISS
fastly-io-info
ifsz=77240 idim=700x951 ifmt=png ofsz=35184 odim=700x951 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-67d675c8c9-m4dk8
fastly-stats
io=1
content-length
35184
x-served-by
cache-chi-kigq8000105-CHI, cache-maa10244-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.291317,VS0,VE2
etag
"7BFksq8xo9eP/64Th905/zC34utiEyPMz7xERifVFYY"
vary
Accept
content-type
image/webp
x-styx-req-id
c2a9e476-375b-11ee-8ddd-268ed9a77419
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 10 Aug 2024 08:56:14 GMT
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&callback=jQuery1124017390680042616213_1692629680162&_=1692629680163
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
600da3183186c36f50236d2b9cc068d89fcc2ff470d4f902cab50266e60d1329

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7fa3b66d3f4b9142-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&callback=jQuery1124017390680042616213_1692629680164&_=1692629680165
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40f2b6111afe27cb0aec9f1c1823de48d5a4742795db1afea78137af18bdc598

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7fa3b66d3f509142-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
user-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
1 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/user-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 16, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324704
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-xs284
content-length
775
x-served-by
cache-chi-kigq8000178-CHI, cache-maa10226-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629680.300106,VS0,VE3
etag
W/"64de8196-556"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
a5395057-3d3e-11ee-bc01-72c0436b5917
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:56 GMT
calendar-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 16, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324704
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-xhm6z
content-length
847
x-served-by
cache-chi-klot8100128-CHI, cache-maa10236-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:44 GMT
server
nginx
x-timer
S1692629680.300453,VS0,VE3
etag
W/"64de8194-7ae"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
a53b09e7-3d3e-11ee-9bbd-92ab6d10cb3c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:56 GMT
arrow-left-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
835 B
666 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-left-dark.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 16, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324703
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-xs284
content-length
489
x-served-by
cache-chi-klot8100114-CHI, cache-maa10228-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:44 GMT
server
nginx
x-timer
S1692629680.301458,VS0,VE3
etag
W/"64de8194-343"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
a5558b64-3d3e-11ee-bc01-72c0436b5917
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:56 GMT
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
639 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 22, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324747
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-mz8rt
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-maa10222-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:45 GMT
server
nginx
x-timer
S1692629680.301971,VS0,VE3
etag
W/"64de8195-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
8ac49862-3d3e-11ee-9c5c-c2904b3aa328
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:12 GMT
calendar-icon-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
2, 16, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324703
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-xs284
content-length
842
x-served-by
cache-chi-klot8100021-CHI, cache-maa10227-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:44 GMT
server
nginx
x-timer
S1692629680.303161,VS0,VE3
etag
W/"64de8194-798"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
a56cafaa-3d3e-11ee-bc01-72c0436b5917
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:42:56 GMT
social-twitter-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
3, 23, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:41 GMT
age
324844
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-76757478-gxfl5
content-length
1036
x-served-by
cache-chi-kigq8000162-CHI, cache-maa10229-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629681.087102,VS0,VE3
etag
W/"64de8196-7e1"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
521b0e8c-3d3e-11ee-825f-9249a20a9991
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:36 GMT

Redirect headers

x-cache-hits
2, 21, 0, 0
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://tags.srv.stackadapt.com/ https://qvdt3feo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=15768000; includeSubDomains;, max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Mon, 21 Aug 2023 14:54:40 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age
1185
x-redirect-by
WordPress
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-xhm6z
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100133-CHI, cache-maa10227-MAA, cache-maa10224-MAA, cache-maa10224-MAA
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1692629681.541317,VS0,VE3
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
x-styx-req-id
e55eec04-402f-11ee-bb96-92ab6d10cb3c
cache-control
max-age=3600
accept-ranges
bytes
expires
Mon, 21 Aug 2023 15:34:55 GMT
social-linkedin-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
4, 117, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:41 GMT
age
324844
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-tbmwp
content-length
993
x-served-by
cache-chi-klot8100083-CHI, cache-maa10236-MAA, cache-maa10224-MAA, cache-maa10224-MAA
last-modified
Thu, 17 Aug 2023 20:22:46 GMT
server
nginx
x-timer
S1692629681.165263,VS0,VE3
etag
W/"64de8196-90f"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
521f55b3-3d3e-11ee-9736-ca3ae9bad1ed
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:37 GMT

Redirect headers

x-cache-hits
2, 1, 0, 0
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://tags.srv.stackadapt.com/ https://qvdt3feo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=15768000; includeSubDomains;, max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Mon, 21 Aug 2023 14:54:40 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age
1165
x-redirect-by
WordPress
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-ht9rw
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100131-CHI, cache-maa10222-MAA, cache-maa10224-MAA, cache-maa10224-MAA
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1692629681.541565,VS0,VE4
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
x-styx-req-id
e55e213c-402f-11ee-bc81-7e4d7b1af4e2
cache-control
max-age=3600
accept-ranges
bytes
expires
Mon, 21 Aug 2023 15:35:14 GMT
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Sat, 19 Aug 2023 05:15:35 GMT
x-content-type-options
nosniff
age
207545
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19440
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:08:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 18 Aug 2024 05:15:35 GMT
zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Fri, 18 Aug 2023 07:23:50 GMT
x-content-type-options
nosniff
age
286250
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20352
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 17 Aug 2024 07:23:50 GMT
zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Fri, 18 Aug 2023 09:03:14 GMT
x-content-type-options
nosniff
age
280286
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20880
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:19:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 17 Aug 2024 09:03:14 GMT
Socicon.woff2
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/
63 KB
64 KB
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/Socicon.woff2?87visu
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1692619745
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
5, 57, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
324835
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-85758c8d7d-7w54k
content-length
64512
x-served-by
cache-chi-klot8100177-CHI, cache-maa10242-MAA, cache-maa10226-MAA, cache-maa10226-MAA
last-modified
Thu, 17 Aug 2023 20:22:45 GMT
server
nginx
x-timer
S1692629681.720528,VS0,VE4
etag
"64de8195-fc00"
content-type
font/woff2
access-control-allow-origin
*
x-styx-req-id
56cac0e6-3d3e-11ee-8f0b-d67fb4423af1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 17 Aug 2024 20:40:44 GMT
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/08/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
3 KB
4 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c3419ffe314cfed42ed710bdc1771a7a8484d251bcd9b0102b7a621a71ddae7b
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
960894
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=5848 idim=150x150 ifmt=jpeg ofsz=3302 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-67d675c8c9-vsfbz
fastly-stats
io=1
content-length
3302
x-served-by
cache-chi-klot8100175-CHI, cache-maa10244-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.489673,VS0,VE2
etag
"ll0YozTrxaYeh6tzyAEciXepTQ3QIkMFtMlpWYPhikQ"
vary
Accept
content-type
image/webp
x-styx-req-id
739e2851-35cc-11ee-b636-0eb1793e9279
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 08 Aug 2024 09:17:52 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2FLnK%2BUk%2FX9OzXdOzGlC50lkOsiRC7EABWRogFHIBNudAk%2BkfiiHrx%2FuKsAn%2FyECYZfqAbDzoqo08hfNnTEF4yqTGJpOR6q%2F%2FudU%2B2Imqi0pL46e%2B8%2BwJZrM4DdyqSif8oA14%2FM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/08/Comrades-in-Arms-North-Korea-Compromises-Sanctioned-Russian-Missile-Engineering-Company-1-150x150.jpg
cf-ray
7fa3b66daf70906a-FRA
content-length
0
JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/07/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
3 KB
4 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2ab39f322f7eb5915eb0576dd13d924eef4edbd67b24bf1a899b80ff27a9aef3
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 1, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
413195
x-cache
HIT, HIT, HIT, MISS
fastly-io-info
ifsz=4608 idim=150x150 ifmt=jpeg ofsz=3480 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-88d69667f-f6r7g
fastly-stats
io=1
content-length
3480
x-served-by
cache-chi-klot8100058-CHI, cache-maa10231-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.489701,VS0,VE2
etag
"tjlgLtTJVBSNc3ek43T4n9RR44Ob4Yp8CtH5k2Lw93U"
vary
Accept
content-type
image/webp
x-styx-req-id
9a6b4e48-2c6a-11ee-a9b4-8667725c9140
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 27 Jul 2024 10:44:46 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=18u38ksWGTiCJ6jTkSAS06LlH0C%2Frl7LbnWKb60UjaaOGj2pdt33aHMJyKYYSG4RLaD6GXnuUDIDrs1UGzwrHTfqfg769GDIxHi%2BLBJ6W3vSskyZ6uegqIOiE60EspOURCDOHZs%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/07/JumpCloud-Intrusion-Attacker-Infrastructure-Links-Compromise-to-North-Korean-APT-Activity-5-150x150.jpg
cf-ray
7fa3b66daf72906a-FRA
content-length
0
Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/07/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
2 KB
3 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6216aa13cd1b94fff9633dcf5b41edfa3bc8fca74ad6472ff286604c3d6875f9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-cache-hits
1, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 21 Aug 2023 14:54:40 GMT
age
413195
x-cache
HIT, MISS, HIT, MISS
fastly-io-info
ifsz=3282 idim=150x150 ifmt=jpeg ofsz=2250 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-5b96c454df-scvhs
fastly-stats
io=1
content-length
2250
x-served-by
cache-chi-kigq8000155-CHI, cache-maa10227-MAA, cache-maa10224-MAA, cache-maa10224-MAA
server
nginx
x-timer
S1692629680.489640,VS0,VE2
etag
"wYMsfhFnad6Yx0EhU4hlZadZ65gkn2WxAGnqgjTthvU"
vary
Accept
content-type
image/webp
x-styx-req-id
c3970eb0-375b-11ee-8915-2e3887f98703
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 10 Aug 2024 08:56:15 GMT

