claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Submission: On April 16 via api (April 16th 2024, 2:10:38 am UTC) from TR — Scanned from DE

Summary HTTP 90 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 33 IPs in 5 countries across 28 domains to perform 90 HTTP transactions. The main IP is 138.197.228.97, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is claroty.com. The Cisco Umbrella rank of the primary domain is 187594.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 13th 2024. Valid for: a year.

This is the only time claroty.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	138.197.228.97 138.197.228.97	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
4	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8e77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
3	104.18.176.125 104.18.176.125	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.192.39 18.66.192.39	16509 (AMAZON-02) (AMAZON-02)
1	108.138.36.118 108.138.36.118	16509 (AMAZON-02) (AMAZON-02)
6	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	104.18.192.125 104.18.192.125	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
2	142.250.74.195 142.250.74.195	15169 (GOOGLE) (GOOGLE)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.20.195.32 52.20.195.32	14618 (AMAZON-AES) (AMAZON-AES)
1	54.230.228.47 54.230.228.47	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e41	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:6cfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e4a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.132 142.250.185.132	15169 (GOOGLE) (GOOGLE)
1	52.50.100.69 52.50.100.69	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
90	33

14 138.197.228.97 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

claroty.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8e77 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.176.125 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.192.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-39.muc50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.36.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-36-118.muc50.r.cloudfront.net

static.oktopost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.192.125 (None, )

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.74.195 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.20.195.32 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-195-32.compute-1.amazonaws.com

okt.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.228.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-228-47.muc50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e41 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6cfe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e4a3 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon-globalaccelerator.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.100.69 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-100-69.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	claroty.com claroty.com — Cisco Umbrella Rank: 187594	392 KB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 5929 c.6sc.co — Cisco Umbrella Rank: 9143 ipv6.6sc.co — Cisco Umbrella Rank: 6057 b.6sc.co — Cisco Umbrella Rank: 3901	20 KB
11	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1784 ka-p.fontawesome.com — Cisco Umbrella Rank: 3249	26 KB
6	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4738 ws-assets.zoominfo.com — Cisco Umbrella Rank: 11768	29 KB
5	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4261 forms-na1.hsforms.com — Cisco Umbrella Rank: 6850 perf-na1.hsforms.com — Cisco Umbrella Rank: 4554	7 KB
4	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 4232 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4182 track.hubspot.com — Cisco Umbrella Rank: 2418	28 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	346 KB
4	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2232	32 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 7050	3 KB
3	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 340 px4.ads.linkedin.com — Cisco Umbrella Rank: 6380	2 KB
2	6sense.com epsilon-globalaccelerator.6sense.com — Cisco Umbrella Rank: 72098	327 B
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4586 forms.hscollectedforms.net — Cisco Umbrella Rank: 4713	26 KB
2	google.de www.google.de — Cisco Umbrella Rank: 7551	126 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 87	402 B
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3076 www.google.com — Cisco Umbrella Rank: 2	314 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	21 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 756 script.hotjar.com — Cisco Umbrella Rank: 1167	59 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	865 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6524	161 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3170	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2238	22 KB
1	okt.to okt.to — Cisco Umbrella Rank: 34629	100 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2510	1 KB
1	oktopost.com static.oktopost.com — Cisco Umbrella Rank: 40677	4 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 822	17 KB
1	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 6698	155 KB
1	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7698	25 KB
90	28

