www.deepinstinct.com Open in urlscan Pro
2600:1f18:2489:8200::c8  Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1721268643325%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%252Fblog%252Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&liSync=true&e_ipv6=AQJlgor40YlnAwAAAZDDmyf74uL_oK2J6OUv-AX5eZ-KXMGCh9lzRBLqKQCIVjBAzIgH_k0POjEgJmOAR1jO9fkB7bGR0SA

Request Chain 74

• https://id.rlcdn.com/464526.gif HTTP 307
• https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCKPz4bQGEgUI6AcQAEIASgA HTTP 307
• https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297yElcPMcMa8ixe7WK-2oMk_d8d1QuATeCd29HfFDmd7U

138 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request deep-dive-exposing-stealthy-new-blacksuit-ransomware Show response www.deepinstinct.com/blog/	113 KB 20 KB	160ms 21ms	Document text/html	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 637ec1cd1503a55086e72010b67711b08dffd7a82fa48b6fc2c353331af7de16 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers age 14158 cache-control public,max-age=0,must-revalidate cache-status "Netlify Edge"; hit; fwd=stale content-encoding br content-length 19995 content-type text/html; charset=utf-8 date Thu, 18 Jul 2024 02:10:42 GMT etag "138hx4o1qjl2hbe-df" netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify strict-transport-security max-age=31536000 surrogate-control max-age=300, stale-while-revalidate=900, stale-if-error=900 vary Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN x-nextjs-date Wed, 17 Jul 2024 22:15:57 GMT x-nf-request-id 01J31SP8QMX4QMPDDEB622Y5SQ x-xss-protection 1
GET H2	200	optimize.js Show response www.googleoptimize.com/	181 KB 65 KB	76ms 30ms	Script application/javascript	2607:f8b0:4004:c1d::66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c1d::66 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 43394a85ab52eb06c8af63b211a4341b63c6392c5c0765a5067f499133420ffd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 66359 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Jul 2024 02:10:42 GMT
GET H2	200	750ec5d7420478b9.css www.deepinstinct.com/_next/static/css/	33 KB 7 KB	17ms 14ms	Stylesheet text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/750ec5d7420478b9.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 03b8f617c55b16aee5c5a696e7a46b65e2165f67b16c80b1869a32cb083187d0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8RXJKC6Z12Q1WX13FA4 date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 25014 cache-status "Netlify Edge"; hit etag "1a64c1b250ffae34cd89c19992b0f7aa-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 7232
GET H2	200	b3c831d72c60daeb.css www.deepinstinct.com/_next/static/css/	15 KB 3 KB	32ms 29ms	Stylesheet text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/b3c831d72c60daeb.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8RXJRGZHNB584PFT9PJ date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "b612c4d93b4d750f521d7cf025d5fdd3-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3478
GET H2	200	ddca67f80ea11511.css www.deepinstinct.com/_next/static/css/	889 B 980 B	18ms 15ms	Stylesheet text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/ddca67f80ea11511.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8RX712P9ZKRY3TE0D4F date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "bf94acaf8c7e8837fa3d2ad39b6a0f87-ssl" content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 889
GET H2	200	5935-76bf011ee3d88f83.js Show response www.deepinstinct.com/_next/static/chunks/	30 KB 10 KB	17ms 16ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/5935-76bf011ee3d88f83.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8W1RN98HEVZYRTSVDQ7 date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 2897 cache-status "Netlify Edge"; hit etag "711c7a0bda1d2a5419580350a0ac2def-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 10218
GET H2	200	7029-3230841eb82dea3f.js Show response www.deepinstinct.com/_next/static/chunks/	123 KB 37 KB	34ms 28ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/7029-3230841eb82dea3f.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYVJJ34GRRH902QM6G date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 11139 cache-status "Netlify Edge"; hit etag "163091f8d515307568ca14bd7c244cee-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 37388
GET H2	200	6839.c8ee40f8e73e0e22.js Show response www.deepinstinct.com/_next/static/chunks/	2 KB 1 KB	26ms 20ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/6839.c8ee40f8e73e0e22.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYVB5TF6X200AQPHH2 date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "42b37c98d571c31326f0ce7f5b379979-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1059
GET H2	200	webpack-ab98c6f8291d4d11.js Show response www.deepinstinct.com/_next/static/chunks/	7 KB 3 KB	22ms 17ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash f296483c861c3109f9ca7c27470fb6975dff698a378cce87f2b6785556acf771 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYQ2J7D7P1Z8KCBASV date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "f41343b49bfd2d65332587d877662dca-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3487
GET H2	200	framework-314c182fa7e2bf37.js Show response www.deepinstinct.com/_next/static/chunks/	138 KB 43 KB	26ms 21ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/framework-314c182fa7e2bf37.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYX9NEN0K3HG1WTCYC date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 15012 cache-status "Netlify Edge"; hit etag "842190aeeb138e17ecbd4e80395b04db-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 43600
GET H2	200	main-c5b7e6d77b82bab5.js Show response www.deepinstinct.com/_next/static/chunks/	124 KB 35 KB	27ms 22ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYYHDQMRES37ZS8MCC date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "f5b74e619e9eb5d06577186ed77b231a-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 35769
GET H2	200	_app-88813e0d1ae2e973.js Show response www.deepinstinct.com/_next/static/chunks/pages/	450 B 537 B	32ms 28ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/_app-88813e0d1ae2e973.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYG5MZ2SGG3XMCVNRD date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "50537b790c14aad9a5df48742d265dfa-ssl" content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 450
GET H2	200	5675-5d8e1c18eb2a06a1.js Show response www.deepinstinct.com/_next/static/chunks/	9 KB 4 KB	22ms 18ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/5675-5d8e1c18eb2a06a1.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYT77G3FKK4MH4BT7N date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "ae4ef7f9e1361f41374b10337ad35c3b-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3722
GET H2	200	8882-efb8f68e8ac16c1e.js Show response www.deepinstinct.com/_next/static/chunks/	27 KB 10 KB	22ms 18ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/8882-efb8f68e8ac16c1e.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WY6M6TBVF8D746YK2B date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 11139 cache-status "Netlify Edge"; hit etag "e9c9a5087b21357b065e593c5a56f0d3-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 9853
GET H2	200	1053-69c3e67c1a3e9c2f.js Show response www.deepinstinct.com/_next/static/chunks/	89 KB 31 KB	23ms 19ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/1053-69c3e67c1a3e9c2f.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WY7DMX3CAVQ5RYNMGB date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 11139 cache-status "Netlify Edge"; hit etag "78b7ac861927eedc433e1fd1aff23deb-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 31147
GET H2	200	512-35e7e0c970a2e23e.js Show response www.deepinstinct.com/_next/static/chunks/	17 KB 6 KB	34ms 31ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/512-35e7e0c970a2e23e.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash ac8eda9680e46c0f5c5dce0bab65c195532a951641f1363dc8f0ce7780d8f703 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8WYZ75DY77C9NFEDQ1J date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "388bfad01ad1882f679136e43e669cc7-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 5663
GET H2	200	%5Bpid%5D-7f7601d838d136ca.js Show response www.deepinstinct.com/_next/static/chunks/pages/blog/	547 B 634 B	37ms 33ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/blog/%5Bpid%5D-7f7601d838d136ca.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XBQKG32BBBHHZDM08M date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "f101ba9e2d84013ead218fe806d71a13-ssl" content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 547
GET H2	200	_buildManifest.js Show response www.deepinstinct.com/_next/static/4uXK4YqfXL62tLBLOAJYS/	8 KB 2 KB	37ms 33ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/4uXK4YqfXL62tLBLOAJYS/_buildManifest.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 8bc48e7f50df1c3ce25af2c94d3b4e7be620c152110bd8388d630dae62d048e7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XBQMK18KRSYRHGYGRM date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "5c6f6b1b9cd2b80ae812f6d4820ffc88-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1538
GET H2	200	_ssgManifest.js Show response www.deepinstinct.com/_next/static/4uXK4YqfXL62tLBLOAJYS/	455 B 541 B	35ms 32ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/4uXK4YqfXL62tLBLOAJYS/_ssgManifest.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XB9GKBZV161XM82581 date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 server Netlify age 27758 cache-status "Netlify Edge"; hit etag "c28c1e4abeeaf5ddbabf351bc59836fa-ssl" content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 455
GET H2	200	zka3qml.css use.typekit.net/	3 KB 993 B	145ms 13ms	Stylesheet text/css	2600:141b:e800:5b::17ca:3d7c AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/zka3qml.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:5b::17ca:3d7c Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Thu, 18 Jul 2024 02:10:42 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 770
GET H2	200	fig1-blacksuit-victims.png www.deepinstinct.com/image/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/	40 KB 40 KB	32ms 30ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash c22e721550c93c047dfd7f3b12fe4d32ae258e96e5ec65aa52c9588102809fb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8RXZD3TT2JR1EE9P6N7 date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98677 fastly-io-served-by vpop-haf2300706 x-cache MISS, HIT fastly-io-info ifsz=40860 idim=667x398 ifmt=png ofsz=40860 odim=667x398 ofmt=png content-disposition inline; filename=fig1-blacksuit-victims.png fastly-stats io=1 content-length 40860 fastly-io-warning Failed to shrink image x-request-id 2c683748c8fb746603bf9b617f945885 x-served-by cache-sjc10046-SJC, cache-iad-kjyo7100155-IAD x-runtime 55ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241330.125625,VS0,VE1 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "6ZYlh3tII3xHGbq2I1RM9GZxQDcuI5ca2JEoNgCWnJY" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	fig2-strings-encryption.png www.deepinstinct.com/image/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/	82 KB 83 KB	17ms 16ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 982061b53a36aa43cd91c02919b86bdd30898b36f5cb3178c572927afa40ebbb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8RXKEJX9H9P8GC9N3C5 date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98677 fastly-io-served-by vpop-haf2300705 x-cache MISS, HIT fastly-io-info ifsz=103299 idim=782x338 ifmt=png ofsz=84288 odim=782x338 ofmt=png content-disposition inline; filename=fig2-strings-encryption.png fastly-stats io=1 content-length 84288 x-request-id 4a75ea1e866a7ced02f77b8b9e277359 x-served-by cache-sjc1000138-SJC, cache-iad-kcgs7200086-IAD x-runtime 45ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241330.983113,VS0,VE2 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "FmO7bHGJghcDlOk3hLk9rQquSt3IQ7snPEGEIPtuI3k" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	fig3-VT-detection-rate.png www.deepinstinct.com/image/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/	52 KB 53 KB	17ms 16ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash be82b4f00e4743df6e3f5db3c1d9fcea99b63155c746851507d88207a2341a14 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8T36S9Z94PE3SN5M2PY date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98676 fastly-io-served-by vpop-haf2300705 x-cache MISS, HIT fastly-io-info ifsz=63820 idim=852x230 ifmt=png ofsz=53457 odim=852x230 ofmt=png content-disposition inline; filename=fig3-VT-detection-rate.png fastly-stats io=1 content-length 53457 x-request-id 735d57c09da9c156ab98f2e51325e300 x-served-by cache-sjc10021-SJC, cache-iad-kiad7000172-IAD x-runtime 55ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241330.196436,VS0,VE4 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "SXVPHU6K17wZnGOpXB8c6mnh+FOpWD4PaJgqwgjXRbE" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	fig4-embedded-legitimate-urls.png www.deepinstinct.com/image/blteae79a1729b07bfd/6696f82c77a780582d44a263/	