Redirect headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ugqJ14ZdT6SCh%2BfuOlAHLjeVRl2xd%2Bz1CKmcu264qJ3BpwFGHqMMBPr1EcCc8KSIdMCkTBLDZDhNQGt7CqfWnHhkyonYZL3tLnSkJz6VYzagAiCN4cDZ98ZZpJiaONIqbOptyZ4%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9-150x150.jpg
cf-ray
7fa3b66daf73906a-FRA
content-length
0
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 24 Jul 2023 09:07:54 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=13401
accept-ranges
bytes
content-length
4862
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
1655
etag
"c807ec-3437-60062cdee3780"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7fa3b66e28989142-FRA
content-length
2623
expires
Mon, 21 Aug 2023 18:54:40 GMT
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
334 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
37
etag
"1b6119f-33c-60062cdee3780"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7fa3b66e289a9142-FRA
content-length
246
expires
Mon, 21 Aug 2023 18:54:40 GMT
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/
54 KB
11 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7426
content-md5
g3u/cB4L4tfTQx7Hp+ONEQ==
content-length
11065
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:24 GMT
server
cloudflare
etag
0x8D97490BD2F4CA7
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4b382f98-d01e-0076-2ee1-5a5c5a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b66e7d2e3801-FRA
expires
Tue, 22 Aug 2023 14:54:40 GMT
p
e.calibermind.com/v1/
16 B
633 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-max-age
900
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BFs9Vp6KtBZhc378UJVjrs6TyOMpzZXgT19aIVyALcJpRADcjmrN5JBBXN3MCbTLT5INzKYD%2BZzByXkNhpi0M6MFNfi4O%2FjqWkyetqD7wa2m%2FaeoPFVBzTfk%2Fr1DW2x43kpKhXPbCm%2Ba%2B2bJ4GMs%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
7fa3b66eead218e1-FRA
alt-svc
h3=":443"; ma=86400
access-control-allow-headers
Content-Type,Authorization
content-length
16
x-request-id
6aa18b85-a27f-41a9-8352-501e1d6e6193
collect
px.ads.linkedin.com/
0
534 B
Image
General
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1692629680452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: A142AECC004B4AD4A7AEAA3FF00F7941 Ref B: FRAEDGE1507 Ref C: 2023-08-21T14:54:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYDcA7Yt+m1U+bUEOQPKg==
XDFrame
go.sentinelone.com/index.php/form/ Frame F5CC
2 KB
866 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7fa3b66f29c09142-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 21 Aug 2023 14:54:40 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
collect
region1.analytics.google.com/g/
0
257 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je38g0&_p=1986149958&_gaz=1&cid=320361525.1692629681&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1692629680&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&dt=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
257 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KJPGLC9EVP&cid=320361525.1692629681&gtm=45je38g0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KJPGLC9EVP&cid=320361525.1692629681&gtm=45je38g0&aip=1&z=122142660
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
optimize.js
www.google-analytics.com/gtm/
169 KB
62 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-K9ZDGR4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
683e1a4ccd781d9a04bafed01df0d1a4e267881aa3a093e9938e93218da10dc2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
63236
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 21 Aug 2023 14:54:40 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 21 Aug 2023 13:49:43 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
3897
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 21 Aug 2023 15:49:43 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1692629680619&cv=11&fst=1692629680619&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&auid=1120668519.1692629681&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d97f91a02e6d7c4f3d9273847b0f5bb745b01d00c8b197d7596617c0214f3826
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1386
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
hotjar-2714452.js
static.hotjar.com/c/
10 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.139.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-139-116.ams50.r.cloudfront.net
Software
/
Resource Hash
c7f1813cee6d21853cf382a71c87dc0ccb2ad93be0024b8182e2fd2301f8e5b4
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Mon, 21 Aug 2023 14:54:40 GMT
via
1.1 9bd09ac7aca1ea8ca6c788136a9ce480.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS50-C1
age
5
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/21da7ed8f7b870deb6e77f644ae55e83
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
yf9yM1WbGm6d1Abt_H5l3gWifdeF7acSnVQY-yd6GN9aqU5KdSyvVw==
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 21 Aug 2023 14:54:39 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 69038139EF2B458DA251D885C2FF0D15 Ref B: FRA31EDGE0511 Ref C: 2023-08-21T14:54:40Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
56a667965d8d21035d00000d.js
tag.marinsm.com/serve/
12 KB
4 KB
Script
General
Full URL
https://tag.marinsm.com/serve/56a667965d8d21035d00000d.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.65 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cowboy /
Resource Hash
73cff75f7e45e09826281feedef1e893c733e45db765803c903c40356a3b8b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 14:54:40 GMT
Via
1.1 vegur, 1.1 varnish
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Age
1204
X-Cache
HIT
Connection
keep-alive
Content-Length
3903
X-Served-By
cache-fra-eddf8230061-FRA
Server
Cowboy
X-Timer
S1692629681.701486,VS0,VE1
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
X-Cache-Hits
1
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 14:54:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
bf-munchkin.min.js
munchkin.brightfunnel.com/js/build/
20 KB
7 KB
Script
General
Full URL
https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.154.63.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-154-63-124.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
Via
1.1 78a8034fcf83df7c4d2aee6bd64bdbb0.cloudfront.net (CloudFront)
Date
Mon, 21 Aug 2023 14:52:59 GMT
X-Amz-Cf-Pop
DUS51-P4
Age
112
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 16 Jun 2021 18:10:10 GMT
Server
AmazonS3
ETag
W/"20317c42053d4a6e5ba388544778b12a"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=300
X-Amz-Cf-Id
trQXEGI7o-_P9XBAoYR49X_NUYDkZ8RCOy9ffVEo7I5PIhWmFABxoQ==
qevents.js
a.quora.com/
40 KB
14 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76634f9eb6534a50e98eaff61fad5bdd249a45fd4aef3f401e946662db0fa606

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
x-amz-version-id
DifaqEYzcusgJwHE06s5KE8WgCtSunmm
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
0BX7BNPJJHY36CE8
age
567620
x-amz-server-side-encryption
AES256
alt-svc
h3=":443"; ma=86400
x-amz-id-2
hPN/ojQIAZMscXesyTcU+MUzhNeaqLSzA2Vt14obeYiA0DkkwGfTnSzykTKJvmmAmlHkgg/uF7E=
last-modified
Mon, 14 Aug 2023 22:09:21 GMT
server
cloudflare
x-amz-meta-s3cmd-attrs
md5:caf76eb3858870bfa8acf81920cf577c
etag
W/"caf76eb3858870bfa8acf81920cf577c"
vary
Accept-Encoding
content-type
text/plain
cache-control
public, max-age=14400
cf-ray
7fa3b67099e892b7-FRA
expires
Mon, 21 Aug 2023 18:54:40 GMT
client.js
cdn.abrankings.com/js/
35 KB
8 KB
Script
General
Full URL
https://cdn.abrankings.com/js/client.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:4c00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
public
date
Sat, 15 Jul 2023 00:10:56 GMT
content-encoding
gzip
via
1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jun 2022 17:44:33 GMT
server
nginx/1.20.1
x-amz-cf-pop
AMS1-C1
age
3249824
etag
W/"62a8c901-8d68"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
max-age=15552000, public
x-amz-cf-id
jTSzw7qPX6NMARjNp8-Jx1sWuFbjWcrUqYKwU8SKKfXOuMwi34kWnA==
expires
Thu, 11 Jan 2024 00:10:56 GMT
js
www.googletagmanager.com/gtag/
171 KB
63 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10604934
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c532b2a0fdea6725ff83e644904739f6ff23b90b00d2d615f4f3207eb352f2c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64367
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 21 Aug 2023 14:54:40 GMT
stat.js
www.clickcease.com/monitor/
171 KB
54 KB
Script
General
Full URL
https://www.clickcease.com/monitor/stat.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2315:8800:15:a0d3:77c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
6Er2d0GJvgnFniPQXIH7h8kzG7dJBNJf
content-encoding
gzip
via
1.1 2667cbb82aabb944a65b99430aa06d1a.cloudfront.net (CloudFront)
date
Mon, 21 Aug 2023 14:54:33 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
x-amz-cf-pop
DUS51-P2
age
8
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 22 Nov 2022 11:31:37 GMT
server
AmazonS3
etag
W/"1c27f449b067550681f23ad3e53988fa"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
microphone 'none'; camera 'none';
x-amz-cf-id
SWJVUUUkspKAY8V5FUIy6y7f8BRFS5Baw8rvVgXSgmPanSKBwvaeYA==
up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.157.1.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-1-118.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 06:16:42 GMT
Content-Encoding
gzip
Via
1.1 e4aaaf9d55a242f83ddc793442b0ebe2.cloudfront.net (CloudFront)
Last-Modified
Tue, 01 Aug 2023 20:10:44 GMT
Server
AmazonS3
X-Amz-Cf-Pop
DUS51-P2
Age
31079
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
UZ3Wxi0F3aai5IvqHYifLf41Ph6fBTEWcPaNXZNwHYgpwDXcKxsjnA==
js
www.googletagmanager.com/gtag/
177 KB
65 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
19d7846cc0bfa392e0c43a1c8115e82c38b7d2adc22145f27659b20e74ce0bc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66113
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 21 Aug 2023 14:54:40 GMT
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-etou8220097-FRA
js
www.googletagmanager.com/gtag/
227 KB
78 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dd68674fc557815b81b5c81564778da129293d01b143986415d8357bdecea8e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
79819
x-xss-protection
0
last-modified
Mon, 21 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 21 Aug 2023 14:54:40 GMT
events.js
tags.srv.stackadapt.com/
18 KB
7 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
067b3af0ba8cdc22760f0403dac22c7dce5f0fb1ca99892bf45849a6c7dacc84