	Domain	Requested by
14	claroty.com	claroty.com
10	ka-p.fontawesome.com	kit.fontawesome.com claroty.com
9	b.6sc.co	claroty.com
5	ws.zoominfo.com	claroty.com js.zi-scripts.com ws-assets.zoominfo.com
4	www.googletagmanager.com	claroty.com www.googletagmanager.com
4	js.hs-banner.com	claroty.com js.hs-scripts.com js.hs-banner.com
3	js.zi-scripts.com	claroty.com js.zi-scripts.com
3	forms.hsforms.com	js.hsforms.net claroty.com
2	track.hubspot.com
2	epsilon-globalaccelerator.6sense.com	cdn.bizible.com
2	px.ads.linkedin.com	1 redirects cdn.bizible.com
2	www.google.de	claroty.com
2	stats.g.doubleclick.net	www.googletagmanager.com cdn.bizible.com
2	www.google-analytics.com	www.googletagmanager.com cdn.bizible.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	fonts.gstatic.com	fonts.googleapis.com
1	perf-na1.hsforms.com	claroty.com
1	fonts.googleapis.com	js.hs-banner.com
1	forms.hscollectedforms.net	cdn.bizible.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	content.hotjar.io	cdn.bizible.com
1	www.google.com	claroty.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	ipv6.6sc.co	cdn.bizible.com
1	c.6sc.co	cdn.bizible.com
1	script.hotjar.com	static.hotjar.com
1	okt.to	static.oktopost.com
1	px4.ads.linkedin.com	claroty.com
1	region1.analytics.google.com	www.googletagmanager.com
1	forms-na1.hsforms.com	claroty.com
1	j.6sc.co	claroty.com
1	js.hs-scripts.com	www.googletagmanager.com
1	static.oktopost.com	claroty.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	kit.fontawesome.com	claroty.com
1	js.hsforms.net	claroty.com
1	cdn.bizible.com	claroty.com
90	41

This site contains links to these domains. Also see Links.

Domain
ruexfil.com
www.infosecurity-magazine.com
christianbaghai.medium.com
ao-sbk.ru
extract_sensor_info.html
youtu.be
irz.net
openwrt.org
shodan.io
www.oreilly.com
en.wikipedia.org
www.kernel.org
elixir.bootlin.com
m-bus.com
github.com
www.linkedin.com
twitter.com
www.facebook.com
claroty-staging.com
portal.claroty.com
nexusconnect.io
www.youtube.com

Subject Issuer	Validity	Valid
*.claroty.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-13` - `2025-03-14`	a year	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
hsforms.net GTS CA 1P5	`2024-04-15` - `2024-07-14`	3 months	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-18` - `2024-05-17`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.oktopost.com Amazon RSA 2048 M01	`2023-08-29` - `2024-09-26`	a year	crt.sh
zoominfo.com E1	`2024-03-22` - `2024-06-20`	3 months	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
okt.to R3	`2024-02-11` - `2024-05-11`	3 months	crt.sh
hs-analytics.net GTS CA 1P5	`2024-04-13` - `2024-07-12`	3 months	crt.sh
hscollectedforms.net E1	`2024-03-29` - `2024-06-27`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
zi-scripts.com GTS CA 1P5	`2024-03-29` - `2024-06-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Frame ID: 7A8153A52D659A23CE856DE35C3CBA9C
Requests: 85 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unpacking the Blackjack Group's Fuxnet Malware | Claroty

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

90
Requests

99 %
HTTPS

52 %
IPv6

28
Domains

41
Subdomains

33
IPs

5
Countries

1243 kB
Transfer

3209 kB
Size

24
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://ruexfil.com/mos/
Title: https://ruexfil.com/mos/

Search URL Search Domain Scan URL

URL: https://www.infosecurity-magazine.com/news/ukrainian-blackjack-hackers/
Title: Russian internet provider

Search URL Search Domain Scan URL

URL: https://christianbaghai.medium.com/blackjacks-big-win-how-a-ukrainian-hacker-group-exposed-russia-s-military-weaknesses-899281feb4bb
Title: Russian military infrastructure

Search URL Search Domain Scan URL

URL: https://ao-sbk.ru/
Title: AO SBK

Search URL Search Domain Scan URL

URL: https://ao-sbk.ru/mpsb/
Title: MPSB

Search URL Search Domain Scan URL

URL: https://ao-sbk.ru/tmsb/
Title: TMSB

Search URL Search Domain Scan URL

URL: http://extract_sensor_info.html/
Title: information about the sensor gateways