9 KB 10 KB	16ms 16ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 94f54abba642dfe52b99f1f6bc15b066c6e438116bdab8e838d580520f66d102 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8TD8BWPS69AFW0JW9YR date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98676 fastly-io-served-by vpop-haf2300704 x-cache MISS, HIT fastly-io-info ifsz=30891 idim=831x186 ifmt=png ofsz=9418 odim=831x186 ofmt=png content-disposition inline; filename=fig4-embedded-legitimate-urls.png fastly-stats io=1 content-length 9418 x-request-id ced602f205d7b68824de6399df97d653 x-served-by cache-sjc1000126-SJC, cache-iad-kjyo7100042-IAD x-runtime 53ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241330.309131,VS0,VE1 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "36DnsbVH49fK/pVFXknotf7LZ7YDZgP7HirrnzeRrcU" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	fig5-fake-metadata.png www.deepinstinct.com/image/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/	91 KB 92 KB	17ms 16ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash dc847de6ea975479507589606c738b3d0fa4fd2d08ec02d80d6deebaf94b1b6f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8TTR112TY63PWNDNNB7 date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98676 fastly-io-served-by vpop-haf2300714 x-cache MISS, HIT fastly-io-info ifsz=114316 idim=678x180 ifmt=png ofsz=93128 odim=678x180 ofmt=png content-disposition inline; filename=fig5-fake-metadata.png fastly-stats io=1 content-length 93128 x-request-id 0966712c648b0d5a37d5bca15295a414 x-served-by cache-sjc10040-SJC, cache-iad-kjyo7100066-IAD x-runtime 53ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241330.347541,VS0,VE2 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "wxcTGWplknCTyfzrAHliTMe6tYHy3myT10g8IVdgNQo" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	fig6-VT-detectio-rate-stealthy-sample.png www.deepinstinct.com/image/blt3971600a651708d4/6696f82c79f2042205390cf0/	56 KB 57 KB	73ms 70ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 6d28c0d73a281535b2f2bbc6a7db5aa8a26a3b86739e1d76b24444cc516f3263 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XB0K6ZM7WN6VMMACZJ date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 98676 fastly-io-served-by vpop-haf2300706 x-cache MISS, HIT fastly-io-info ifsz=67877 idim=1264x173 ifmt=png ofsz=57839 odim=1264x173 ofmt=png content-disposition inline; filename=fig6-VT-detectio-rate-stealthy-sample.png fastly-stats io=1 content-length 57839 x-request-id a685e8e946d22eaa38acff84ea095187 x-served-by cache-sjc10042-SJC, cache-iad-kjyo7100179-IAD x-runtime 54ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241224.756764,VS0,VE0 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "vaEQDMgjnYvTaZtOv9dppjwir238rH3esopN4r9FMHc" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 2
GET H2	200	fig7-ransom-note.png www.deepinstinct.com/image/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/	200 KB 201 KB	35ms 32ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 4e7cee3c4c26f0b1116810724040c3f26701e560d554ecca80e87d79f769be31 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XBS5V9K165SQSFAKTX date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 27419 fastly-io-served-by vpop-haf2300701 x-cache MISS, HIT fastly-io-info ifsz=249431 idim=1257x202 ifmt=png ofsz=205267 odim=1257x202 ofmt=png content-disposition inline; filename=fig7-ransom-note.png fastly-stats io=1 content-length 205267 x-request-id 20ce1ed6190f4ff4d6999912c182a7c9 x-served-by cache-sjc1000143-SJC, cache-iad-kjyo7100174-IAD x-runtime 51ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241224.982838,VS0,VE1 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "XTFfqSl5g1e6iXpwtrnFOu2oil9WtmjqWEtL3ax5UI8" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 0
GET H2	200	fig9-darkweb-leak_redact_WB.png www.deepinstinct.com/image/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/	44 KB 44 KB	34ms 32ms	Image image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/image/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash fd0884c2533c5b1196c7e07eff837038feb985da8cdcea5d0d38667f16103481 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP8XB5YE8PDR4ZC1SRMXM date Thu, 18 Jul 2024 02:10:42 GMT strict-transport-security max-age=31536000 via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 43357 fastly-io-served-by vpop-haf2300711 x-cache MISS, HIT fastly-io-info ifsz=59953 idim=789x265 ifmt=png ofsz=44771 odim=789x265 ofmt=png content-disposition inline; filename=fig9-darkweb-leak_redact_WB.png fastly-stats io=1 content-length 44771 x-request-id d513afa708735113ab3c02ad98ab50c1 x-served-by cache-sjc1000097-SJC, cache-iad-kjyo7100063-IAD x-runtime 52ms netlify-vary header=x-nextjs-data|x-next-debug-logging,cookie=__prerender_bypass|__next_preview_data server Netlify x-timer S1721241331.629628,VS0,VE2 x-contentstack-organization bltdec97706489ab5de cache-status "Netlify Edge"; hit etag "wbwmkdu87eShmrGz5fcDFtwRYNHrPyaA2+9en9rMyiM" content-type image/png access-control-allow-origin * access-control-expose-headers content-disposition, content-type, cache-control, status, content-length cache-control max-age=31536000 accept-ranges bytes x-cache-hits 0, 1
GET H2	200	gtm.js Show response www.googletagmanager.com/	320 KB 109 KB	82ms 33ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9dddac450e071e619e667cac1c066a839f0e0a737daa7d25dc845496d5073100 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 110686 x-xss-protection 0 last-modified Thu, 18 Jul 2024 00:55:04 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 18 Jul 2024 02:10:42 GMT
GET H2	200	p.css p.typekit.net/	5 B 172 B	123ms 9ms	Stylesheet text/css	2600:141b:e800:5b::17ca:3d66 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=zka3qml&ht=tk&f=10954.13454.13466.28969&a=83637106&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/zka3qml.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:5b::17ca:3d66 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT last-modified Sun, 21 Jan 2024 12:50:46 GMT server nginx etag "65ad1326-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	js Show response www.googletagmanager.com/gtag/	305 KB 102 KB	40ms 38ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 847b0ac4abc5fa1ad95467627afe9534e302c4bdad5d4c54693a3bf0e905a6ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 104622 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Jul 2024 02:10:42 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	70ms 20ms	Script text/javascript	2607:f8b0:400d:c0d::8a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c0d::8a Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 18 Jul 2024 00:39:47 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 5455 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 18 Jul 2024 02:39:47 GMT
GET H2	200	hotjar-1665869.js Show response static.hotjar.com/c/	9 KB 4 KB	90ms 27ms	Script application/javascript	18.239.183.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1665869.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.183.97 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-183-97.bos50.r.cloudfront.net Software / Resource Hash 8d6a3f3b2b6c02aab737f0261309ba8f553254dfd6e6544cf577118b23c4952a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=2592000; includeSubDomains content-encoding br x-content-type-options nosniff date Thu, 18 Jul 2024 02:09:52 GMT via 1.1 224a6b751b8322609af7fa7d59c0303e.cloudfront.net (CloudFront) x-amz-cf-pop BOS50-P4 age 50 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin etag W/5920176f3b4ef2e582d2a0280901dd64 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 cache-control max-age=60 x-amz-cf-id KnJXDJFxT94Ygv5qF-bYU405W69PfB4G3TcWJKDXxkPygQ7WlLbvjg==
GET H2	200	8430ce879b38826d.min.js Show response tag.demandbase.com/	81 KB 23 KB	223ms 128ms	Script application/javascript	18.239.168.129 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.demandbase.com/8430ce879b38826d.min.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.168.129 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-168-129.bos50.r.cloudfront.net Software AmazonS3 / Resource Hash e2c7b00e5aa344d1329c962df15f0aca26bd1acd2f6a487cd31ffa06ceda1094 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id CRKTGtdxkgHcPQvYTe3cvgpOYk2qqMPT content-encoding gzip via 1.1 5e28369133a72a47acf796b9cc447b6e.cloudfront.net (CloudFront) date Thu, 18 Jul 2024 02:10:44 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-amz-cf-pop BOS50-P3 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront last-modified Wed, 17 Jul 2024 21:50:35 GMT server AmazonS3 etag W/"829942483c07f238c2bf09e594554c72" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control public, max-age=3600 permissions-policy accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() x-amz-cf-id XyXA_hZaicUO-7VS0_yERBY24XN9a_LG-LvMetWD9A05AHeMEEsSXQ==
GET H2	200	2183098.js Show response js.hs-scripts.com/	2 KB 1 KB	76ms 48ms	Script application/javascript	2606:4700::6810:89d1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/2183098.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dbe0a560fa158220b7c377f46a090e6a9cf7f9313c9537375b85fea6aa975ef0 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 76d8a84f-de0e-4ce4-b78d-7cecb7b3d5b0 x-envoy-upstream-service-time 5 content-length 651 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 76d8a84f-de0e-4ce4-b78d-7cecb7b3d5b0 last-modified Thu, 18 Jul 2024 01:26:20 GMT server cloudflare vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.deepinstinct.com x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-7dd59b876-2v7bp access-control-allow-credentials true cache-control public, max-age=90 accept-ranges bytes cf-ray 8a4eefda4e8c8ce3-EWR expires Thu, 18 Jul 2024 02:12:12 GMT
GET H2	200	destination Show response www.googletagmanager.com/gtag/	260 KB 90 KB	43ms 31ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 66d86a27050cb4f6818fe83d128dcba8de702ea9c5c7d0b91be98de1577ade77 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91761 x-xss-protection 0 last-modified Thu, 18 Jul 2024 00:55:04 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 18 Jul 2024 02:10:42 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	38 KB 14 KB	44ms 10ms	Script application/javascript	2600:141b:e800:b::172c:8324 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:b::172c:8324 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash dbfeb010a0c8acddc38dea97e228787f16ac5e30b4af96b764fa2252fe3827e4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 11 Jul 2024 09:18:59 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=51897 accept-ranges bytes content-length 14011
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	452ms 25ms	Script application/javascript	146.75.80.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.80.157 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip last-modified Tue, 26 Mar 2024 20:58:07 GMT x-amz-server-side-encryption AES256 etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15412 x-served-by cache-iad-kcgs7200117-IAD, cache-chi-klot8100066-CHI
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	224 KB 60 KB	60ms 17ms	Script application/x-javascript	2a03:2880:f003:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 18 Jul 2024 02:10:42 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 58677 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=12, rtx=0, c=12, mss=1328, tbw=2801, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug 68IH82e0nHegmzmqTzV7qngjout9WcVxVGztRO6ITUgOkizX9rmiaQTXBw7/jzD4TwIIrE9a2cpzfoZmPCgamg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	49 KB 14 KB	66ms 23ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Thu, 18 Jul 2024 02:10:42 GMT last-modified Sat, 13 Jul 2024 20:42:16 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A581BEC1A6FF4F09A3B7241D23EDC7D7 Ref B: EWR311000104049 Ref C: 2024-07-18T02:10:42Z etag "044982565d5da1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 14183
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	67 KB 25 KB	163ms 8ms	Script application/x-javascript	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nyd/D12D) / Resource Hash d712fe18630ebeb6200015703274e9bd938c871e748355ea26cfdec67955e2a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSub last-modified Thu, 11 Jul 2024 19:09:28 GMT server ECS (nyd/D12D) age 17718 etag "a8653dac5d3da1:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 25393
GET H2	200	tracking.js Show response trk.techtarget.com/	3 KB 2 KB	128ms 46ms	Script text/javascript	2606:4700:4400::ac40:973c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trk.techtarget.com/tracking.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e Security Headers Name Value Strict-Transport-Security max-age=0; includeSubDomains; preload Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT via 1.1 google content-encoding br cf-cache-status HIT cf-bgj minify last-modified Tue, 13 Dec 2022 15:01:39 GMT strict-transport-security max-age=0; includeSubDomains; preload age 4467 server cloudflare vary Accept-Encoding content-type text/javascript cache-control public, max-age=1200 cf-ray 8a4eefdab86d0c84-EWR expires Thu, 18 Jul 2024 02:30:43 GMT