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 14:54:40 GMT
cache-control
max-age=5
content-encoding
gzip
content-type
text/javascript
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame F5CC
208 KB
69 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.sentinelone.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
4077
etag
"c807f5-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7fa3b6701b1e9142-FRA
expires
Mon, 21 Aug 2023 18:54:40 GMT
token
cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/
36 B
378 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2315:3e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:17:20 GMT
content-encoding
gzip
via
1.1 374989d04bb9f7efef831637d8f4b234.cloudfront.net (CloudFront)
x-amz-cf-pop
DUS51-P2
age
2240
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
SMy0TowPHTe6hiCYwNIZkg-8gqgaU7uF3Xz7Y8JgHuXFGlxyzHPBPA==
otFlat.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
r7t3xbAZ3QK/7lQuu5X7ww==
age
77878
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2950
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:51 GMT
server
cloudflare
etag
0x8D96DBF68EC8D5B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0e75d206-d01e-00b1-14e1-5a209b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b6706fe83801-FRA
otPcPanel.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/
47 KB
11 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
57AUyP21eMxOiwzpGGh99A==
age
53557
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11457
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:53 GMT
server
cloudflare
etag
0x8D96DBF6A0C163B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
526a64c6-301e-007c-14e1-5a45d3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7fa3b6706fea3801-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
20 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bada , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Ye6OeZcNyuFoWog7CYs00A==
age
77878
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:12:05 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
960abd06-f01e-0180-53e1-5a3d19000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7fa3b6706feb3801-FRA
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1692629680731&id=undefined&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=4dcc5d35-19ad-4f3f-b844-faa6ca5c3603&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
modules.b2c67271bc39c80bf49b.js
script.hotjar.com/
223 KB
55 KB
Script
General
Full URL
https://script.hotjar.com/modules.b2c67271bc39c80bf49b.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.227.219.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-227-219-71.ams54.r.cloudfront.net
Software
/
Resource Hash
2b02e9de991d275184da0ca9bb8fa0a03e04f25a20d4c1145e55a590aed09fd2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 09:17:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 2dc050ab05a5052054de7d000d6c5f50.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS54-C1
age
20254
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
55645
last-modified
Mon, 21 Aug 2023 09:16:38 GMT
etag
"674ca8f715ef21c2b8845405fb296155"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
6mg2gV7qZFT0Y-P-s9Hs0NNWcM_bOP3DP3DgjyIfn59dbnJK-1h59g==
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 14:54:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Wed, 29 Nov 2023 14:54:40 GMT
tagjs
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
125 B
454 B
Script
General
Full URL
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Server
52.215.59.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-59-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
c5d12214821d5728c626bf8d567302273e459771419181688e2469a01536a314

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
125
Content-Type
text/javascript

Redirect headers

Location
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
/
www.google.com/pagead/1p-user-list/970186784/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970186784/?random=1692629680619&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&fmt=3&is_vtc=1&random=1246028179&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/970186784/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/970186784/?random=1692629680619&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&fmt=3&is_vtc=1&random=1246028179&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
185 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1986149958&t=pageview&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&ul=en-us&de=UTF-8&dt=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABQAAAACAAI~&jid=525777951&gjid=1203490865&cid=320361525.1692629681&tid=UA-38175129-1&_gid=1251699321.1692629681&_r=1&_slc=1&gtm=45He38g0n71KGGXSJ&z=1620108353
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
134618848.js
bat.bing.com/p/action/
0
117 B
Script
General
Full URL
https://bat.bing.com/p/action/134618848.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 21 Aug 2023 14:54:40 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: FA905737AF1B4913B681D433D50FA160 Ref B: FRA31EDGE0511 Ref C: 2023-08-21T14:54:40Z
x-cache
CONFIG_NOCACHE
pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/
43 B
422 B
Image
General
Full URL
https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&tag=ViewContent&ts=1692629680799
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.20.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-20-174.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 14:54:41 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
,39e1dcffb93e4d4fbfe1b832981081f5,10.0.0.113,43722,80.255.10.205,,278434162815,1,1692629681.151,0.001,,.,0,0,0.000,0.004,-,0,0,197,157,78,10,26847,,,,,,-,
Content-Type
image/gif
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/?random=1692629680854&cv=11&fst=1692629680854&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&auid=1120668519.1692629681&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
cb1f5b98d199082ac65fd45160498344ef0285a4bbfb3460cbf5582ae5ae106e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1403
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/?random=1692629680869&cv=11&fst=1692629680869&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&auid=1120668519.1692629681&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e257da2a99d14cddce8c819237683691a09eec61a44f6ddf6e8b9b63d72e4295
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1404
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/1/i/
43 B
376 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=1a617450-38bf-4fd4-8297-0bcf004ed7c2&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=40e856e0-4476-41b5-bb50-dcba14de18d1&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-response-time
139
date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
e880f2cd07dac05b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
2988dc2cab6380099f3d9512e819134271aecc967601c991f60f082c1d939540
content-length
43
adsct
analytics.twitter.com/1/i/
43 B
725 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=1a617450-38bf-4fd4-8297-0bcf004ed7c2&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=40e856e0-4476-41b5-bb50-dcba14de18d1&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-response-time
132
date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
3b35755d174cc031
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
34124369befa043db66a3cfe2767e12cb02fd308d157640d856dd511d04f6cbd
content-length
43
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-38175129-1&cid=320361525.1692629681&jid=525777951&gjid=1203490865&_gid=1251699321.1692629681&_u=aADAAEAAQAAAACAAI~&z=1434106139
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Mon, 21 Aug 2023 14:54:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-38175129-1&cid=320361525.1692629681&jid=525777951&_u=aADAAEAAQAAAACAAI~&z=397190411
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-38175129-1&cid=320361525.1692629681&jid=525777951&_u=aADAAEAAQAAAACAAI~&z=397190411
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1692629680985&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1692629680985-12236&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Mon, 21 Aug 2023 14:54:41 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
df4e66c6-d946-41d9-bbff-178219090c17
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1692619746
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
911fb8f3c9457ef89d35dd21dedfc00e7dd2eb1c64406567f5523a60e2d4ab16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
content-security-policy-report-only
require-trusted-types-for 'script';report-uri /cspreport
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-type
text/javascript; charset=utf-8
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
origin-trial
AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Mon, 21 Aug 2023 14:54:41 GMT
/
www.googleadservices.com/pagead/conversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/970186784/?random=1692629681013&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&bttype=purchase&auid=1120668519.1692629681&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
a56ee96b7a0ebc1771d9306dc4eaf3ec275228bb08c05d3d7c55a114e099b66a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1704
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~...
13115870.fls.doubleclick.net/ Frame B6FB
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;u...
527 B
429 B
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f134.1e100.net
Software
cafe /
Resource Hash
71461b60af94b691ee4caa7b2661e78ee7fa29feb67633177f054f8191a22677
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
320
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 21 Aug 2023 14:54:41 GMT
expires
Mon, 21 Aug 2023 14:54:41 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 21 Aug 2023 14:54:41 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D432890%26conversionId%3D2402852%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQKrFPKIhY_pCAAAAYoYl0Y9YnnyE2EsnfvF1Dci25BJ3FqBqLmW8gj355OnYEEILQ
43 B
348 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQKrFPKIhY_pCAAAAYoYl0Y9YnnyE2EsnfvF1Dci25BJ3FqBqLmW8gj355OnYEEILQ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
content-encoding
gzip
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 28BFC13AD02F4A31BE65CCB4A43D90D2 Ref B: FRAEDGE1409 Ref C: 2023-08-21T14:54:41Z
linkedin-action
1
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
content-type
image/gif
x-li-proto
http/2
content-length
65
x-li-uuid
AAYDcA7tmAPLfT4f+7P2ag==