Search URL Search Domain Scan URL

URL: https://youtu.be/CE6lMslmLLo
Title: here

Search URL Search Domain Scan URL

URL: https://youtu.be/TeIiQx8jgXQ
Title: here

Search URL Search Domain Scan URL

URL: https://irz.net/en/
Title: iRZ

Search URL Search Domain Scan URL

URL: https://irz.net/en/products/routers/r2-series/rl22w
Title: iRZ RL22w

Search URL Search Domain Scan URL

URL: https://openwrt.org/
Title: OpenWRT

Search URL Search Domain Scan URL

URL: http://shodan.io/
Title: Shodan

Search URL Search Domain Scan URL

URL: https://www.oreilly.com/library/view/mastering-embedded-linux/9781787283282/64271306-bd52-47d8-8118-6b618630d307.xhtml
Title: mtdblock

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Flash_memory
Title: NAND memory chips

Search URL Search Domain Scan URL

URL: https://www.kernel.org/doc/html/next/filesystems/ubifs.html
Title: UBI volume

Search URL Search Domain Scan URL

URL: https://elixir.bootlin.com/linux/latest/source/include/uapi/mtd/ubi-user.h#L74
Title: UBI_IOCVOLUP

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Meter-Bus
Title: Meter-Bus channel

Search URL Search Domain Scan URL

URL: https://m-bus.com/overview
Title: M-Bus (Meter-Bus) communication protocol

Search URL Search Domain Scan URL

URL: https://m-bus.com/documentation-wired/06-application-layer
Title: M-Bus documentation

Search URL Search Domain Scan URL

URL: https://github.com/ganehag/pyMeterBus/tree/master
Title: pyMeterBus

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/RS-485
Title: RS485

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle/?url=https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/post?text=Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware&url=https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Title: Facebook

Search URL Search Domain Scan URL

URL: https://claroty-staging.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
Title: [Read more: New Critical Vulnerabilities in Unitronics UniStream Devices Uncovered.]

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/register_email.aspx
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/directory/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://nexusconnect.io/podcasts
Title: Podcasts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/claroty/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/claroty
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@claroty20
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ClarotyOT/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/
Title: Partner Login

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&e_ipv6=AQK4HNKR6lnqsgAAAY7kq5GqsqFrQTGbb0uDxqDGV4Q4_yOAwd0IMbVqIj12eRvZXGyMv58

90 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request unpacking-the-blackjack-groups-fuxnet-malware Show response
claroty.com/team82/research/ 157 KB
26 KB 462ms
225ms Document
text/html 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / Statamic

Resource Hash

043a4ec31168345ebe7c4de609fd71a61c3fda959fc67e3db2f075ede09ae03d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, private
content-encoding: gzip
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Tue, 16 Apr 2024 02:10:31 GMT
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
referrer-policy: same-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: Statamic
x-ratelimit-limit: 30
x-ratelimit-remaining: 29
x-xss-protection: 1; mode=block

GET
H2 200 claroty-CJsZd_YW.css
claroty.com/build/assets/ 56 KB
11 KB 116ms
115ms Stylesheet
text/css 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/claroty-CJsZd_YW.css

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

5cbbe573b80252da25be2037dc40fc3bc3e0a17e90c41eee77f4da1925b18138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: W/"661d7f34-e174"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 claroty-3AHVqBhE.js Show response
claroty.com/build/assets/ 207 KB
70 KB 198ms
197ms Script
application/javascript 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/claroty-3AHVqBhE.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

dc924bdb7298a1d9785ee12b8d0637a528473b8e8bad1be2008c515038b6b7d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: W/"661d7f34-33da7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 183ms
39ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