GET H2	200	qualified.js Show response js.qualified.com/	1 MB 288 KB	259ms 148ms	Script text/javascript	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5f6d73ad848607315cd664ee2e88c541cb4674586c9d526ca74e747c73c6f92e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip via 1.1 spaces-router (42359e36e9bb) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status MISS x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 2b110fee-7a4c-a82b-8716-e17a9c421ed0 pragma no-cache x-runtime 0.042780 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"5f6d73ad848607315cd664ee2e88c541" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 8a4eefdb2a2a80d3-EWR expires Thu, 18 Jul 2024 06:10:43 GMT
GET H2	200	l use.typekit.net/af/04ec74/00000000000000000001205b/27/	29 KB 29 KB	40ms 10ms	Font application/font-woff2	2600:141b:e800:5b::17ca:3d7c AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/04ec74/00000000000000000001205b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/zka3qml.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:5b::17ca:3d7c Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d Request headers Referer https://use.typekit.net/zka3qml.css Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT server nginx etag "1c4557ace28950fbc49487c3a85660222d5fe232" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 29588
GET H2	200	l use.typekit.net/af/1709eb/000000000000000000010b60/27/	24 KB 24 KB	41ms 11ms	Font application/font-woff2	2600:141b:e800:5b::17ca:3d7c AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/zka3qml.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:5b::17ca:3d7c Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447 Request headers Referer https://use.typekit.net/zka3qml.css Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT server nginx etag "9bd0488a91630a3c738a4d950e0b0b7930bcb98f" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24740
GET H2	200	l use.typekit.net/af/442215/000000000000000000010b5a/27/	23 KB 23 KB	49ms 20ms	Font application/font-woff2	2600:141b:e800:5b::17ca:3d7c AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/442215/000000000000000000010b5a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/zka3qml.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:141b:e800:5b::17ca:3d7c Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7 Request headers Referer https://use.typekit.net/zka3qml.css Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT server nginx etag "9523c64514161c03124fab238b18113d17bad9eb" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 23800
GET H2	200	image www.deepinstinct.com/_next/	377 KB 378 KB	24ms 21ms	Image image/avif	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fwww.deepinstinct.com%2Fimage%2Fblt51c070f57c78e259%2F6696fe4c6c101949e63979b6%2FBlackSuit_900x400_2.png&w=1680&q=100 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 347ee7b8829b954f845278fd629f206ae713ba890aee8ef061103280045a3fd7 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP94VRMFE7ASSYJ101DQ7 content-security-policy date Thu, 18 Jul 2024 02:10:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000 age 27312 cross-origin-resource-policy cross-origin content-length 386146 last-modified Wed, 17 Jul 2024 18:35:31 GMT netlify-vary query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width server Netlify cache-status "Netlify Edge"; hit vary Accept content-type image/avif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	image www.deepinstinct.com/_next/	5 KB 5 KB	37ms 35ms	Image image/avif	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fblt0cf06d1687eae8f6%2F662a583851b16fd55bc4f095%2FIvan_Kosarev.png&w=64&q=75 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash ad8e8b7b59e68afcbdc688e6ec1a186f7b02be890cbeb6d7631434b8486fdafa Security Headers Name Value Content-Security-Policy script-src 'none' Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP94VMCW2KB07Q66KFJ4W content-security-policy script-src 'none' date Thu, 18 Jul 2024 02:10:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000 age 1887305 cross-origin-resource-policy cross-origin content-length 4644 last-modified Wed, 26 Jun 2024 05:55:38 GMT netlify-vary query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width server Netlify cache-status "Netlify Edge"; fwd=miss vary Accept content-type image/avif access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	image www.deepinstinct.com/_next/	5 KB 5 KB	29ms 27ms	Image image/avif	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fbltfdfca743f7ac9662%2F630e2d5d8bdc107d4a01ba3f%2F800x800-blue-monogram.png&w=64&q=75 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a Security Headers Name Value Content-Security-Policy script-src 'none' Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP94V1HJD7A0NBBZ59HZY content-security-policy script-src 'none' date Thu, 18 Jul 2024 02:10:42 GMT x-content-type-options nosniff strict-transport-security max-age=31536000 age 1603439 cross-origin-resource-policy cross-origin content-length 5220 last-modified Sat, 29 Jun 2024 12:46:43 GMT netlify-vary query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width server Netlify cache-status "Netlify Edge"; hit vary Accept content-type image/avif access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	5518.abf70040ebe14552.js Show response www.deepinstinct.com/_next/static/chunks/	17 KB 7 KB	33ms 30ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/5518.abf70040ebe14552.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP96WDG561ANHTBNH14Y7 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "a1bb3610d16d40d3994a04e335eb2f7b-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 7377
GET H2	200	4c213f3cb0a0d816.css www.deepinstinct.com/_next/static/css/	1 KB 406 B	22ms 19ms	Stylesheet text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/4c213f3cb0a0d816.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP96WGPB7P9VCKZW603W7 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "6eccd5b5ee90f21ffe9daf5e31693980-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 298
GET H2	200	1114.36c11ded4c40c351.js Show response www.deepinstinct.com/_next/static/chunks/	5 KB 2 KB	22ms 20ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/1114.36c11ded4c40c351.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP96W5Y47PP7GTD3SYG1R date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "be2cb73604d20aae800d9673a2b8cb00-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1662
GET H2	200	7743.1cc5d0e5cea43aba.js Show response www.deepinstinct.com/_next/static/chunks/	2 KB 1 KB	19ms 19ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/7743.1cc5d0e5cea43aba.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP96W7JPA0W0SS0YAAXRW date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "b01362f8cfc3944820c788efd91353e8-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1124
GET H2	200	bc7bc02e97adc5a7.css www.deepinstinct.com/_next/static/css/	7 KB 1 KB	26ms 23ms	Stylesheet text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/bc7bc02e97adc5a7.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 5100d3b54c0823629c1aa3724c1e19fda936a10e378f6aa26b0bcf8357cd7b61 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP98EGHFC6CF03WM1VYGN date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "f861d3991435d60ec131879b13f8f7bd-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1389
GET H2	200	7133.5d727180e3422d19.js Show response www.deepinstinct.com/_next/static/chunks/	2 KB 1 KB	25ms 24ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/7133.5d727180e3422d19.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/webpack-ab98c6f8291d4d11.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 2b9daf21b02002d1cc92e23db4ef74d8ae594308f5cdda57cc760ae4ecf2b4a2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP98EX3SXWFGX1Q1DP4Y9 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "0320e7ec9d1c6c14d260f360c0ecad43-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 957
GET H2	200	st.js Show response s.swiftypecdn.com/install/v2/	416 KB 110 KB	117ms 8ms	Script text/javascript	151.101.193.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/install/v2/st.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-served-by cache-lga21956-LGA date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip via 1.1 varnish age 47 x-timer S1721268643.254330,VS0,VE0 etag "644bc380-1b6c6" vary Accept-Encoding x-cache HIT content-type text/javascript access-control-allow-origin * cache-control max-age=300, public, max-age=300, public accept-ranges bytes content-length 112326 x-cache-hits 3
GET H2	200	bo2xmiv11n.jsonp Show response fast.wistia.com/embed/medias/	6 KB 2 KB	87ms 25ms	Script application/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/embed/medias/bo2xmiv11n.jsonp Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software envoy / Resource Hash c6888201381a8fdc77def40e341a9c7f6b5a53d1f691445c8de052eac6ca3651 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=0 via 1.1 b0785dd15b9c7ed21cde8fa5e473d0a2.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish x-permitted-cross-domain-policies none x-amz-cf-pop IAD61-P1 age 35827 x-cache Miss from cloudfront, HIT, HIT x-envoy-upstream-service-time 57 content-length 1725 x-request-id 38225c2d-aade-4c58-becb-f3b0a34d5668 x-served-by cache-iad-kjyo7100053-IAD, cache-lga21970-LGA x-runtime 0.055191 x-browser-version 126 server envoy x-timer S1721268643.216165,VS0,VE2 etag W/"c6888201381a8fdc77def40e341a9c7f" vary Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, no-cache x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-amz-cf-id loFvXLEAxemfA4NVbC09_FEMIlvxMJ4WloNsrc4FJKTkZY4jqLImcg== x-cache-hits 36, 0
GET H2	200	E-v1.js Show response fast.wistia.com/assets/external/	792 KB 134 KB	69ms 8ms	Script text/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/assets/external/E-v1.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6ac684f0d7bbe2947da03a4ef906bace5ea3d477b948cf2d0c83448db9731814 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1372 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 137039 x-served-by cache-iad-kcgs7200051-IAD, cache-lga21970-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 14:48:47 GMT server AmazonS3 x-timer S1721268643.216137,VS0,VE0 etag "b7a20449a31031c3fc02dfc523ad0c8b" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome asset-version 2bd36ef2cf79e0d4c6a9f7fd609491b19a6c23e0 x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 2, 159
POST H2	204	collect analytics.google.com/g/	0 0	57ms 22ms	Fetch text/plain	2001:4860:4802:32::181 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-P5MMKMDSNW&gtm=45je47h0v868549395z878451102za200zb78451102&_p=1721268642696&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=936595179.1721268643&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1721268643&sct=1&seg=0&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&dt=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=870&_z=fetch Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.deepinstinct.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 257 B	66ms 30ms	Ping text/plain	2607:f8b0:4004:c07::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P5MMKMDSNW&cid=936595179.1721268643&gtm=45je47h0v868549395z878451102za200zb78451102&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c07::9a Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.deepinstinct.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	fb.js Show response js.hsadspixel.net/	6 KB 4 KB	63ms 22ms	Script application/javascript	2606:4700::6811:df98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsadspixel.net/fb.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/2183098.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:df98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 50a35208d4d64a784109aa95fc4741f204e4035bd304dfa933859fc124c579ea Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT x-amz-version-id uYbxvY6weeATqv9c6Wdvv9TcA.mK4yCh content-encoding gzip x-content-type-options nosniff via 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront) cf-cache-status HIT x-amz-cf-pop IAD12-P3 age 256 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.570/bundles/pixels-release.js&cfRay=8a4ee99aeb561998-EWR x-cache Hit from cloudfront x-hubspot-correlation-id db8119cb-b30b-404e-bf24-93ef3b971313 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 3 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id db8119cb-b30b-404e-bf24-93ef3b971313 last-modified Wed, 17 Jul 2024 14:15:10 UTC server cloudflare etag W/"d0bc1801c348710367f872ece4338c28" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-65f7f7c749-th2td cf-ray 8a4eefdcfedc428e-EWR x-amz-cf-id pe0PG8GN2G6tdHKqSTwCamARtzoHgRJU4iDcrwn9F3MHN3d-1mhe3w== x-hs-target-asset adsscriptloaderstatic/static-1.570/bundles/pixels-release.js