Redirect headers

date
Mon, 21 Aug 2023 14:54:41 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 50F82681698342B7898D3BB09362DB9A Ref B: FRAEDGE1507 Ref C: 2023-08-21T14:54:41Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQKrFPKIhY_pCAAAAYoYl0Y9YnnyE2EsnfvF1Dci25BJ3FqBqLmW8gj355OnYEEILQ
x-li-proto
http/2
content-length
0
x-li-uuid
AAYDcA7qPT0N2+sX5t5vCg==
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
d3b64adf949a01915c03bae247c1cbdd6f188e488e4fd7fdc349942b2a691fd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 14:54:41 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 14:54:41 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
content-type
image/jpeg
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 14:54:41 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
content-type
image/jpeg
/
www.google.com/pagead/1p-user-list/10940107324/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/10940107324/?random=1692629680854&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1700535437&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/10940107324/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/10940107324/?random=1692629680854&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1700535437&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/462891735/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/462891735/?random=1692629680869&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3049321682&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/462891735/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/462891735/?random=1692629680869&cv=11&fst=1692626400000&bg=ffffff&guid=ON&async=1&gtm=45be38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3049321682&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=12c9789c4528a9431963b4b52733d818
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1691
etag
W/"7f9669464fe15e6a516c0eb693b26dbb"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7fa3b6732e025b80-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Thu, 24 Aug 2023 14:54:41 GMT
sd
api.brightfunnel.com/v1/
4 B
541 B
XHR
General
Full URL
https://api.brightfunnel.com/v1/sd
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.156.60.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-156-60-59.ams1.r.cloudfront.net
Software
/
Resource Hash
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

Date
Mon, 21 Aug 2023 14:54:42 GMT
Via
1.1 6851e5f468b237438eae4078fbc9d3b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
AMS1-P2
X-Amzn-Trace-Id
Root=1-64e37ab1-4868fc5c4bed07037cf360e8;Sampled=0;lineage=9409b995:0
x-amzn-RequestId
4921fec5-9a96-46c9-9c52-860e933c667d
X-Cache
Miss from cloudfront
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
keep-alive
x-amz-apigw-id
KBAbxHZOIAMFuYw=
Content-Length
4
X-Amz-Cf-Id
ff3ZnEJF5ai2aTKR3CtqND9uSWCxRTjvROJq6pMryBlFWYkf2hFsDA==
browser-perf.1c7ecd2be12644b9e658.js
script.hotjar.com/
6 KB
2 KB
Script
General
Full URL
https://script.hotjar.com/browser-perf.1c7ecd2be12644b9e658.js
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.b2c67271bc39c80bf49b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.227.219.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-227-219-71.ams54.r.cloudfront.net
Software
/
Resource Hash
37c5396a8f8c91466be1ab221bf6f86330013f0ce91cec575b8d9163b517da68
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Fri, 18 Aug 2023 09:10:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 2dc050ab05a5052054de7d000d6c5f50.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS54-C1
age
279845
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2011
last-modified
Fri, 18 Aug 2023 09:05:29 GMT
etag
"45a46deaac94afc7df5a17fb8b1a8233"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
0418Wdj-uj-NP1wCDfh2T7NRG4Lxpr5FaRVPC7IKCtjJtbTF1s-6hg==
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
image/svg+xml
0
bat.bing.com/action/
0
230 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=aa946cff-7b83-4e3b-865b-1ba09da6c214&sid=a85b40d0403211eeb021cbf3db5b9c26&vid=a85b5690403211eea6214ba858bcae46&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&r=&lt=3161&evt=pageLoad&sv=1&rn=237293
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 21 Aug 2023 14:54:40 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 7B483D5A1E2D4B7C84E27B6FF5865486 Ref B: FRA31EDGE0511 Ref C: 2023-08-21T14:54:41Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=aa946cff-7b83-4e3b-865b-1ba09da6c214&sid=a85b40d0403211eeb021cbf3db5b9c26&vid=a85b5690403211eea6214ba858bcae46&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&sw=1600&sh=1200&sc=24&evt=custom&rn=673581
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 21 Aug 2023 14:54:40 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 3B18720C41DB4F61A4416CF06D117D08 Ref B: FRA31EDGE0511 Ref C: 2023-08-21T14:54:41Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga.js
ga.clearbit.com/v1/
4 KB
1 KB
Script
General
Full URL
https://ga.clearbit.com/v1/ga.js?authorization=pk_ed7b4bbadb390cf24ef37a1223019246
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.158.205.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-205-16.eu-central-1.compute.amazonaws.com
Software
envoy /
Resource Hash
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-envoy-response-flags
-
server
envoy
x-api-version
2018-03-28
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
x-account-id
330680ff-f4de-4d19-81d4-375af65453c9
6si.min.js
j.6sc.co/
48 KB
14 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jul 2023 16:27:10 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64b9605e-bf6f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14190
expires
Mon, 21 Aug 2023 14:54:41 GMT
adsct
analytics.twitter.com/i/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_Vk9HkAOUjJ1cG4o7N
43 B
95 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_Vk9HkAOUjJ1cG4o7N
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-response-time
135
date
Mon, 21 Aug 2023 14:54:40 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
f402ea4858d3fc20
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
34124369befa043db66a3cfe2767e12cb02fd308d157640d856dd511d04f6cbd
content-length
43