4183a5c823ec18238c04c02d03449b179e41eb95e318d9365b9da937309a02c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Thu, 11 Apr 2024 21:27:51 GMT
server: ECS (frb/67D4)
age: 17708
etag: "932e641b578cda1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25393

GET
H2 200 d44331c910ed5795dcf0803f1f8c018d0b78673e308a02768f49c5dce853cf48.js Show response
js.hs-banner.com/cookie-scanning/20307279/ 19 KB
8 KB 438ms
352ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-scanning/20307279/d44331c910ed5795dcf0803f1f8c018d0b78673e308a02768f49c5dce853cf48.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c076c9a1f9b9651fb91d83cd691cc0796e5d167e072d9fe13253c8f6b442ef9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-amz-version-id: IiAhqaF6CwpR3C0NwkqFX3xe7Bo3l3mD
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: AZKK5FEH1GRKES52
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 59c3f7f6-c832-43f3-ae7e-67193ac0b321
x-envoy-upstream-service-time: 17
x-amz-id-2: hccyDBNhygWpopRg/31cdjVzsoECTI2j9NpBreEdOAuZk/q1eDvD9S6GX9IPRPiSldU799O6QkU=
x-evy-trace-listener: listener_https
x-request-id: 59c3f7f6-c832-43f3-ae7e-67193ac0b321
x-evy-trace-route-configuration: listener_https/all
last-modified: Sun, 14 Apr 2024 01:31:28 GMT
server: cloudflare
etag: W/"f3ace7d7e475df3324c84884bca32bf3"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://wt.contify.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-jg42k
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8750a3b63ab98ffe-FRA
expires: Tue, 16 Apr 2024 02:15:32 GMT

GET
H2 200 team82-logo-white-BGiCQ9zb.svg
claroty.com/build/assets/ 5 KB
2 KB 228ms
227ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/team82-logo-white-BGiCQ9zb.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

ef410da15ef1307792230bc15984643d4fa47ab902d62496ef98a725b1429e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: W/"661d7f34-14f8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 logo-solid-white-DcRiqKcD.svg
claroty.com/build/assets/ 2 KB
1 KB 228ms
227ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/logo-solid-white-DcRiqKcD.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: W/"661d7f34-9cb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 logo-white-VeF9EwMy.svg
claroty.com/build/assets/ 2 KB
1 KB 114ms
114ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/build/assets/logo-white-VeF9EwMy.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: W/"661d7f34-9d1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 v2.js Show response
js.hsforms.net/forms/embed/ 482 KB
155 KB 141ms
50ms Script
application/javascript 2606:4700::6812:8e77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/embed/v2.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8e77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 461
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5064/bundles/project-v2.js&cfRay=87509878cf886aba-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"b0047a8901d8ed9f81db3dcb5982114e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.5064/bundles/project-v2.js
date: Tue, 16 Apr 2024 02:10:32 GMT
x-amz-version-id: 4lHA5dnNobe4YqKec9CE2kPtPUzRSBNR
via: 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 01eeb4be-0301-4e51-9631-46dcea76b760
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 01eeb4be-0301-4e51-9631-46dcea76b760
last-modified: Wed, 03 Apr 2024 11:15:05 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uNZcl4UDTbPjMjBkhaaQTXa6YiC9nvyfmZsiaJqg0JomMjk9eptCRTHT6uzCnB7fvUXxvce%2F%2BIfyi6w%2BXgoREg5lZlntwExxomrbvdLxOjkAfodbTFlY8UxFsn9KWSvLDRswXJ%2F%2F1whoelmv"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-6zsl2
cf-ray: 8750a3b7abf22c41-FRA
x-amz-cf-id: W1YUr0eaFpZcFYcCrV4wmG6DIn2P9ZFe6Roc19jdZR5GrOMULUcb1A==

GET
H2 200 da9381b325.js Show response
kit.fontawesome.com/ 12 KB
5 KB 248ms
158ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/da9381b325.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d269e745735d0cff621fefc03710777c918f02475e693312e49164ee589105d7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 8750a3b7a86a1ac7-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F8ae_lEjmV8ByrYbZibB