GET H2	200	2183098.js Show response js.hs-analytics.net/analytics/1721268600000/	67 KB 24 KB	83ms 56ms	Script text/javascript	2606:4700::6811:afc9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1721268600000/2183098.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/2183098.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1e2d02de0bb1a5490358ee8d68de20fe7c929f8da65a7a13ce5f9a13963c34d Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT x-amz-version-id null content-encoding gzip cf-cache-status MISS x-amz-request-id 9V9CGNMM8Y8PZVMV x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id bc9fd376-4d75-461c-9a89-a7410412a3d5 x-envoy-upstream-service-time 20 x-amz-id-2 Zy00RREcsh6O/5NX+PkcOmwJ0ar8anOD5ouwxo3Z93EZTDSfGUyP4mRZ/3DcLQBqGNk+k8Wn2i0t7Hub0gFHCaPJh0Mcjt7/U1dyhuebb5k= x-evy-trace-listener listener_https x-request-id bc9fd376-4d75-461c-9a89-a7410412a3d5 x-evy-trace-route-configuration listener_https/all last-modified Tue, 09 Jul 2024 17:51:35 GMT server cloudflare etag W/"acabc70653075c9e1da585933595eb83" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-zmwrp cache-control max-age=300,public access-control-allow-credentials false cf-ray 8a4eefdcd9e40f63-EWR expires Thu, 18 Jul 2024 02:15:43 GMT
GET H2	200	2183098.js Show response js.hs-banner.com/	64 KB 19 KB	89ms 60ms	Script text/javascript	2606:4700:4400::6812:22e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/2183098.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/2183098.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8b66fac289b2ad1de7c5f9ea4ee51cf6d1361b4c9dbf081626bc0ef5bc205150 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT x-amz-version-id R1W10dwvhonM068CPcDC.o94dYFouque content-encoding gzip cf-cache-status REVALIDATED x-amz-request-id 92WMQS1RJDR9RR0X x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 65bbcb07-172f-4a86-9db0-5aa83026cdd3 x-envoy-upstream-service-time 168 x-amz-id-2 kea45Cuc2hr3iyiRicTDd+CIjrcfIhGpeXhuc93jdnjxERJExoX78mPdYYItv2v1/VsJNIKOMkQ= x-evy-trace-listener listener_https x-request-id 65bbcb07-172f-4a86-9db0-5aa83026cdd3 x-evy-trace-route-configuration listener_https/all last-modified Fri, 03 May 2024 15:56:44 GMT server cloudflare etag W/"427a987ba870918608ae5cea12fa7d29" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://info.deepinstinct.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-rslzw vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8a4eefdcefab4378-EWR expires Thu, 18 Jul 2024 02:15:43 GMT
GET H2	200	leadflows.js Show response js.hsleadflows.net/	551 KB 92 KB	55ms 27ms	Script application/javascript	2606:4700::6812:8c11 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/2183098.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:8c11 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-encoding gzip x-evy-trace-route-service-name envoyset-translator age 20011 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js&cfRay=8a4d07530e201a34-EWR x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"be45bdb720f44c8db4ee42bc228ff2a8" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js date Thu, 18 Jul 2024 02:10:43 GMT x-amz-version-id HLkmxotJV8gQ_mnvhNwLT9fnVmh1uWjb x-content-type-options nosniff cf-cache-status HIT via 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront) x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 3de3abb5-0bd6-4080-866d-ce68f82e7956 x-cache Miss from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 48 x-evy-trace-route-configuration listener_https/all x-request-id 3de3abb5-0bd6-4080-866d-ce68f82e7956 last-modified Thu, 30 May 2024 10:22:15 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-65f7f7c749-x8whk cf-ray 8a4eefdce8c71851-EWR x-amz-cf-id Qp3BXYz2vvf9zWfM0yBhMhLM8w8qkTzOFB9RapnA42Hxtt0dnK0Ymg==
GET H2	200	modules.e4b2dc39f985f11fb1e4.js Show response script.hotjar.com/	223 KB 56 KB	102ms 14ms	Script application/javascript	18.239.183.35 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.e4b2dc39f985f11fb1e4.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1665869.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.183.35 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-183-35.bos50.r.cloudfront.net Software / Resource Hash 619feac205d68f6356fcad13d6758533011a8acc7830e3deb0f763249d7516c0 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Mon, 01 Jul 2024 08:11:07 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 2b2491fc3c8b84a7fd8dd41a09ba5510.cloudfront.net (CloudFront) x-amz-cf-pop BOS50-P4 age 1447176 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 56291 last-modified Mon, 01 Jul 2024 08:10:34 GMT etag "ca025d2d8ae4b3dc51e058b782590501" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id XMrMCV_l8urnQ9I-bJ4WJLyme--BeOsdUHdL9YOxS2mWfWGzIGFzJQ==
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 211 B	27ms 25ms	XHR text/plain	2607:f8b0:400d:c0d::8a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=91302986&t=pageview&_s=1&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&ul=en-us&de=UTF-8&dt=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=353336632&gjid=794125438&cid=936595179.1721268643&tid=UA-69598329-1&_gid=94343538.1721268643&_r=1&_slc=1&gtm=45He47h0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&z=2044606683 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c0d::8a Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.deepinstinct.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 787 B	135ms 97ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers Accept * Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:42 GMT content-encoding gzip x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 97E4617A386C44CEADC89B19F6DA3221 Ref B: EWR311000107049 Ref C: 2024-07-18T02:10:43Z access-control-allow-methods GET, OPTIONS x-li-fabric prod-ltx1 access-control-allow-origin * x-li-source-fabric prod-lva1 content-type application/json x-li-proto http/2 x-restli-protocol-version 1.0.0 x-cache CONFIG_NOCACHE access-control-allow-headers * x-li-uuid AAYdfBYNJXJC74wadFExaA== x-fs-uuid 00061d7c160d257242ef8c1a74513168
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1721268643325%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%25... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&li... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&l...	0 487 B	128ms 75ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&liSync=true&e_ipv6=AQJlgor40YlnAwAAAZDDmyf74uL_oK2J6OUv-AX5eZ-KXMGCh9lzRBLqKQCIVjBAzIgH_k0POjEgJmOAR1jO9fkB7bGR0SA Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 5F78944F6AD64E499AB5B18AAFD750E4 Ref B: EWR30EDGE0112 Ref C: 2024-07-18T02:10:43Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYdfBYXCNmsCWwTeoMm1g== Redirect headers date Thu, 18 Jul 2024 02:10:43 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 6506A1D00B0040E89522E3F34145903E Ref B: EWR30EDGE1011 Ref C: 2024-07-18T02:10:43Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1721268643325&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&cookiesTest=true&liSync=true&e_ipv6=AQJlgor40YlnAwAAAZDDmyf74uL_oK2J6OUv-AX5eZ-KXMGCh9lzRBLqKQCIVjBAzIgH_k0POjEgJmOAR1jO9fkB7bGR0SA x-li-proto http/2 content-length 0 x-li-uuid AAYdfBYUEMiCX3gSe2rQng==
GET H2	200	17571311.js Show response bat.bing.com/p/action/	334 B 407 B	23ms 23ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/17571311.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0170197caffee3d73fe659b2b65d4c50b88310d98752d7dba0e7988e7dfe4376 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br date Thu, 18 Jul 2024 02:10:42 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 77FAFC77601F4402AC83B917DEE068CE Ref B: EWR311000104049 Ref C: 2024-07-18T02:10:43Z vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript; charset=utf-8 cache-control private,max-age=1800
GET H2	200	gif.gif Show response ibc-flow.techtarget.com/a/	43 B 441 B	38ms 37ms	XHR image/gif	34.111.208.231 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1721268643330&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&version=2.4 Requested by Host: trk.techtarget.com URL: https://trk.techtarget.com/tracking.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 231.208.111.34.bc.googleusercontent.com Software nginx/1.20.2 / Resource Hash 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363 Request headers ibc_rate_tier 16780454 Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT via 1.1 google x-guploader-uploadid ACJd0Nrv6zH72MmGWhM1xK7t74fx5VF1SQBYfhmLBKnyzWZeV38_2PFosmMd762pvAsf5Eq49ZE x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 last-modified Thu, 08 Dec 2022 21:19:29 GMT server nginx/1.20.2 etag "fc94fb0c3ed8a8f909dbc7630a0987ff" vary Origin x-goog-generation 1670534369365034 content-type image/gif access-control-allow-origin * x-goog-hash crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w== cache-control public, max-age=3600 access-control-allow-methods GET, POST, OPTIONS x-goog-stored-content-length 43 accept-ranges bytes access-control-allow-headers ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range expires Thu, 18 Jul 2024 03:10:43 GMT
OPTIONS H2	200	gif.gif ibc-flow.techtarget.com/a/ Frame	0 0	81ms 25ms	Preflight text/html	34.111.208.231 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1721268643330&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&version=2.4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 231.208.111.34.bc.googleusercontent.com Software nginx/1.20.2 / Resource Hash Request headers Accept */* Access-Control-Request-Headers ibc_rate_tier Access-Control-Request-Method GET Origin https://www.deepinstinct.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-headers ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Thu, 18 Jul 2024 02:10:43 GMT expires Thu, 18 Jul 2024 02:10:43 GMT server nginx/1.20.2 vary Origin via 1.1 google x-guploader-uploadid ACJd0NphCrkxRZJR-SVf27aSsGw5zRD_0VhQGzlqKav7KttdGG42NLWRQHYzowfwoZx9MdbD37s
GET H2	200	ipv cdn.bizible.com/	43 B 305 B	11ms 10ms	Image image/gif	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=61b592485c63430aa3f7980157ee2b98&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&_biz_t=1721268643338&_biz_i=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&_biz_n=0&rnd=487904&cdn_o=a&_biz_z=1721268643343 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nyd/D164) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=31536000; includeSub last-modified Fri, 12 Jul 2024 21:15:24 GMT server ECS (nyd/D164) age 449719 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type image/gif cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 169 B	52ms 9ms	Image image/gif	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=61b592485c63430aa3f7980157ee2b98&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&_biz_t=1721268643346&_biz_i=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&rnd=766434&cdn_o=a&_biz_z=1721268643346 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nyd/D12D) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=31536000; includeSub last-modified Fri, 12 Jul 2024 21:15:24 GMT server ECS (nyd/D12D) age 449719 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type image/gif cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	468591697375107 Show response connect.facebook.net/signals/config/	60 KB 12 KB	19ms 18ms	Script application/x-javascript	2a03:2880:f003:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/468591697375107?v=2.9.162&r=stable&domain=www.deepinstinct.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1eb82bf8694f2ba1c4f5a0da11cb9056cdb27d806efaca9fc19256f9c2a21cdc Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 18 Jul 2024 02:10:43 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 12326 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=20, rtx=0, c=64, mss=1328, tbw=64188, tp=-1, tpl=-1, uplat=1, ullat=-1 pragma public x-fb-debug u7FUbl497y6KRUb6xOsUwVG8GPyirz5HaJtX2so7iNYqc79fPWmndC2RG1N2imRAW5rgCVBmHJ60sgJpVIppQA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	sync s.company-target.com/s/ Frame ADE7	0 0	101ms 24ms	Document text/html	34.96.71.22 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://s.company-target.com/s/sync?exc=lr Requested by Host: tag.demandbase.com URL: https://tag.demandbase.com/8430ce879b38826d.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 22.71.96.34.bc.googleusercontent.com Software / Resource Hash Request headers Referer https://www.deepinstinct.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-methods GET,OPTIONS alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 634 content-type text/html; charset=UTF-8 date Thu, 18 Jul 2024 02:10:43 GMT via 1.1 google