Redirect headers

Location
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_Vk9HkAOUjJ1cG4o7N
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=yah
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_Vk9HkAOUjJ1cG4o7N&_origin=1
0
125 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_Vk9HkAOUjJ1cG4o7N&_origin=1
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-71-149-231.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.10.75 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.75
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Location
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_Vk9HkAOUjJ1cG4o7N&_origin=1
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=opx
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_Vk9HkAOUjJ1cG4o7N
43 B
273 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_Vk9HkAOUjJ1cG4o7N
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_Vk9HkAOUjJ1cG4o7N
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_Vk9HkAOUjJ1cG4o7N
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_Vk9HkAOUjJ1cG4o7N
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Server
69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
37b22a0c36bd84993dd2cda4a5e04b1d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_Vk9HkAOUjJ1cG4o7N
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
cb
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=goo
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfVms5SGtBT1VqSjFjRzRvN04
  • https://pixel-geo.prfct.co/cb?partnerId=goo
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Server
52.215.59.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-59-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel-geo.prfct.co/cb?partnerId=goo
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
240
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
pixel-geo.prfct.co/seg/
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/seg/?add=4530935&source=js_tag&a_id=56252
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.59.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-59-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/seg?t=2&add=4530935
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
43 B
839 B
Image
General
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Server
185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
an-x-request-uuid
7e7c0dc1-9a38-42c8-b541-667d8b61a0a7
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
80.255.10.205; 80.255.10.205; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
an-x-request-uuid
38237dca-6034-47fe-94ee-9b90dd5a6438
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
x-proxy-origin
80.255.10.205; 80.255.10.205; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
www-widgetapi.js
www.youtube.com/s/player/f980f2a9/www-widgetapi.vflset/
209 KB
65 KB
Script
General
Full URL
https://www.youtube.com/s/player/f980f2a9/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
386cffc306300930d11390e7ef3b437fe902b5d7363167fa2f1f33d8dcacf5f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:29:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
1515
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66015
x-xss-protection
0
last-modified
Wed, 16 Aug 2023 03:39:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 20 Aug 2024 14:29:26 GMT
/
www.google.de/pagead/1p-conversion/970186784/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww....
  • https://www.google.com/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flab...
  • https://www.google.de/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs...
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&auid=1120668519.1692629681&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOEphTXB3WVF0ZkxtNVk2TjFlSUlFaVlBNDB1YWh1bGhUcE5PZ0pVaHI2Y0FFMTVhZDlVaEE2MkVlQ0RXaDZxTVl4STd6UjcwWVEaWkNoRUk4SmFNcHdZUWpfMmN6WTd5MjRYWkFSSXVBREtSMkNody11OWhVQXhId3B0am1WZU5pVlVQSmNZa29FUERRMmFIUWpjbjdkNjdZc2UxMTRZd1R4bkhyQSITCKjagfeA7oADFTO0mgodjAwMzg&is_vtc=1&ocp_id=sXrjZOi9BLPo6gSMmbDwDA&cid=CAQSKQBpAlJW80vdhkPbO5dR_GPSLbCK2DwLvd1Be7SU6uQZjEhNCMURc-_t&eitems=ChAI8JaMpwYQ4rfw4r3-__gmEh0AHQBIfJasRvkSBP2bjSzR6Yj6PZjTyntA26SvCQ&random=3109511788&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/970186784/?random=2038923446&cv=11&fst=1692629681013&bg=ffffff&guid=ON&async=1&gtm=45He38g0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&value=0&auid=1120668519.1692629681&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJOEphTXB3WVF0ZkxtNVk2TjFlSUlFaVlBNDB1YWh1bGhUcE5PZ0pVaHI2Y0FFMTVhZDlVaEE2MkVlQ0RXaDZxTVl4STd6UjcwWVEaWkNoRUk4SmFNcHdZUWpfMmN6WTd5MjRYWkFSSXVBREtSMkNody11OWhVQXhId3B0am1WZU5pVlVQSmNZa29FUERRMmFIUWpjbjdkNjdZc2UxMTRZd1R4bkhyQSITCKjagfeA7oADFTO0mgodjAwMzg&is_vtc=1&ocp_id=sXrjZOi9BLPo6gSMmbDwDA&cid=CAQSKQBpAlJW80vdhkPbO5dR_GPSLbCK2DwLvd1Be7SU6uQZjEhNCMURc-_t&eitems=ChAI8JaMpwYQ4rfw4r3-__gmEh0AHQBIfJasRvkSBP2bjSzR6Yj6PZjTyntA26SvCQ&random=3109511788&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&t=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&tip=4JCiGM0PzVILvS47YMfDlc72aFViJRPelnbEZu9Eo4k&host=https://www.sentinelone.com&sa_conv_data_Event%20Name=mkto.form.success&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90f71840c54715da15f3a09412cad599150ff0acd&sa-user-id-v3=s%253AAQAKIE5XVrVva16qb5ECRMugLQu3wpQWh_1U3ub5MZSOorisEHwYBCCw9Y2nBjABOgTa3nmDQgQomMAL.ZFl%252FzuX%252B7E9RT9eujgBdAynARLZ0EGCQZHNGWmFPxuI&sa-user-id-v2=s%253AD3GEDFRxXaFfOglBLK1ZkVD_Cs0.iPSNVofU1q21OJQoU7GlH%252FZ7h0qTQcGXsBsAiW66ukw&sa-user-id=s%253A0-0f71840c-5471-5da1-5f3a-09412cad5991.KoRVNwZj4f75qyycvc%252Fc8UCM2HsiAjTlAaX5VDW%252Bn58
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
https://www.sentinelone.com
date
Mon, 21 Aug 2023 14:54:41 GMT
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
213
access-control-allow-methods
GET
content-type
text/plain; charset=utf-8
/
c.6sc.co/
7 B
196 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
15 B
305 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9a6ba811fc90def5a72f7aa42390c4cab40a1e1cabb90a1ade79c900d7e0a41f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:5a::12
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692629681357_388391900_420907872_25_1191_10_33_219";dur=1
content-length
15
expires
Mon, 21 Aug 2023 14:54:41 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%223576c97e67a9b7f8553a44ff1cc54791%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%228ba4c5a3fa178cfadac2b61291295db2874be830%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
saq_pxl
tags.srv.stackadapt.com/
213 B
410 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&t=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&tip=4JCiGM0PzVILvS47YMfDlc72aFViJRPelnbEZu9Eo4k&host=https://www.sentinelone.com&sa_conv_data_css_value=%270-0f71840c-5471-5da1-5f3a-09412cad5991%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90f71840c54715da15f3a09412cad599150ff0acd&sa-user-id-v3=s%253AAQAKIE5XVrVva16qb5ECRMugLQu3wpQWh_1U3ub5MZSOorisEHwYBCCw9Y2nBjABOgTa3nmDQgQomMAL.ZFl%252FzuX%252B7E9RT9eujgBdAynARLZ0EGCQZHNGWmFPxuI&sa-user-id-v2=s%253AD3GEDFRxXaFfOglBLK1ZkVD_Cs0.iPSNVofU1q21OJQoU7GlH%252FZ7h0qTQcGXsBsAiW66ukw&sa-user-id=s%253A0-0f71840c-5471-5da1-5f3a-09412cad5991.KoRVNwZj4f75qyycvc%252Fc8UCM2HsiAjTlAaX5VDW%252Bn58
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.193.228.227 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-228-227.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin
https://www.sentinelone.com
date
Mon, 21 Aug 2023 14:54:41 GMT
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
213
access-control-allow-methods
GET
content-type
text/plain; charset=utf-8
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66766a2841325afff848521b7b352fd785c564b87926b3c9985c7984a9cf00af
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
age
959
cf-polished
origSize=3460
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
917ef970-e775-48a4-94b1-e6307b572249
x-runtime
0.080731
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"ca28d92dd0f372653ae61a60c12adde7"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
cf-ray
7fa3b674efa75b80-FRA
access-control-allow-headers
SDK-Version
expires
Mon, 21 Aug 2023 15:54:41 GMT
dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=*;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentine...
adservice.google.com/ddm/fls/z/ Frame B6FB
42 B
401 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=*;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F
Requested by
Host: 13115870.fls.doubleclick.net
URL: https://13115870.fls.doubleclick.net/activityi;dc_pre=CPnEhPeA7oADFU-0nwodChMIng;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=1120668519.1692629681;gtm=45fe38g0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://13115870.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 14:54:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A5a%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1640
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
cf-ray
7fa3b6753aa12c1e-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Wed, 20 Sep 2023 14:54:41 GMT
details
epsilon.6sense.com/v3/company/
726 B
575 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.25.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-25-18.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 8ba4c5a3fa178cfadac2b61291295db2874be830
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
X-6s-CustomID
WebTag1.0 3576c97e67a9b7f8553a44ff1cc54791