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 255 KB
89 KB 148ms
56ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

edb9ff04d5c5bf6738977d073dc2f1c721ba3fb42c684acef3afde5f7fd85098

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90460
x-xss-protection: 0
last-modified: Tue, 16 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H2 200 proxima-nova-regular-DqkkgJcb.woff2
claroty.com/build/assets/ 29 KB
29 KB 113ms
112ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-regular-DqkkgJcb.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-CJsZd_YW.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

c4d04d2b6a041dde11c80d8332f983a58c1031c663ab4f42230899cb82adf4a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/build/assets/claroty-CJsZd_YW.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: "661d7f34-747c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 29820
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-semibold-CrIMIJZE.woff2
claroty.com/build/assets/ 29 KB
29 KB 114ms
113ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-semibold-CrIMIJZE.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-CJsZd_YW.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/build/assets/claroty-CJsZd_YW.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: "661d7f34-7444"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 29764
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-medium-italic-bO1HHsIQ.woff2
claroty.com/build/assets/ 31 KB
31 KB 225ms
225ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-medium-italic-bO1HHsIQ.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-CJsZd_YW.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2517eb1a7ae21f813fe2b074dd0ba1091bc5ad60356750b04de79a6328960c71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/build/assets/claroty-CJsZd_YW.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: "661d7f34-7c40"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 31808
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-regular-italic-CMAA4I7g.woff2
claroty.com/build/assets/ 31 KB
31 KB 226ms
225ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-regular-italic-CMAA4I7g.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-CJsZd_YW.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

19be36b532c3147a005317cbc940c69b7137c7980a462525055393d3cfd20b30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/build/assets/claroty-CJsZd_YW.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: "661d7f34-7b84"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 31620
x-xss-protection: 1; mode=block

GET
H2 200 proxima-nova-bold-BEWb3vsP.woff2
claroty.com/build/assets/ 30 KB
30 KB 226ms
226ms Font
font/woff2 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/build/assets/proxima-nova-bold-BEWb3vsP.woff2

Requested by

Host: claroty.com
URL: https://claroty.com/build/assets/claroty-CJsZd_YW.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/build/assets/claroty-CJsZd_YW.css
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Apr 2024 19:25:40 GMT
server: nginx
etag: "661d7f34-77f0"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 30704
x-xss-protection: 1; mode=block

GET
H2 200 YXNzZXRzL2JsYWNramFja2ZlYXQxLnBuZw==
claroty.com/img/asset/ 47 KB
48 KB 229ms
228ms Image
image/webp 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/asset/YXNzZXRzL2JsYWNramFja2ZlYXQxLnBuZw==?fm=webp&fit=crop&w=800&h=450&s=ff378a169b0f14032ec99303127a846a

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

976437eebed4b0c67e1d0a7ae80c5eb43946177387055d833af55958522aa393

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-permitted-cross-domain-policies: none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
content-length: 48564
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 12 Apr 2024 16:48:45 GMT
server: nginx
cross-origin-opener-policy: unsafe-none
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=31536000, public
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
expires: Wed, 16 Apr 2025 02:10:32 GMT

GET
H2 200 YXNzZXRzL2ltYWdlMjUtMTcxMjkzNzI0Ni5wbmc=
claroty.com/img/asset/ 79 KB
80 KB 338ms
338ms Image
image/webp 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/asset/YXNzZXRzL2ltYWdlMjUtMTcxMjkzNzI0Ni5wbmc=?fm=webp&fit=crop&s=fd64c917f2881cbdbe0a4276cdc157a7

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

ee59c007b99f5ce43f5b2d310df1e72968d48ed012667ab0194b812697ad93c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-permitted-cross-domain-policies: none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
content-length: 81030
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 12 Apr 2024 16:43:32 GMT
server: nginx
cross-origin-opener-policy: unsafe-none
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=31536000, public
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
expires: Wed, 16 Apr 2025 02:10:32 GMT