GET H/1.1	200 OK	log segments.company-target.com/ Redirect Chain https://id.rlcdn.com/464526.gif https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCKPz4bQGEgUI6AcQAEIASgA https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297yElcPMcMa8ixe7WK-2oMk_d8d1QuATeCd29HfFDmd7U	26 B 348 B	111ms 30ms	Image image/gif	65.8.20.26 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297yElcPMcMa8ixe7WK-2oMk_d8d1QuATeCd29HfFDmd7U Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol HTTP/1.1 Server 65.8.20.26 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-8-20-26.bos50.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Thu, 18 Jul 2024 02:10:43 GMT Via 1.1 403d64ea8c6435a1c76a47509afa499a.cloudfront.net (CloudFront) X-Amz-Cf-Pop BOS50-C3 X-Cache Miss from cloudfront Content-Type image/gif Connection keep-alive Content-Length 26 X-Amz-Cf-Id qdEbD5lHzPb2blsWsvX_vUGJ-XGeP2TppemF_igJeizZAqxeNrAuCQ== Redirect headers date Thu, 18 Jul 2024 02:10:43 GMT via 1.1 google p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297yElcPMcMa8ixe7WK-2oMk_d8d1QuATeCd29HfFDmd7U cache-control no-cache, no-store timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
GET H2	200	deep-instinct-versus-trellix.json Show response www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/	16 KB 5 KB	105ms 102ms	Fetch application/json	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/deep-instinct-versus-trellix.json?pid=deep-instinct-versus-trellix Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 48d85ab64eb9f7726cebeb2eb1d12ea8104dd45896a2d9eb6e837b66821ab27e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers purpose prefetch x-nextjs-data 1 Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JS2EYES0RB7DQGMDQ5 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000 netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify age 333 cache-status "Next.js"; hit, "Netlify Durable"; fwd=miss, "Netlify Edge"; fwd=stale etag "qyvnv3pgmpcxe-df-df" vary Accept-Encoding content-type application/json x-nextjs-date Thu, 18 Jul 2024 02:10:43 GMT cache-control public,max-age=0,must-revalidate x-nextjs-matched-path /en/[pid]
GET H2	200	%5Bpid%5D-ed9134132e10b8ba.js www.deepinstinct.com/_next/static/chunks/pages/	0 1 KB	19ms 16ms	Other application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JSGXST7V8A6JPP9TSJ date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "15d332bb735e0dafb8bc25db3451253c-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1259
GET H2	200	partners.json Show response www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/	27 KB 7 KB	149ms 146ms	Fetch application/json	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/partners.json?pid=partners Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash ea76bd7940059b80fdc0ebd80e9728e7ed033cdd480d36fb444c2dda1ab66670 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers purpose prefetch x-nextjs-data 1 Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JSDM0XSAJZRQPRJPN3 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000 netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify age 332 cache-status "Next.js"; hit, "Netlify Durable"; fwd=miss, "Netlify Edge"; fwd=stale etag "apyn2x36nflcw-df-df" vary Accept-Encoding content-type application/json x-nextjs-date Thu, 18 Jul 2024 02:10:43 GMT cache-control public,max-age=0,must-revalidate x-nextjs-matched-path /en/[pid]
GET H2	200	blog.json Show response www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/	125 KB 33 KB	25ms 23ms	Fetch application/json	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/blog.json?pid=blog Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 7e21dc21254468fa57097d0b77c4e8fb00802874756facd364657ccafeb69356 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers purpose prefetch x-nextjs-data 1 Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JSG8JP4NGJHKQK1WWR date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000 x-nextjs-date Wed, 17 Jul 2024 22:06:42 GMT age 14654 x-nextjs-matched-path /en/[pid] content-length 33082 netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify cache-status "Netlify Edge"; hit; fwd=stale etag "okw5etivle2qfx-df" vary Accept-Encoding content-type application/json cache-control public,max-age=0,must-revalidate
GET H2	200	1.json Show response www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/author/ivan-kosarev/page/	71 KB 18 KB	132ms 130ms	Fetch application/json	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/author/ivan-kosarev/page/1.json Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 60ead6f7d8e2665837f050d0694b9efa75f85fb215269c7ee326db6b47fbb976 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers purpose prefetch x-nextjs-data 1 Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JS67Y5H822D7DY7DJP date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000 netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify age 323 cache-status "Next.js"; hit; fwd=stale, "Netlify Durable"; fwd=miss, "Netlify Edge"; fwd=stale etag "id535vashz1jn0-df-df" vary Accept-Encoding content-type application/json x-nextjs-date Thu, 18 Jul 2024 02:10:43 GMT cache-control public,max-age=0,must-revalidate x-nextjs-matched-path /en/author/[uid]/page/[pid]
GET H2	200	%5Bpid%5D-dae3acf70331eea3.js www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/	0 4 KB	16ms 15ms	Other application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JS369RHGM4AF6P9Z94 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27312 cache-status "Netlify Edge"; hit etag "cd19cee397474a5badc0b081afba1bd1-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3811
GET H2	200	1.json Show response www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/author/deep-instinct-research/page/	277 KB 68 KB	224ms 222ms	Fetch application/json	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/data/4uXK4YqfXL62tLBLOAJYS/en/author/deep-instinct-research/page/1.json Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 2be2e61fbe14bbe5e55e241e10e4a14420b2c03e1344485e73a8b152b5609211 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers purpose prefetch x-nextjs-data 1 Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JS5VBBCKPG5YTATDC9 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000 netlify-vary header=x-nextjs-data|x-next-debug-logging|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data server Netlify age 322 cache-status "Next.js"; hit; fwd=stale, "Netlify Durable"; fwd=miss, "Netlify Edge"; fwd=stale etag "lb2hlmxv9l61ku-df" vary Accept-Encoding content-type application/json x-nextjs-date Thu, 18 Jul 2024 02:10:43 GMT cache-control public,max-age=0,must-revalidate x-nextjs-matched-path /en/author/[uid]/page/[pid]
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/	2 KB 1 KB	77ms 29ms	Script text/javascript	2607:f8b0:400d:c07::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/?random=1721268643430&cv=11&fst=1721268643430&bg=ffffff&guid=ON&async=1&gtm=45be47h0v9116635018z878451102za201zb78451102&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&hn=www.googleadservices.com&frm=0&tiba=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&npa=0&pscdl=noapi&auid=718609936.1721268643&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c07::9d Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1879319bc8a80826c706f15130e507ddf4fc927a05cc33be774283935b125d21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1400 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	swatch fast.wistia.com/embed/medias/bo2xmiv11n/	4 KB 4 KB	12ms 11ms	Image image/jpeg	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://fast.wistia.com/embed/medias/bo2xmiv11n/swatch Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software envoy / Resource Hash b7d3640ddd6fbbc1ed3f335015b7ab282a47e52eed3d58dd98df46dc7ba2c2d9 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT access-control-request-method * via 1.1 2b0c54ffe9876882253b010d44184bdc.cloudfront.net (CloudFront), 1.1 e8977de5589675c37360cfbb1bfac24a.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 x-cdn cloudfront x-amz-cf-pop IAD89-P2, JFK52-P2 age 96144 edge-cache-tag e0afd3bfa75491ddbbdb81ae864aba3a474d9144 x-cache Miss from cloudfront, HIT, HIT x-envoy-upstream-service-time 126 content-disposition inline content-length 3839 x-served-by cache-iad-kcgs7200106-IAD, cache-lga21970-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 23:20:31 UTC server envoy x-timer S1721268643.469041,VS0,VE3 etag P188Wl9ZGjwlpoG115bFk_d_3F4= vary Origin content-type image/jpeg access-control-allow-origin * cache-control public, no-cache,max-age=31536000 x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-amz-cf-id NCsUPA4u5q7v-zQiM1oYcMcfthfOLEzbYHWEhZznjKF3qd532d_qng== x-cache-hits 42, 0
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 325 B	36ms 35ms	Script text/javascript	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=61b592485c63430aa3f7980157ee2b98&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.07.11 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nyd/D132) / Resource Hash f3e123f696240e5157e5082417ab6e5b65b9281363a2426fcb029e09ef188e58 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSub server ECS (nyd/D132) etag 1D0A9B09 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 219
GET H2	200	NW3rMrxBqJx71BachJFa.json Show response s.swiftypecdn.com/install/v2/config/	19 KB 5 KB	295ms 278ms	XHR application/json	151.101.193.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/install/v2/config/NW3rMrxBqJx71BachJFa.json Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:43 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-permitted-cross-domain-policies none age 0 x-cache MISS content-length 4251 x-xss-protection 1; mode=block x-request-id 5d13e1a8e738f5ebf1c9cc23337587b4 x-served-by cache-lga21938-LGA referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 May 2023 16:51:29 GMT x-timer S1721268644.628267,VS0,VE270 etag W/"0b4dc992c692095d33a1f63f87bd38a6" x-download-options noopen x-frame-options SAMEORIGIN access-control-max-age 7200 access-control-allow-methods GET, POST content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers cache-control max-age=300, public access-control-allow-credentials true vary Accept-Encoding, Origin accept-ranges bytes x-cache-hits 0
POST H2	200	ip.json Show response api.company-target.com/api/v2/	483 B 979 B	133ms 46ms	XHR application/json	65.8.20.75 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&page_title=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.8.20.75 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-8-20-75.bos50.r.cloudfront.net Software nginx / Resource Hash 167d27cbd7f83a52827caf570555d0fffc75e61d3094c14bebb33230acad981e Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 18 Jul 2024 02:10:43 GMT identification-source CENTRAL content-encoding gzip via 1.1 403d64ea8c6435a1c76a47509afa499a.cloudfront.net (CloudFront) x-amz-cf-pop BOS50-C3 x-cache Miss from cloudfront request-id 0171f586-03af-47c1-b7f0-56de85d701c3 pragma no-cache server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 access-control-allow-origin https://www.deepinstinct.com access-control-expose-headers x-amz-cf-id cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true vary Accept-Encoding, Origin api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tQs7tc5-e8u5R_DBZPfFeSt4L19hkAKhC12k8q3HyVH2dpvR6GDofw== expires Wed, 17 Jul 2024 02:10:43 GMT
GET BLOB	200 OK	19f544bd-01a0-48df-b25c-f4939bb60df4 https://www.deepinstinct.com/	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL blob:https://www.deepinstinct.com/19f544bd-01a0-48df-b25c-f4939bb60df4 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Length 43 Content-Type image/gif
GET H2	200	adsct t.co/i/	43 B 376 B	180ms 129ms	Image image/gif	72.21.81.130 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=f7a317c3-e560-4913-91d2-0370e7cbef1e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=33f4e642-9705-4c84-8179-f634be7a15b7&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 72.21.81.130 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-response-time 71 date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=0 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id 925d0f64c1dc6d4a cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash 546a518e342f95de1d62ab54035c9e7b70a76bc892414c8f1ecbf72f721a3a8e content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 392 B	160ms 46ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=f7a317c3-e560-4913-91d2-0370e7cbef1e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=33f4e642-9705-4c84-8179-f634be7a15b7&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-response-time 5 date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=631138519 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id a390a65f95385ef2 cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash c75bda853c23085fac8c3eeee05cd334076292007b498cc21ffb3403f230eb53 content-length 43
GET H2	200	adsct t.co/i/	43 B 250 B	190ms 140ms	Image image/gif	72.21.81.130 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=c3103ad8-8887-4080-895f-01b96ffb06be&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=33f4e642-9705-4c84-8179-f634be7a15b7&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 72.21.81.130 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-response-time 80 date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=0 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id 8ffb03cc80359435 cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash 69d0f0dd6229710e30683be27f6d1020c46ce497273da869e5be0ff652071814 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 214 B	159ms 46ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c3103ad8-8887-4080-895f-01b96ffb06be&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=33f4e642-9705-4c84-8179-f634be7a15b7&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-response-time 6 date Thu, 18 Jul 2024 02:10:43 GMT strict-transport-security max-age=631138519 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id fe434d2ad4f34fd5 cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash c75bda853c23085fac8c3eeee05cd334076292007b498cc21ffb3403f230eb53 content-length 43