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
content-length
387
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.25.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-25-18.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.sentinelone.com
access-control-max-age
1800
date
Mon, 21 Aug 2023 14:54:41 GMT
server
nginx
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
268 B
798 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1deada449ce1e720c36f2d1e638c588de0f889e078c3361eed0fdb67d1b08b50
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:41 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
age
14
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
a0daa35d-588b-4c48-925e-96baa9199094
x-runtime
0.024954
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"1deada449ce1e720c36f2d1e638c588d"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept, Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate
cf-ray
7fa3b6759c211c13-FRA
access-control-allow-headers
SDK-Version
v2YIX3gQ6moCsoRYtalA_apple-touch-icon.png
img.onesignal.com/permanent/00b53cc8-e3cf-4d2d-bbf3-1986e3d59095/
2 KB
2 KB
Image
General
Full URL
https://img.onesignal.com/permanent/00b53cc8-e3cf-4d2d-bbf3-1986e3d59095/v2YIX3gQ6moCsoRYtalA_apple-touch-icon.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a643e2fcf834dce892b4f2844cab6db03148dea4523223816742f43077e4572d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
date
Mon, 21 Aug 2023 14:54:41 GMT
strict-transport-security
max-age=15552000; includeSubDomains
cf-cache-status
HIT
age
3048
cf-polished
origSize=4820, status=vary_header_present
x-guploader-uploadid
ADPycdvJJmQ5Qiw3PFfTbFootSE7VNb5cmD5PaOka4_cKIepsXyyg1sEmwUTt9ZeNxNbC-5fgIjcAEM16S05FPr3ZuLP9TdnowIX
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
content-length
1830
pragma
no-cache
cf-bgj
imgq:85,h2pri
last-modified
Mon, 22 May 2023 20:49:17 GMT
server
cloudflare
etag
"-CLTLg7zmif8CEAE="
vary
Origin, Accept-Encoding
x-goog-generation
1684788557702580
content-type
image/png
x-goog-hash
crc32c=menOhw==, md5=+95Zp3W01opqou09atAbPQ==
cache-control
public, max-age=2678400
x-goog-stored-content-length
4820
accept-ranges
bytes
cf-ray
7fa3b675d8545b80-FRA
expires
Thu, 21 Sep 2023 14:54:41 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1986149958&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&ul=en-us&de=UTF-8&dt=Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aDDAAEADQAAAACAAI~&jid=&gjid=&cid=320361525.1692629681&tid=UA-38175129-1&_gid=1251699321.1692629681&gtm=45He38g0n71KGGXSJ&cd1=&cd2=&cd3=&cd4=Germany&cd5=&z=205547185
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 21 Aug 2023 07:01:56 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
28365
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
async-api.e9f77430-1.237.1.min.js
js-agent.newrelic.com/
3 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/async-api.e9f77430-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
370a9e517ef0694db38a18b53a46711e1461912f0074f024db5373ff946fc894
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
Nnzi3DxfGlFxxxaHTHoVoaEtXaaSwSj1
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGM44G2H3T95M0RG
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1384
x-amz-id-2
pYMoGKzxpzTDzhmdjTgFG5JFai/unv5XW+Eo4tyfxeb6QhVr+NUuCnGsSPtGwjMZeEidI8tMaCw=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1692629682.101071,VS0,VE0
etag
"193a6d6f02af9cfb9888de413246e90b"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
6039
860.95a91211-1.237.1.min.js
js-agent.newrelic.com/
14 KB
5 KB
Script
General
Full URL
https://js-agent.newrelic.com/860.95a91211-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0aee72df00de1dcfe4d631dd2a72979cee0e756ef7e243b2799856582c44557
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
EoQgbqtiNktUFHe2XcVVByjJaUw3xjmB
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGME0EFST6A5NB5B
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5422
x-amz-id-2
Th5W14ONfFa1hPkjGXdAwsnAcmTWbhXtOnkYTgyxzqjdHoN5/7oAlCp3nkLVz675UvH0slqFSN0=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1692629682.101234,VS0,VE0
etag
"b550851fb79f7d61442ca34a6120ac44"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
5656
session-manager.d080e4cc-1.237.1.min.js
js-agent.newrelic.com/
1 KB
913 B
Script
General
Full URL
https://js-agent.newrelic.com/session-manager.d080e4cc-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
oaOpBoY_R0Emmn1D4qOBGa8Bli_CwZsc
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGM1T0AT17NVAZ13
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
686
x-amz-id-2
O6L3Ip1/4vY5L1/soaX8sXkNC/gXPkvDfaja4IcpjlxbDAWhaXoBV8SjiDx7hZYgttdDgTYrt4U=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1692629682.101180,VS0,VE0
etag
"a097cb2068fb2d63e521cacf139c921d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
5422
up
insight.adsrvr.org/track/ Frame 618F
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&upid=jskiafk&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Mon, 21 Aug 2023 14:54:42 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
lazy-feature-loader.c1052c27-1.237.1.min.js
js-agent.newrelic.com/
1 KB
867 B
Script
General
Full URL
https://js-agent.newrelic.com/lazy-feature-loader.c1052c27-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8f51d7bb4a7314fbd42bd5a2cec23adcfd23441c6539c3437cac22bc10c285a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
4gplzRtxWsISTBSfvxcHM2iQ7IWskafp
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGMFHKA8BCZDAHJD
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
422
x-amz-id-2
b1C6Hx7FixjbCwFIc+5ICMs9iLzGLUJtTJaIbhcfAT1kfqQ6k4sioRXp5G7/iX9xorqroX6uKSI=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1692629682.121297,VS0,VE0
etag
"e2a4dffecb3f725ca685cfc37cc223f8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
5797
646.9e7a6b8d-1.237.1.min.js
js-agent.newrelic.com/
8 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/646.9e7a6b8d-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de72c7056110de6c12aefd6fedb26a0e323d4cfab62d84c64db52e168af372e5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
J93EXw1eqMtGdXxiO91RJ8N7Vb2Flihy
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VJ869YA1CC3394
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3460
x-amz-id-2
7fIhRwbqln0AFC4AK5A665eA4jDD4mVUfLc87VlErCNtrPMQrbVJjBEkcCgJ8km/2QVNwyxyw+E=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1692629682.138332,VS0,VE0
etag
"ec83dba32689d4a796844e10a31121ff"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
2998
page_view_event-aggregate.4988d952-1.237.1.min.js
js-agent.newrelic.com/
11 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.4988d952-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7662a5a8640648c39b824f101e232d34b73499503492d05394988f00ab79f1b4
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
97KO3uF7bK0xbSFbyTLOB.IfHKJDnJRG
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VRE94K7XRRMEKF
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4294
x-amz-id-2
Yz1zUSno2wNxfKe4XnAb95sfluvgftG6IT0ySvYWfSXH/AG7aUpLcOpFzZakSBkiNwYvHyaC5gk=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1692629682.138501,VS0,VE0
etag
"82daa027f82e87cd1c2fdffd51598981"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
5790
page_view_timing-aggregate.7b2a53ee-1.237.1.min.js
js-agent.newrelic.com/
15 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.7b2a53ee-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a1c8bf8b428570336332bf63dd4efaf9e41b95dd4d83e324592d87d3042f747e
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
9V3_HBwcuGR4s0SRIPY4jJi2AWvILXpO
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VYTC65XAS3WA5V
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5638
x-amz-id-2
2WR1q1UWLCH5CBEXlilo1jPYP4cR1ZF8dL5IU8GOnsi9ZlRtZC6OgyISGCycUyId7zIRsJp8hpc=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1692629682.138989,VS0,VE0
etag
"be733f239fd67b0efd24d572dfe8263c"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4549
metrics-aggregate.b86cefcf-1.237.1.min.js
js-agent.newrelic.com/
9 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/metrics-aggregate.b86cefcf-1.237.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
141c410edab90686e098d4a827e8b79d8c8e295694508ddb4e3003f955127b65
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id
dqbxt2r61x_OSAHoWthSPNHI9j_y3Vhk
content-encoding
br
via
1.1 varnish
date
Mon, 21 Aug 2023 14:54:42 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VZ3551HKA05NVV
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3060
x-amz-id-2
mwGokb8xilNe2NDwDN/oGsjr0G6h0rybiuYfofj8129iB+pgsDGxKsFVv3svieqzkZFXUjpUfk4=
x-served-by
cache-fra-eddf8230131-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1692629682.139622,VS0,VE0
etag
"41c470a0065b8af87ec8b24a5a1862ca"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
5782
NRJS-7f7a0b93139dcf56f90
bam.nr-data.net/1/
40 B
468 B
XHR
General
Full URL
https://bam.nr-data.net/1/NRJS-7f7a0b93139dcf56f90?a=773889139&v=1.237.1&to=ZlwDMkMCWxJQUkdYXF8WIAVFCloPHkJaX1RdXA%3D%3D&rst=4122&ck=0&s=0ceab4a900ae0c3e&ref=https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/&ap=742&be=1062&fe=2937&dc=2099&at=ShsARAsYSBw%3D&perf=%7B%22timing%22:%7B%22of%22:1692629678046,%22n%22:0,%22f%22:988,%22dn%22:988,%22dne%22:999,%22c%22:999,%22s%22:1006,%22ce%22:1020,%22rq%22:1020,%22rp%22:1062,%22rpe%22:1068,%22di%22:3097,%22ds%22:3104,%22de%22:3162,%22dc%22:3995,%22l%22:3995,%22le%22:3999%7D,%22navigation%22:%7B%7D%7D&fp=2142&fcp=2258
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
content-type
text/plain

Response headers

Date
Mon, 21 Aug 2023 14:54:42 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.sentinelone.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
CF-Ray
7fa3b679dd1e2bc5-FRA
Content-Length
40
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A41%20GMT%22%2C%22timeSpent%22%3A%221010%22%2C%22totalTimeSpent%22%3A%221010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
test
cdn.abrankings.com/
2 B
424 B
XHR
General
Full URL
https://cdn.abrankings.com/test?url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&abr_id=1280
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:4c00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-my-header
my-header-content
date
Mon, 21 Aug 2023 14:54:37 GMT
content-encoding
gzip
via
1.1 3ffec0ecfde687fb371812ad42f5cfc2.cloudfront.net (CloudFront)
server
nginx/1.20.1
x-amz-cf-pop
AMS1-C1
age
5
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
cache-control
max-age=60, public
x-amz-cf-id
BqVulnrqy8EcJ8OvTnfnt0sWdZQfnQEV2cJ8z9LWQYXRetBo1dK1rQ==
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A42%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%222013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:43 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A43%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%223019%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A44%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224021%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.57 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-57.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Mon, 21 Aug 2023 14:54:45 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
b.6sc.co
URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=eb8e8641-e3df-4112-8072-ba349c466085&session=8bd3a956-be6b-47f9-823c-a3a6ff9ce83a&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2021%20Aug%202023%2014%3A54%3A45%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225023%22%7D&isIframe=false&m=%7B%22description%22%3A%22Threat%20actors%20abuse%20Adobe%20Creative%20Cloud%2C%20Edge%2C%20and%20other%20executables%20vulnerable%20to%20DLL%20hijacking%20in%20campaign%20targeting%20the%20Southeast%20Asian%20gambling%20sector.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chinese%20Entanglement%20%7C%20DLL%20Hijacking%20in%20the%20Asian%20Gambling%20Sector%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&pageViewId=a8dadf15-6ee6-43f0-8728-b67de7390502&v=1.1.5