GET H2	200	json Show response api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	115 B 1 KB	85ms 55ms	XHR application/json	2606:4700::6812:f46c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=2183098 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f46c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 338bb102cb02ea5d873ff1df529cab30c5b8c52992cd089c20134d2d692bda69 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0a8aed46-d284-43b3-8ca8-2f012a4134bb content-encoding br x-envoy-upstream-service-time 12 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0a8aed46-d284-43b3-8ca8-2f012a4134bb server cloudflare vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.deepinstinct.com x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-7dd59b876-964mk access-control-max-age 180 access-control-allow-credentials false x-evy-trace-virtual-host all report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WAjp0wCM%2BwV4g29g4Mr6Xylp1c5hK9UBW0gjhT%2FBH9e%2FvlFPdf8WNWN%2Fw2JRJbrTYkOsHzKdRvSc5XjjZbVZP85mvqy2tQozdMhwf5kcA8Okafl56npLxvjErqpUzYMpRqJ4Q644AiOTNCkL"}],"group":"cf-nel","max_age":604800} cf-ray 8a4eefe0db32430a-EWR access-control-allow-headers *
GET H2	204	0 bat.bing.com/action/	0 360 B	23ms 22ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=17571311&Ver=2&mid=a02af206-f266-4545-b2f9-7b40994f7f81&sid=f05bcd1044aa11efa75e13fd5fb7c0c3&vid=f05bfd9044aa11efad7b39ce1af729b1&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&kw=Cybersecurity,%20ransomware,%20Blacksuit&p=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&r=&lt=596&evt=pageLoad&sv=1&cdb=AQAQ&rn=200998 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 18 Jul 2024 02:10:43 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 768AC90D165B4D71ABD9D9C5D7A070D9 Ref B: EWR311000104049 Ref C: 2024-07-18T02:10:43Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	332937911623471 Show response connect.facebook.net/signals/config/	22 KB 3 KB	19ms 18ms	Script application/x-javascript	2a03:2880:f003:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/332937911623471?v=2.9.162&r=stable&domain=www.deepinstinct.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108%2C190%2C189%2C191%2C196%2C197%2C198%2C194%2C186%2C125%2C155%2C185%2C187%2C116%2C149%2C138%2C143%2C180%2C122%2C222%2C109%2C121%2C223%2C157%2C113%2C129%2C117%2C146 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 28c5a24a5322fcc266126bc4d9e6af240a171de23108e5a1224465cb87eaff7c Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 18 Jul 2024 02:10:43 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 2873 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=18, rtx=0, c=23, mss=1232, tbw=4328, tp=9, tpl=0, uplat=1, ullat=-1 pragma public x-fb-debug L1SWv82xe2q2MMwc0PA1zS4qkVDjhiwLuPLDLCwOc3qoLS+sGWkSAsAl5YsWmm4lhSKnGUM+Q04fC/0I6slhqg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	204	1665869 Show response vc.hotjar.io/sessions/	0 232 B	160ms 84ms	XHR text/plain	18.161.21.9 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vc.hotjar.io/sessions/1665869?s=0.25&r=0.038854723045692374 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.161.21.9 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-161-21-9.bos50.r.cloudfront.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-origin * date Thu, 18 Jul 2024 02:10:44 GMT cache-control no-store via 1.1 8c1e06e160791fa22f4a732b9aaed82e.cloudfront.net (CloudFront) x-amz-cf-pop BOS50-P1 x-amz-cf-id RLSGfhL6-jU5VTYHLBk70ZmUHazXvfLZmMo1JLV2uQmEKnT4woArIA== x-cache Miss from cloudfront
GET H2	200	new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css s.swiftypecdn.com/assets/	89 KB 33 KB	10ms 10ms	Stylesheet text/css	151.101.193.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css Requested by Host: s.swiftypecdn.com URL: https://s.swiftypecdn.com/install/v2/st.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.167 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-cache-hits 21238 date Thu, 18 Jul 2024 02:10:44 GMT content-encoding gzip via 1.1 varnish age 1225591 x-cache HIT content-length 33983 x-served-by cache-lga21956-LGA x-timer S1721268644.078136,VS0,VE0 etag "667cb064-84bf" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public accept-ranges bytes expires Thu, 03 Jul 2025 21:44:12 GMT
GET H2	200	bg9s Show response tag-logger.demandbase.com/	0 417 B	185ms 78ms	XHR text/html	2600:9000:20ee:4400:1d:8d6d:3b40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=tQs7tc5-e8u5R_DBZPfFeSt4L19hkAKhC12k8q3HyVH2dpvR6GDofw==&api-version=v2 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ee:4400:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-amz-version-id 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH date Wed, 17 Jul 2024 06:21:32 GMT via 1.1 58297de185795c2197e70f8ed29fa5a8.cloudfront.net (CloudFront) x-amz-cf-pop BOS50-C2 age 71499 x-amz-server-side-encryption AES256 x-cache Error from cloudfront content-length 0 last-modified Tue, 07 Mar 2023 20:47:02 GMT server AmazonS3 etag "d41d8cd98f00b204e9800998ecf8427e" vary Accept-Encoding content-type text/html access-control-allow-origin * accept-ranges bytes x-amz-cf-id PJ6Z8gohVx2i7joQRl7vVUhhtg1kcegwb-tuVL1rEth2A1LuW47QPg==
GET H3	200	collect www.google-analytics.com/	35 B 55 B	24ms 23ms	Image image/gif	2607:f8b0:400d:c0d::8a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&a=91302986&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&ul=en-us&de=UTF-8&dt=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDACEABBAAAACAAI~&jid=&gjid=&cid=936595179.1721268643&tid=UA-69598329-1&_gid=94343538.1721268643&gtm=45He47h0n8152PC3MWv78451102za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=Bot&cd5=(Non-Company%20Visitor)&cd6=NY&cd7=US&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&z=1034473234 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c0d::8a Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Wed, 17 Jul 2024 08:12:48 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 64676 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	260 KB 90 KB	30ms 30ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-812608847 Requested by Host: js.hsadspixel.net URL: https://js.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4f59bc329f080a9611da83b58627d71096912896e104db8fc7e09a6e5643e0bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91795 x-xss-protection 0 last-modified Thu, 18 Jul 2024 00:55:04 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 18 Jul 2024 02:10:44 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	260 KB 90 KB	35ms 35ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-812608847&l=dataLayer&cx=c Requested by Host: www.googleoptimize.com URL: https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 3b81fa4cf166a8eb29c2670c138de1152f471375b57ff956a191a194e1ce8b40 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91754 x-xss-protection 0 last-modified Thu, 18 Jul 2024 00:55:04 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 18 Jul 2024 02:10:44 GMT
GET H3	200	/ www.google.com/pagead/1p-user-list/812608847/	42 B 64 B	68ms 32ms	Image image/gif	2607:f8b0:4004:c1f::63 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/812608847/?random=1721268643430&cv=11&fst=1721268000000&bg=ffffff&guid=ON&async=1&gtm=45be47h0v9116635018z878451102za201zb78451102&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&hn=www.googleadservices.com&frm=0&tiba=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&npa=0&pscdl=noapi&auid=718609936.1721268643&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDaQooLcMxxxX4KYzDzeZGMbR8tXBebl6MIbw&random=832269224&rmt_tld=0&ipr=y Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1f::63 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:44 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 199 B	83ms 82ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept * Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 18 Jul 2024 02:10:43 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 690DCE58BBA5494086CBC075D18512E0 Ref B: EWR30EDGE1011 Ref C: 2024-07-18T02:10:44Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.deepinstinct.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYdfBYZBmq//9BLg1R8+g==
GET H2	200	googleAnalytics4.js Show response fast.wistia.com/assets/external/	24 KB 6 KB	14ms 13ms	Script text/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/assets/external/googleAnalytics4.js Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash b2ac19f65b396b5b786662fd04f055f47fce6f8b4888c13a2b3a2f2c9dc8d1c5 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1665 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 5983 x-served-by cache-iad-kiad7000091-IAD, cache-lga21970-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 14:48:48 GMT server AmazonS3 x-timer S1721268644.152654,VS0,VE0 etag "eca87ec61e5cf836d235f6cbc7fa3ccc" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome asset-version 2bd36ef2cf79e0d4c6a9f7fd609491b19a6c23e0 x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 22, 11
GET H2	200	/ www.facebook.com/tr/	0 274 B	62ms 15ms	Image text/plain	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&rl=&if=false&ts=1721268644161&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1721268644159.80529323870781392&ler=empty&cdl=API_unavailable&it=1721268643365&coo=false&rqm=GET Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=11, rtx=0, c=10, mss=1328, tbw=2833, tp=-1, tpl=-1, uplat=1, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Thu, 18 Jul 2024 02:10:44 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 4 KB	127ms 81ms	Image image/png	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&rl=&if=false&ts=1721268644161&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1721268644159.80529323870781392&ler=empty&cdl=API_unavailable&it=1721268643365&coo=false&rqm=FGET Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1f6c6a85a3ac8fbe","source_keys":["1","2"]},{"key_piece":"0xf52ebe074584e098","source_keys":["1","2"]}],"aggregatable_values":{"1":1}} content-encoding zstd x-content-type-options nosniff content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; strict-transport-security max-age=15552000; preload document-policy force-load-at-top date Thu, 18 Jul 2024 02:10:44 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7392792533794467827", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=12, rtx=0, c=12, mss=1328, tbw=3254, tp=-1, tpl=-1, uplat=63, ullat=1 pragma no-cache x-fb-debug IyPFuZ48EzqKxZtxG03rTKEBmatQfKOKNa0ftFrQhhWi3qeOW4G/iWju9nmiWiyC7BSCmur/S/ijH3dQDLT6WA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7392792533794467827"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/png x-frame-options DENY origin-agent-cluster ?0 cache-control private, no-store, no-cache, must-revalidate permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 103 B	60ms 14ms	Image text/plain	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&rl=&if=false&ts=1721268644163&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1721268644159.80529323870781392&ler=empty&cdl=API_unavailable&it=1721268643365&coo=false&rqm=GET Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=11, rtx=0, c=10, mss=1328, tbw=2833, tp=-1, tpl=-1, uplat=0, ullat=1 strict-transport-security max-age=31536000; includeSubDomains date Thu, 18 Jul 2024 02:10:44 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 1 KB	137ms 91ms	Image image/png	2a03:2880:f103:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&rl=&if=false&ts=1721268644163&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1721268644159.80529323870781392&ler=empty&cdl=API_unavailable&it=1721268643365&coo=false&rqm=FGET Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xc432d2605b532c55","source_keys":["1","2"]},{"key_piece":"0x10c8d240997579bc","source_keys":["1","2"]}],"aggregatable_values":{"1":1}} content-encoding zstd x-content-type-options nosniff content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; strict-transport-security max-age=15552000; preload document-policy force-load-at-top date Thu, 18 Jul 2024 02:10:44 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7392792534092873841", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=12, rtx=0, c=12, mss=1328, tbw=6965, tp=-1, tpl=-1, uplat=77, ullat=0 pragma no-cache x-fb-debug PDPwRwswXespoVT9OVq0fizmRs2oWhDgxKtf0tNSlq5d6Il5bt5SHYOJ+eujKs0+PtsvIpWA+97NYOuq77+epg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7392792534092873841"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/png x-frame-options DENY origin-agent-cluster ?0 cache-control private, no-store, no-cache, must-revalidate permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	cc.js cc.swiftype.com/	43 B 279 B	301ms 52ms	Image image/gif	169.63.31.198 SOFTLAYER
General Check archive.org Show headers Download Go to Show image Full URL https://cc.swiftype.com/cc.js?engine_key=zPgdszsQivuSeQwTEHrm&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.63.31.198 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS c6.1f.3fa9.ip4.static.sl-reverse.com Software / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/gif Date Thu, 18 Jul 2024 02:10:44 GMT Cache-Control no-cache Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Connection keep-alive Content-Length 43 Expires Thu, 18 Jul 2024 02:10:43 GMT
GET H/1.1	200 OK	messenger app.qualified.com/w/1/DxHYmKWTScn3buDp/ Frame 7614	0 0	182ms 31ms	Document text/html	54.224.18.24 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=d6cfcbac-8230-4c98-a00a-f10487ecb864 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.224.18.24 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-224-18-24.compute-1.amazonaws.com Software / Resource Hash Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.deepinstinct.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1662 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Thu, 18 Jul 2024 02:10:44 GMT Etag W/"81651cdde5a06db8065ddce8252ab239" Link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (42359e36e9bb) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id 0927c856-c4f6-7f73-7a5b-dd22f1519acc X-Runtime 0.015838 X-Xss-Protection 1; mode=block
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/	3 KB 1 KB	29ms 28ms	Script text/javascript	2607:f8b0:400d:c07::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812608847/?random=1721268644270&cv=11&fst=1721268644270&bg=ffffff&guid=ON&async=1&gtm=45be47h0v9116635018za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&hn=www.googleadservices.com&frm=0&tiba=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=718609936.1721268643&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-812608847 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c07::9d Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 95e6b2f173ded5d19e7cd7827dc6b486dee3435e36dc8528c5af447ca2b31d93 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1435 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	305 KB 102 KB	43ms 43ms	Script application/javascript	2607:f8b0:400d:c01::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/googleAnalytics4.js Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:400d:c01::61 Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 26dc995ad295abf3a67a9d410fd61fef476e9c8df94562f8a8248669501cb1b4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 104593 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Jul 2024 02:10:44 GMT
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 14328f67af6b839ac4f57c7e5c2b32ef51e9d2d0f6532731120d1c989f8476f2 Request headers Referer Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type application/x-font-woff;charset=utf-8
GET H2	200	e0afd3bfa75491ddbbdb81ae864aba3a474d9144.webp embed-ssl.wistia.com/deliveries/	134 KB 135 KB	125ms 29ms	Image image/webp	2600:9000:26dd:7c00:1e:c86:4140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://embed-ssl.wistia.com/deliveries/e0afd3bfa75491ddbbdb81ae864aba3a474d9144.webp?image_crop_resized=1374x720 Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26dd:7c00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 65e4e8a2e523349a65c1280090a937a06cc88a6b16f9ea794ce20cea135f91bd Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 17 Jul 2024 12:55:24 GMT access-control-request-method * via 1.1 bcb27567a77dcc9895a46a953f4c4938.cloudfront.net (CloudFront) x-cdn cloudfront x-amz-cf-pop BOS50-P3 age 47720 edge-cache-tag e0afd3bfa75491ddbbdb81ae864aba3a474d9144 x-cache Hit from cloudfront x-envoy-upstream-service-time 249 content-disposition inline surrogate-key e0afd3bfa75491ddbbdb81ae864aba3a474d9144 thumbnail-delivery last-modified Tue, 16 Jul 2024 23:20:31 UTC server envoy etag c4XYATkqqTTgGwZBOxDkEo7nLUE= vary Origin content-type image/webp cache-control max-age=31536000 accept-ranges none x-amz-cf-id xPvATzJ4vxCbBG9jKQbnkRkta46f9hsZvAdfi-6JPUauvrjkAD3hKQ==
GET H3	200	/ www.google.com/pagead/1p-user-list/812608847/	42 B 64 B	37ms 36ms	Image image/gif	2607:f8b0:4004:c1f::63 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/812608847/?random=1721268644270&cv=11&fst=1721268000000&bg=ffffff&guid=ON&async=1&gtm=45be47h0v9116635018za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&hn=www.googleadservices.com&frm=0&tiba=Deep%20Dive%3A%20Exposing%20BlackSuit%20Ransomware&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=718609936.1721268643&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooL8gPXjpe0VrrV1mML3qhdk80CdMUMpQzdsLKWfqvRAXyy9p29&random=2449956250&rmt_tld=0&ipr=y Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1f::63 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 18 Jul 2024 02:10:44 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	%5Bpid%5D-ed9134132e10b8ba.js Show response www.deepinstinct.com/_next/static/chunks/pages/	5 KB 0	1ms 0ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JSGXST7V8A6JPP9TSJ date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br server Netlify age 27759 cache-status "Netlify Edge"; hit etag "15d332bb735e0dafb8bc25db3451253c-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1259
GET H2	200	7e11275f8e6fc085.css Show response www.deepinstinct.com/_next/static/css/	14 KB 3 KB	17ms 16ms	Fetch text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/7e11275f8e6fc085.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SPAHDEAK8JH0SXVG532N3 date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27759 cache-status "Netlify Edge"; hit etag "a08d329af0ca27ab60ede65e07cd2abf-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3169
GET H2	200	%5Bpid%5D-dae3acf70331eea3.js Show response www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/	10 KB 0	1ms 1ms	Script application/javascript	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SP9JS369RHGM4AF6P9Z94 date Thu, 18 Jul 2024 02:10:43 GMT content-encoding br server Netlify age 27312 cache-status "Netlify Edge"; hit etag "cd19cee397474a5badc0b081afba1bd1-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3811
GET H2	200	b5a64cbe6880b7dc.css Show response www.deepinstinct.com/_next/static/css/	16 KB 4 KB	16ms 15ms	Fetch text/css	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/_next/static/css/b5a64cbe6880b7dc.css Requested by Host: www.deepinstinct.com URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SPAHDSB958CGS954CZJ3Z date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 27313 cache-status "Netlify Edge"; hit etag "a85bff580d8ffd9cf629505d2f37a034-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 3640
GET H2	200	playPauseLoadingControl.js Show response fast.wistia.com/assets/external/	81 KB 22 KB	25ms 8ms	Script text/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/assets/external/playPauseLoadingControl.js Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1ae37538ceacf2b3b1bac1208621fbd98393d4f3a402931ce7ffda5cb73245dd Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1327 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 21819 x-served-by cache-iad-kjyo7100115-IAD, cache-lga21930-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 14:48:48 GMT server AmazonS3 x-timer S1721268645.951176,VS0,VE0 etag "66d2391bf93be270dc0b6ebe090be9cb" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome asset-version 2bd36ef2cf79e0d4c6a9f7fd609491b19a6c23e0 x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 47, 110
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	85ms 55ms	Image image/gif	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=533429052&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&t=Deep+Dive%3A+Exposing+BlackSuit+Ransomware&cts=1721268644939&vi=55e77c21310373d6248764db6f38aab7&nc=true&u=160033954.55e77c21310373d6248764db6f38aab7.1721268644934.1721268644934.1721268644934.1&b=160033954.1.1721268644934&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 1e6efec4-1852-482d-a22c-21732f027347 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 11 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 1e6efec4-1852-482d-a22c-21732f027347 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8m27sXYwAcbKhTU%2BTqe%2BewQGXKGrNZVjPcw61a0uc6NA0PHEJ56WDe1a3xKTWGsZQiOOhWGGSv0qaeoUU4NtNMRQi3Do6jMfhhbIZt0gDEz3BKT5U2NIDcZkoeL1QXuO%2BT3%2FKxyNqtovC5kz2QEa"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-cztsk x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8a4eefe7188041a9-EWR x-robots-tag none
GET H2	200	hls_video.js Show response fast.wistia.com/assets/external/engines/	510 KB 125 KB	15ms 11ms	Script text/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/assets/external/engines/hls_video.js Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 827d9260911830f9fc5f799abc6b84f5b7d116101ac969a55a3271e46a914a59 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:44 GMT content-encoding br via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1395 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 127761 x-served-by cache-iad-kjyo7100094-IAD, cache-lga21930-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 14:48:48 GMT server AmazonS3 x-timer S1721268645.951303,VS0,VE0 etag "2f775b894830b4770275e4a7ef486fd5" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome asset-version 2bd36ef2cf79e0d4c6a9f7fd609491b19a6c23e0 x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 39, 50
POST H2	200	mput Show response pipedream.wistia.com/	2 B 330 B	63ms 28ms	Fetch text/plain	2600:9000:20ee:7200:3:471f:5240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pipedream.wistia.com/mput?topic=metrics Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ee:7200:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 18 Jul 2024 02:10:44 GMT via 1.1 cd9c85933a60bbac347299c34015e9ba.cloudfront.net (CloudFront) server envoy x-amz-cf-pop BOS50-C2 x-cache Miss from cloudfront access-control-allow-methods POST, OPTIONS access-control-allow-origin * content-type text/plain; charset=utf-8 x-envoy-upstream-service-time 0 content-length 2 x-amz-cf-id atRrqzuMQlndM0UY6ZE_E1zkO59YJRz6adukEOBZBc858GR74DpHpw==
POST H2	204	x distillery.wistia.com/	0 0	97ms 30ms	Fetch	65.8.20.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://distillery.wistia.com/x Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.8.20.120 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-8-20-120.bos50.r.cloudfront.net Software envoy / Resource Hash Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain Response headers date Thu, 18 Jul 2024 02:10:45 GMT via 1.1 c8e6799b2083efb532f5d57e76bd09ea.cloudfront.net (CloudFront) server envoy x-amz-cf-pop BOS50-C3 x-cache Miss from cloudfront access-control-allow-origin * cache-control max-age=0, private, must-revalidate x-envoy-upstream-service-time 1 x-amz-cf-id 4MdRb5E9jbHpWGMn3CjGHqQv7waErO6Auacz7vKtDbjY-LW8JBpuQg==
GET H2	200	favicon-32x32.png www.deepinstinct.com/favicon/	1 KB 1 KB	18ms 14ms	Other image/png	2600:1f18:2489:8200::c8 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.deepinstinct.com/favicon/favicon-32x32.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:2489:8200::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash 5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.deepinstinct.com/blog/deep-dive-exposing-stealthy-new-blacksuit-ransomware User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-nf-request-id 01J31SPB37Z5GVG1390JE44HK4 date Thu, 18 Jul 2024 02:10:44 GMT strict-transport-security max-age=31536000 server Netlify age 27757 cache-status "Netlify Edge"; hit etag "6c3361589f0d0f46f3458658f29255f6-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1056
GET H2	200	blank.gif fast.wistia.com/assets/images/	1 KB 1 KB	11ms 10ms	Image image/gif	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://fast.wistia.com/assets/images/blank.gif Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/engines/hls_video.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://www.deepinstinct.com/ Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1591 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 1214 x-served-by cache-iad-kcgs7200077-IAD, cache-lga21930-LGA x-browser-version 126 last-modified Wed, 10 May 2023 19:48:54 GMT server AmazonS3 x-timer S1721268645.080146,VS0,VE0 etag "fbdc4ed9a1e2ee4917a265306927bcf1" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type image/gif access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 6387208, 109