Verdicts & Comments Add Verdict or Comment

190 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA object| OneTrustStub function| OptanonWrapper object| google_tag_manager object| google_tag_data object| dataLayer object| google_optimize object| analytics string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| $ function| jQuery object| MktoForms2 function| FontFaceOnload function| Swiper function| Collage object| FaqSearcher function| HeadingSizer object| HomeScrolling function| LogoCrossfader object| MarketoWrap object| ScrolledSections function| TestimonialCarousel function| VideoCarousel function| VideoTabs function| VimeoPlaylist function| documentInitOneSignal function| OneSignal function| gtag object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener function| ClipboardJS object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ function| addCaptchaScript object| jQuery1124017390680042616213 function| lintrk boolean| _already_called_lintrk function| postscribe object| google_tag_manager_external function| onYouTubeIframeAPIReady object| gaGlobal string| GoogleAnalyticsObject function| ga object| GooglebQhCsO function| hj object| _hjSettings function| rdt object| _pa object| freeEditElems number| len undefined| curr string| bfId number| bfSession string| _linkedin_partner_id object| _linkedin_data_partner_ids function| qp number| abr_id object| script string| target object| elem function| twq function| saq function| _saq object| Optanon object| OneTrust object| gaplugins object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| facebookEventsHelper function| googleAdsEventsHelper object| _pq object| gaData function| UET function| UET_init function| UET_push object| ueto_9ca4e8d6b5 object| uetq object| qevents string| abr_url object| abr function| abrankings function| Template7 function| ttd_dom_ready function| TTDUniversalPixelApi object| regeneratorRuntime object| ccConsole boolean| ccinstalled object| twttr object| terminusTracker object| MunchkinTracker object| lazyLoadInstance function| sidebarSticky function| checkPageScroll object| anchors object| anchor object| swiper undefined| largest object| hljs object| MarkerAnimation function| LazyLoad function| WOW object| AmazonPolly object| AnimatedBox object| Autopop object| Calendar object| GlobalMediaViewer object| Glossary object| Greenhouse object| Highlighter object| ImageModalOpener object| Magnifier object| MultiStepForm object| PathFactoryUtils object| ProgressBar object| ResourceCenter object| TableOfContents object| TechCenter object| Threats object| Tooltip object| UrlShortener object| UtmLinks number| r function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady string| res object| saCookies string| current_window_url_param number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ boolean| _storagePopulated boolean| abr_completed string| dateDayShort string| dateDay string| dateDD string| dateMon string| dateMM string| dateMonth string| dateYYYY string| dateYY

58 Cookies

Domain/Path Name / Value
.sentinelone.com/ Name: __cfredirector_sm
Value: DE
.go.sentinelone.com/ Name: __cf_bm
Value: tDMa4PEDNkOLZN4mz5z4y51Kgcl3qinceFOBZed2Qjw-1692629679-0-AQT4DaNXuhKiYqYOtK+nmCY/JOI/1DEKvhsCPuIBS2Y7G3sI4YMjgSALxW9Id0f3+TBh25x84GduMwKc0P8g7y8=
.onesignal.com/ Name: __cf_bm
Value: ZcQWoBF8xlr3xhXUZ8tdrPuWp_XPjwDOqMG5M8XpxEU-1692629680-0-Aed7iWnsR4VaovUhu5sI0WvdP65Vo00M0nSramt6F+1mAh38CYM98QLnZCcRHUgZvRPXBie5ffYwjiSNkRJQT6w=
.sentinelone.com/ Name: ajs_anonymous_id
Value: 5e471d98-a53c-4658-bafe-f35998079923
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1692629680.1.0.1692629680.60.0.0
.sentinelone.com/ Name: _gcl_au
Value: 1.1.1120668519.1692629681
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !9jC3B5jin7lkwFOkCIQPm+cqSAXSEecUjxwAX5OGYz4esH8PaNl1RVvdXlVKlGdR28kPj1UpmDK4tKI=
.linkedin.com/ Name: bcookie
Value: "v=2&8856c984-8c33-4cd9-8c1b-ba32d83db957"
.linkedin.com/ Name: lidc
Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2818:u=1:x=1:i=1692629680:t=1692716080:v=2:sig=AQFgOETXCL4XXko3VqSVyU0nW94YaMh1"
www.sentinelone.com/ Name: ln_or
Value: eyI0MzI4OTAiOiJkIn0%3D
.sentinelone.com/ Name: _rdt_uuid
Value: 1692629680730.4dcc5d35-19ad-4f3f-b844-faa6ca5c3603
.sentinelone.com/ Name: _ga
Value: GA1.2.320361525.1692629681
.sentinelone.com/ Name: _gid
Value: GA1.2.1251699321.1692629681
.sentinelone.com/ Name: _gat_UA-38175129-1
Value: 1
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-0f71840c-5471-5da1-5f3a-09412cad5991.KoRVNwZj4f75qyycvc%2Fc8UCM2HsiAjTlAaX5VDW%2Bn58
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-0f71840c-5471-5da1-5f3a-09412cad5991.KoRVNwZj4f75qyycvc%2Fc8UCM2HsiAjTlAaX5VDW%2Bn58
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AD3GEDFRxXaFfOglBLK1ZkVD_Cs0.iPSNVofU1q21OJQoU7GlH%2FZ7h0qTQcGXsBsAiW66ukw
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AD3GEDFRxXaFfOglBLK1ZkVD_Cs0.iPSNVofU1q21OJQoU7GlH%2FZ7h0qTQcGXsBsAiW66ukw
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIE5XVrVva16qb5ECRMugLQu3wpQWh_1U3ub5MZSOorisEHwYBCCw9Y2nBjABOgTa3nmDQgQomMAL.ZFl%2FzuX%2B7E9RT9eujgBdAynARLZ0EGCQZHNGWmFPxuI
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIE5XVrVva16qb5ECRMugLQu3wpQWh_1U3ub5MZSOorisEHwYBCCw9Y2nBjABOgTa3nmDQgQomMAL.ZFl%2FzuX%2B7E9RT9eujgBdAynARLZ0EGCQZHNGWmFPxuI
.prfct.co/ Name: pa_uid
Value: pa_Vk9HkAOUjJ1cG4o7N
.doubleclick.net/ Name: IDE
Value: AHWqTUnusGGJWYCj7lbQUSVSYPxNwnwvjTjZaqtNwGpvhxHujzMFiK4VlTyagDjs
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1692629680985-12236
.youtube.com/ Name: YSC
Value: 9Nlpv-IC3aI
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: ozQ-zoSvf_o
www.sentinelone.com/ Name: sa-user-id
Value: s%253A0-0f71840c-5471-5da1-5f3a-09412cad5991.KoRVNwZj4f75qyycvc%252Fc8UCM2HsiAjTlAaX5VDW%252Bn58
www.sentinelone.com/ Name: sa-user-id-v2
Value: s%253AD3GEDFRxXaFfOglBLK1ZkVD_Cs0.iPSNVofU1q21OJQoU7GlH%252FZ7h0qTQcGXsBsAiW66ukw
www.sentinelone.com/ Name: sa-user-id-v3
Value: s%253AAQAKIE5XVrVva16qb5ECRMugLQu3wpQWh_1U3ub5MZSOorisEHwYBCCw9Y2nBjABOgTa3nmDQgQomMAL.ZFl%252FzuX%252B7E9RT9eujgBdAynARLZ0EGCQZHNGWmFPxuI
.twitter.com/ Name: guest_id_marketing
Value: v1%3A169262968100508523
.twitter.com/ Name: guest_id_ads
Value: v1%3A169262968100508523
.twitter.com/ Name: personalization_id
Value: "v1_qO36d93LAhWZWq1Qox8A3w=="
.twitter.com/ Name: guest_id
Value: v1%3A169262968100508523
.t.co/ Name: muc_ads
Value: f4cb3ece-1678-4976-8106-4a617e62ecae
.sentinelone.com/ Name: bf_lead
Value: 1aqs2ehkrorg00
.sentinelone.com/ Name: _hjSessionUser_2714452
Value: eyJpZCI6ImFjNTRhZTdkLTE3NWItNWYzYS1hYThjLTYzMmU0ZDMxMGFlNyIsImNyZWF0ZWQiOjE2OTI2Mjk2ODEwNTUsImV4aXN0aW5nIjpmYWxzZX0=
.sentinelone.com/ Name: _hjFirstSeen
Value: 1
.sentinelone.com/ Name: _hjIncludedInSessionSample_2714452
Value: 1
.sentinelone.com/ Name: _hjSession_2714452
Value: eyJpZCI6IjVkNDJhZGM2LTc0MjQtNGIyZS04Y2Y0LWZmNzNlYzQzNDU3NSIsImNyZWF0ZWQiOjE2OTI2Mjk2ODExNjUsImluU2FtcGxlIjp0cnVlfQ==
.sentinelone.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Mon+Aug+21+2023+16%3A54%3A41+GMT%2B0200+(Central+European+Summer+Time)&version=6.23.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fchinese-entanglement-dll-hijacking-in-the-asian-gambling-sector%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.sentinelone.com/ Name: _uetsid
Value: a85b40d0403211eeb021cbf3db5b9c26
.sentinelone.com/ Name: _uetvid
Value: a85b5690403211eea6214ba858bcae46
.linkedin.com/ Name: li_sugr
Value: 9f580c07-10a3-4144-82e7-e409edc61402
.bing.com/ Name: MUID
Value: 282D2539814F65AC1C09364D80C464AC
.prfct.co/ Name: pa_twitter_ts
Value: 1692629681251
.prfct.co/ Name: pa_yahoo_ts
Value: 1692629681307
www.sentinelone.com/ Name: _gd_visitor
Value: eb8e8641-e3df-4112-8072-ba349c466085
www.sentinelone.com/ Name: _gd_session
Value: 8bd3a956-be6b-47f9-823c-a3a6ff9ce83a
.prfct.co/ Name: pa_openx_ts
Value: 1692629681314
.prfct.co/ Name: pa_rubicon_ts
Value: 1692629681315
.prfct.co/ Name: pa_google_ts
Value: 1692629681316
.linkedin.com/ Name: UserMatchHistory
Value: AQIJn_A2Tf2bUAAAAYoYl0S08lyK1oGch-hGPDrxylSTJa1PXi-6HRZWtVBnKsIIvy9Uu04KXV4ZfQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKJAezoEQsNlQAAAYoYl0S0AJJlsHpuqBPf0NlcMLZThjgxMF7oT3LjyvqqZjL1dIw3JYAAx7Ey5DTjLTmi3w
.adnxs.com/ Name: uuid2
Value: 2915431969865425050
.adnxs.com/ Name: anj
Value: dTM7k!M4/8CxrEQF']wIg2In9jf1CB!]tbP6j2F-XstGt!@DuW$w5Na
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230821145441217211ec-351e-49e2-836e-0f2a5d3f9fdeAQFBbY7SyI9p3xmDsMqTuXGES456ID6A"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTI2Mjk2ODE7MjswMjEGvXRDftjB1mbKThHU8sDnGYnOWf1ctbjEI6EFJZfecg==
.6sc.co/ Name: 6suuid
Value: 358f1402e2b10500b17ae3647b020000a8e93c00