GET H2	200	bo2xmiv11n.m3u8 Show response fast.wistia.com/embed/medias/	754 B 1 KB	11ms 10ms	XHR application/x-mpegurl	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/embed/medias/bo2xmiv11n.m3u8 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software envoy / Resource Hash eb139a92d8ca4a46cf8115f6aef7107ee61a567125eae3426c3bc0f73676fb34 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT via 1.1 d4b41c13595dcfd327649d8cdea72ce8.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=0 x-permitted-cross-domain-policies none x-amz-cf-pop IAD89-C3 age 96195 x-cache Miss from cloudfront, HIT, HIT x-envoy-upstream-service-time 32 content-length 754 x-request-id 2fa811c7-13bf-4e3e-845e-40c4ee1ddbe8 x-served-by cache-iad-kiad7000050-IAD, cache-lga21930-LGA x-runtime 0.030664 x-browser-version 126 server envoy x-timer S1721268645.090205,VS0,VE1 etag W/"eb139a92d8ca4a46cf8115f6aef7107e" vary Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override content-type application/x-mpegURL access-control-allow-origin * cache-control public, no-cache x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-amz-cf-id rOtAEfqjyqCREoGKegfUCGdRgnuGXdQNsHpMLH0n_12vxQ5hj3e31A== x-cache-hits 15, 0
GET H2	200	a3591ba5e949a37083cc6f5a4191e903.min.js Show response js.sentry-cdn.com/	3 KB 2 KB	35ms 8ms	Script text/javascript	2a04:4e42:600::729 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js.sentry-cdn.com/a3591ba5e949a37083cc6f5a4191e903.min.js Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:600::729 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2d9e600cc97a563d568d616671db47dac1576938a377d50e92c3d0d250e14ba3 Security Headers Name Value Content-Security-Policy object-src 'none'; default-src 'none'; media-src *; style-src * 'unsafe-inline'; frame-ancestors 'self' *.sentry.io; base-uri 'none'; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; script-src 'self' 'unsafe-inline' 'report-sample' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; font-src * data:; worker-src blob:; img-src * blob: data:; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=e663b0d01c7341739c97f74a6bb75d9c5a40a1df Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://www.deepinstinct.com/ Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-security-policy object-src 'none'; default-src 'none'; media-src *; style-src * 'unsafe-inline'; frame-ancestors 'self' *.sentry.io; base-uri 'none'; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; script-src 'self' 'unsafe-inline' 'report-sample' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; font-src * data:; worker-src blob:; img-src * blob: data:; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=e663b0d01c7341739c97f74a6bb75d9c5a40a1df content-encoding gzip x-content-type-options nosniff date Thu, 18 Jul 2024 02:10:45 GMT strict-transport-security max-age=31536000; includeSubDomains age 31 x-envoy-upstream-service-time 20 content-length 1299 x-xss-protection 1; mode=block x-served-by getsentry-web-default-common-production-7765d96c67-ljkhc, cache-chi-klot8100079-CHI, cache-lga21974-LGA x-frame-options deny vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000 x-envoy-attempt-count 1 accept-ranges bytes timing-allow-origin *
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	2 KB 2 KB	88ms 63ms	XHR application/json	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=2183098&utk=55e77c21310373d6248764db6f38aab7&__hstc=160033954.55e77c21310373d6248764db6f38aab7.1721268644934.1721268644934.1721268644934.1&__hssc=160033954.1.1721268644934&currentUrl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd057f2625224684109357bac6a53ce4f4c805cccbc5962f1d6d67efda1f4d92 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id a31926bc-338b-4fa1-8fcf-3a1d09797865 x-envoy-upstream-service-time 25 content-length 899 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a31926bc-338b-4fa1-8fcf-3a1d09797865 server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.deepinstinct.com x-evy-trace-virtual-host all cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-ptpxr access-control-max-age 180 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C28lKsFKSc1DwduTsUOOQ%2FgcnmxIn1blgqlQPnq%2BwI5igsX4iaKw2jUlm11eXHesRELQEsFAwVefThJZuNH0lowL%2Fnhxnq9eXA5mWh3k2Db48gN%2FYFEfHKPTcGILcLxdWw7PC6IEcjNpykffJ4kx"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8a4eefe81818435c-EWR
GET H2	200	3e08bff4eeaf6f5c1e400f3225367f37d96d7494.m3u8 Show response embed-cloudfront.wistia.com/deliveries/	2 KB 2 KB	57ms 28ms	XHR application/vnd.apple.mpegurl	2600:9000:26dd:7200:1e:c86:4140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embed-cloudfront.wistia.com/deliveries/3e08bff4eeaf6f5c1e400f3225367f37d96d7494.m3u8 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26dd:7200:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash c8a75515ed9c5318dfb4a438e09e3d849ac03185e41bae22ca30951ec9675e7b Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 17 Jul 2024 12:55:25 GMT via 1.1 7c9cfa087c0ef457593c1e12ecfc5ca8.cloudfront.net (CloudFront) x-cdn cloudfront x-amz-cf-pop BOS50-P3 age 47720 edge-cache-tag 3e08bff4eeaf6f5c1e400f3225367f37d96d7494-hls-segment x-cache Hit from cloudfront x-envoy-upstream-service-time 188 content-length 1818 surrogate-key 3e08bff4eeaf6f5c1e400f3225367f37d96d7494-hls-segment last-modified Mon, 05 Nov 2018 10:11:00 GMT server envoy content-type application/vnd.apple.mpegurl access-control-allow-origin * access-control-expose-headers Server,range,Content-Length,Content-Range,x-cdn cache-control max-age=31536000 accept-ranges bytes x-amz-cf-id G3bpM1Felw8attuUJbI7UBwODg9VmHcX1VlQQfPjSALwCxCX-ilmiQ== expires Thu, 17 Jul 2025 12:55:25 GMT
GET H2	200	seg-1-v1-a1.ts Show response embed-cloudfront.wistia.com/deliveries/3e08bff4eeaf6f5c1e400f3225367f37d96d7494.m3u8/	200 KB 201 KB	30ms 30ms	XHR video/mp2t	2600:9000:26dd:7200:1e:c86:4140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embed-cloudfront.wistia.com/deliveries/3e08bff4eeaf6f5c1e400f3225367f37d96d7494.m3u8/seg-1-v1-a1.ts Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26dd:7200:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash bbf196743734f15ae8a0496c7137f6c7429847a94a79d57ac563dcd2f65c64f3 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 17 Jul 2024 12:55:25 GMT via 1.1 7c9cfa087c0ef457593c1e12ecfc5ca8.cloudfront.net (CloudFront) x-cdn cloudfront x-amz-cf-pop BOS50-P3 age 47720 edge-cache-tag 3e08bff4eeaf6f5c1e400f3225367f37d96d7494-hls-segment x-cache Hit from cloudfront x-envoy-upstream-service-time 81 content-length 204920 surrogate-key 3e08bff4eeaf6f5c1e400f3225367f37d96d7494-hls-segment last-modified Mon, 05 Nov 2018 10:11:00 GMT server envoy content-type video/MP2T access-control-allow-origin * access-control-expose-headers Server,range,Content-Length,Content-Range,x-cdn cache-control max-age=31536000 accept-ranges bytes x-amz-cf-id GC9iew6YWpYFF00jvxkOcW1ILBYLaktWsdXC9JpPrSeYtG3lpoXLhA== expires Thu, 17 Jul 2025 12:55:25 GMT
GET H3	200	enterprise.js Show response www.google.com/recaptcha/	1 KB 992 B	32ms 31ms	Script text/javascript	2607:f8b0:4004:c1f::63 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/enterprise.js?render=explicit Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1f::63 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash c3c0307d8139cc09952eda74747e00e8385214244a4bbdfb3d9f13ce308a9f4b Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Thu, 18 Jul 2024 02:10:45 GMT
GET H2	200	__ptq.gif track.hubspot.com/	45 B 433 B	52ms 51ms	Image image/gif	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=16&fi=edf3154a-9058-41f2-8bd8-5f0fc6bddce4&lfi=2584648&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=533429052&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdeep-dive-exposing-stealthy-new-blacksuit-ransomware&t=Deep+Dive%3A+Exposing+BlackSuit+Ransomware&cts=1721268645205&vi=55e77c21310373d6248764db6f38aab7&nc=true&u=160033954.55e77c21310373d6248764db6f38aab7.1721268644934.1721268644934.1721268644934.1&b=160033954.1.1721268644934&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6465b954-a187-4a43-99a1-f3a45e0b78a4 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 11 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6465b954-a187-4a43-99a1-f3a45e0b78a4 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cdgOjiPbR95BAL5Jfd2Fm8TqRjOml7MOHvZZA%2BU2nZeXrfgZ9zs7kjUzKqipZiEYZMQBJJlFCUd2gW4oVeFY%2FwewYSUssoDaYQtksYrnYOpLEris7YkudV6NNvsf3sTXLdH1RGGwiAAh5zCMZU7a"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-rt7tr x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8a4eefe89a5741a9-EWR x-robots-tag none
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/	534 KB 212 KB	50ms 16ms	Script text/javascript	2607:f8b0:4004:c09::5e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/enterprise.js?render=explicit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c09::5e Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.deepinstinct.com/ Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 17 Jul 2024 19:18:01 GMT content-encoding gzip x-content-type-options nosniff age 24764 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 216123 x-xss-protection 0 last-modified Sun, 23 Jun 2024 08:01:07 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 17 Jul 2025 19:18:01 GMT
GET H2	200	09b959e1627a853b698c0e9f1ae24a66943be0ce.m3u8 Show response embed-cloudfront.wistia.com/deliveries/	2 KB 2 KB	28ms 28ms	XHR application/vnd.apple.mpegurl	2600:9000:26dd:7200:1e:c86:4140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://embed-cloudfront.wistia.com/deliveries/09b959e1627a853b698c0e9f1ae24a66943be0ce.m3u8 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26dd:7200:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 657c8d435667e90efddf2d1fd029260a55b49cb61dfdc6442de8a73ca7da489b Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 17 Jul 2024 16:58:56 GMT via 1.1 7c9cfa087c0ef457593c1e12ecfc5ca8.cloudfront.net (CloudFront) x-cdn cloudfront x-amz-cf-pop BOS50-P3 age 33109 edge-cache-tag 09b959e1627a853b698c0e9f1ae24a66943be0ce-hls-segment x-cache Hit from cloudfront x-envoy-upstream-service-time 193 content-length 1818 surrogate-key 09b959e1627a853b698c0e9f1ae24a66943be0ce-hls-segment last-modified Mon, 05 Nov 2018 10:11:00 GMT server envoy content-type application/vnd.apple.mpegurl access-control-allow-origin * access-control-expose-headers Server,range,Content-Length,Content-Range,x-cdn cache-control max-age=31536000 accept-ranges bytes x-amz-cf-id ELlvQCl3US3bhx8wlXBk7EnCfd1dwl-GF4aVlXHJk-f77wvfXll9vg== expires Thu, 17 Jul 2025 16:58:56 GMT
POST H2	200	mput Show response pipedream.wistia.com/	2 B 327 B	28ms 26ms	Fetch text/plain	2600:9000:20ee:7200:3:471f:5240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pipedream.wistia.com/mput?topic=metrics Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ee:7200:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 18 Jul 2024 02:10:45 GMT via 1.1 cd9c85933a60bbac347299c34015e9ba.cloudfront.net (CloudFront) server envoy x-amz-cf-pop BOS50-C2 x-cache Miss from cloudfront access-control-allow-methods POST, OPTIONS access-control-allow-origin * content-type text/plain; charset=utf-8 x-envoy-upstream-service-time 1 content-length 2 x-amz-cf-id 5yNa86rqp_47aECD9SITqRApi17FctzyJoTJlapl-KNMOoMh4SNt5w==
GET H2	200	allIntegrations.js Show response fast.wistia.com/assets/external/	48 KB 12 KB	10ms 9ms	Script text/javascript	2a04:4e42::644 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.com/assets/external/allIntegrations.js Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/E-v1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::644 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ed2bc704e3fc26b8ee33210578b918016eab1d881e7db60e44e4afbbeeb5b2fd Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer Origin https://www.deepinstinct.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 18 Jul 2024 02:10:45 GMT content-encoding br via 1.1 varnish, 1.1 varnish strict-transport-security max-age=0 age 1375 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 12251 x-served-by cache-iad-kjyo7100031-IAD, cache-lga21930-LGA x-browser-version 126 last-modified Tue, 16 Jul 2024 14:48:47 GMT server AmazonS3 x-timer S1721268646.947601,VS0,VE0 etag "c71c49acde6f4cac3c778ccc6f496292" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/javascript access-control-allow-origin * cache-control public, max-age=3600 x-browser chrome asset-version 2bd36ef2cf79e0d4c6a9f7fd609491b19a6c23e0 x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 50, 79
POST H2	200	mput Show response pipedream.wistia.com/	2 B 328 B	26ms 25ms	Fetch text/plain	2600:9000:20ee:7200:3:471f:5240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pipedream.wistia.com/mput?topic=metrics Requested by Host: fast.wistia.com URL: https://fast.wistia.com/assets/external/allIntegrations.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ee:7200:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://www.deepinstinct.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Thu, 18 Jul 2024 02:10:46 GMT via 1.1 cd9c85933a60bbac347299c34015e9ba.cloudfront.net (CloudFront) server envoy x-amz-cf-pop BOS50-C2 x-cache Miss from cloudfront access-control-allow-methods POST, OPTIONS access-control-allow-origin * content-type text/plain; charset=utf-8 x-envoy-upstream-service-time 1 content-length 2 x-amz-cf-id C6rYuocMg3hxSYbVxLTzK3xilOEUeTerWVgoL55H50m7Jqp3j8HQIw==