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
adservice.google.com
alb.reddit.com
analytics.twitter.com
api.brightfunnel.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.onesignal.com
cloud.typography.com
cm.g.doubleclick.net
de.sentinelone.com
e.calibermind.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
ga.clearbit.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
img.onesignal.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.adsrvr.org
munchkin.brightfunnel.com
munchkin.marketo.net
onesignal.com
pixel-geo.prfct.co
pixel.rubiconproject.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
script.hotjar.com
secure.adnxs.com
sentinelone.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag.marinsm.com
tags.srv.stackadapt.com
ups.analytics.yahoo.com
us-u.openx.net
www.clickcease.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.sentinelone.com
www.youtube.com
b.6sc.co
104.102.38.132
104.17.70.206
104.244.42.195
104.244.42.69
104.26.3.18
108.156.60.59
108.157.1.118
13.107.42.14
13.227.219.71
142.250.185.130
146.75.120.157
151.101.192.65
151.101.65.140
151.101.66.137
162.159.152.17
162.247.241.14
172.217.23.98
18.154.63.124
18.158.205.16
18.193.228.227
185.89.210.82
192.28.144.124
2.20.143.57
2001:4860:4802:34::36
216.58.212.134
23.201.248.34
2600:9000:2104:4c00:11:8a36:7200:93a1
2600:9000:2315:3e00:2:53b2:240:93a1
2600:9000:2315:8800:15:a0d3:77c0:93a1
2606:4700:3031::ac43:d595
2606:4700:3037::6815:2d74
2606:4700:4400::6812:2089
2606:4700::6812:bada
2606:4700::6812:d63b
2606:4700::6812:d73b
2620:12a:8000::2
2620:12a:8001::2
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:811::200a
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2008
2a00:1450:4001:827::2004
2a00:1450:4001:828::2003
2a00:1450:4001:828::200e
2a00:1450:4001:82f::200e
2a00:1450:4001:831::200e
2a00:1450:400c:c0a::9a
2a02:26f0:3500:16::215:149b
2a02:26f0:480:23::1726:629c
2a04:4e42::396
3.71.149.231
34.98.64.218
52.21.20.174
52.215.59.161
52.222.139.116
52.223.40.198
52.59.25.18
69.173.144.138
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
067b3af0ba8cdc22760f0403dac22c7dce5f0fb1ca99892bf45849a6c7dacc84
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
0da08befe5a68eec43e1e5598ae8f09c574234a20c164c52c16ed0938712ca5e
13b3e0774f34feff8af39c43e1466a1482b52a35fe32ce1e7a7b0fe85385e34e
141c410edab90686e098d4a827e8b79d8c8e295694508ddb4e3003f955127b65
183ee96c78d9aeae323ed8ff9630ffc5e2844227835f3e67bae5e9cf59aa575f
19d7846cc0bfa392e0c43a1c8115e82c38b7d2adc22145f27659b20e74ce0bc8
1deada449ce1e720c36f2d1e638c588de0f889e078c3361eed0fdb67d1b08b50
1e05b9ea0b011538c18894c754a623c15fff99f0e6bc4cc641628890c6367a10
1f1b053798feca0d6310c9f463fa883f374d4ad73d5cc54e4d1160762a87ca96
1fbe7203318a179068ef1d35f4e5bc2d7583b1c046dcda8e84159a528468f060
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2ab39f322f7eb5915eb0576dd13d924eef4edbd67b24bf1a899b80ff27a9aef3
2b02e9de991d275184da0ca9bb8fa0a03e04f25a20d4c1145e55a590aed09fd2
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
370a9e517ef0694db38a18b53a46711e1461912f0074f024db5373ff946fc894
37c5396a8f8c91466be1ab221bf6f86330013f0ce91cec575b8d9163b517da68
386cffc306300930d11390e7ef3b437fe902b5d7363167fa2f1f33d8dcacf5f2
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
40f2b6111afe27cb0aec9f1c1823de48d5a4742795db1afea78137af18bdc598
4181a6741fbec0d7ef8536ac03badf16c41425821bc0355ca7800762e1a397b1
425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae
4486d08e581da7eb5267ca780ae7f6e28fe84082d7aa07ed0f1ef029c1b8aca4
47f08226ea71e159d8f9563f3041ac93e5699aa89031e3d071b05d5975ac8780
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
4ade995b30f0f423c698fd2e0a5f267a915afc89eb5706123646c97dd2d1d6cd
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
600da3183186c36f50236d2b9cc068d89fcc2ff470d4f902cab50266e60d1329
6216aa13cd1b94fff9633dcf5b41edfa3bc8fca74ad6472ff286604c3d6875f9
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
66766a2841325afff848521b7b352fd785c564b87926b3c9985c7984a9cf00af
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288
683e1a4ccd781d9a04bafed01df0d1a4e267881aa3a093e9938e93218da10dc2
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
71461b60af94b691ee4caa7b2661e78ee7fa29feb67633177f054f8191a22677
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
73cff75f7e45e09826281feedef1e893c733e45db765803c903c40356a3b8b4b
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
7662a5a8640648c39b824f101e232d34b73499503492d05394988f00ab79f1b4
76634f9eb6534a50e98eaff61fad5bdd249a45fd4aef3f401e946662db0fa606
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8f51d7bb4a7314fbd42bd5a2cec23adcfd23441c6539c3437cac22bc10c285a5
911fb8f3c9457ef89d35dd21dedfc00e7dd2eb1c64406567f5523a60e2d4ab16
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
97e1df3e3c73e853a22806274887388de2becb5c7dcac68180a219d891e160e0
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
9a6ba811fc90def5a72f7aa42390c4cab40a1e1cabb90a1ade79c900d7e0a41f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1c8bf8b428570336332bf63dd4efaf9e41b95dd4d83e324592d87d3042f747e
a56ee96b7a0ebc1771d9306dc4eaf3ec275228bb08c05d3d7c55a114e099b66a
a643e2fcf834dce892b4f2844cab6db03148dea4523223816742f43077e4572d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b97b49ee323dbccf9a13f15fa3d93188d01681652d52b1ed40ad00c32dfb0513
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
c0aee72df00de1dcfe4d631dd2a72979cee0e756ef7e243b2799856582c44557
c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
c3419ffe314cfed42ed710bdc1771a7a8484d251bcd9b0102b7a621a71ddae7b
c532b2a0fdea6725ff83e644904739f6ff23b90b00d2d615f4f3207eb352f2c0
c5d12214821d5728c626bf8d567302273e459771419181688e2469a01536a314
c7f1813cee6d21853cf382a71c87dc0ccb2ad93be0024b8182e2fd2301f8e5b4
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
cb1f5b98d199082ac65fd45160498344ef0285a4bbfb3460cbf5582ae5ae106e
cc079836abe496d8cc3a3e2b5ec355195b2dc1cde665b6d1ea5996e04b930720
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d3b64adf949a01915c03bae247c1cbdd6f188e488e4fd7fdc349942b2a691fd5
d97f91a02e6d7c4f3d9273847b0f5bb745b01d00c8b197d7596617c0214f3826
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd68674fc557815b81b5c81564778da129293d01b143986415d8357bdecea8e2
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
de72c7056110de6c12aefd6fedb26a0e323d4cfab62d84c64db52e168af372e5
de7fc77fa47baa443846b4f13232d122f4c5b8436d5d359b12b01f8629b0586b
e257da2a99d14cddce8c819237683691a09eec61a44f6ddf6e8b9b63d72e4295
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fc539e86a89fb1ac21634169076646278597f9b74cd5d5ca8aad35a3756e2ba4
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678