GET
H2 200 pro.min.js Show response
ka-p.fontawesome.com/releases/v6.5.2/js/ 60 KB
18 KB 57ms
49ms Fetch
application/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/js/pro.min.js?token=da9381b325
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/da9381b325.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24b19f3adb4b93ae4e7c14e7fc2b17ffa34ca6a03518b7b0fc18117b8c9ee214

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:27 GMT
server: cloudflare
age: 1054639
etag: "660c23a3-4581"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8750a3b8d8ee1ac7-FRA
content-length: 17793

GET
H3 200 json Show response
forms.hsforms.com/embed/v3/form/20307279/4ec0d86c-87f7-4863-8c01-93bea20ffd85/ 11 KB
4 KB 218ms
170ms XHR
application/json 104.18.176.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/20307279/4ec0d86c-87f7-4863-8c01-93bea20ffd85/json?hs_static_app=forms-embed&hs_static_app_version=1.5064&X-HubSpot-Static-App-Info=forms-embed-1.5064

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.176.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a121b8e6700c3f60127b06d7ef6188ae3ec5d1a4c55f2353bd7cda35524226e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-origin-hublet: na1
date: Tue, 16 Apr 2024 02:10:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: c9fc05c2-7999-4a8b-912a-86d5032ce530
x-envoy-upstream-service-time: 16
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c9fc05c2-7999-4a8b-912a-86d5032ce530
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8750a3b92a676a73-TXL
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-2f4ft

GET
H2 200 plus.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 429 B
386 B 51ms
51ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/plus.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c33c3b4654450ad9afe9d9cb1da4e2ad8f2b601218d4015da547331079865976

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:33:19 GMT
server: cloudflare
age: 1053329
etag: W/"660c253f-1ad"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939521ac7-FRA

GET
H2 200 linkedin.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 672 B
513 B 52ms
52ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/linkedin.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 655460488a4e86be0c0adbd0af8f537bcc1f077f261f3e95ff8e213af3b33e39

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:33 GMT
server: cloudflare
age: 1054638
etag: W/"660c23a9-2a0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939571ac7-FRA

GET
H2 200 square-x-twitter.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 510 B
452 B 51ms
51ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/square-x-twitter.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d9d9af17df221748b0e58108771b9aa312a7b1caa789e60ccf9167a0e10f420

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:36 GMT
server: cloudflare
age: 1054638
etag: W/"660c23ac-1fe"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b9395b1ac7-FRA

GET
H2 200 facebook.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 516 B
450 B 59ms
59ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/facebook.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43b962bc3ef0ddc52398c669a6344d1d78954017cd297f5f95654f71a16cd8e9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:31 GMT
server: cloudflare
age: 1054638
etag: W/"660c23a7-204"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b9395f1ac7-FRA

GET
H2 200 envelope.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 567 B
485 B 546ms
546ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/envelope.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ede3ffda856f66ed7d3685f59716dfec3a38aedf5701ad54125d8b8889ba572

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Tue, 02 Apr 2024 15:32:52 GMT
server: cloudflare
etag: W/"660c2524-237"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939641ac7-FRA

GET
H2 200 youtube.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/ 718 B
505 B 53ms
53ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/brands/youtube.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e02675c0b58e43a34fbc81fed80ec2798deb5ddae78a16f9dd5e0e82e84b598a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:47 GMT
server: cloudflare
age: 1054638
etag: W/"660c23b7-2ce"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939651ac7-FRA

GET
H2 200 xmark-large.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 478 B
397 B 52ms
52ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/xmark-large.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 962c60f1e79f0ca16e7142d53a2eae2ec60d33071a306d010e25cfc262a652c4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:34:54 GMT
server: cloudflare
age: 1054638
etag: W/"660c259e-1de"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939671ac7-FRA

GET
H2 200 angle-down.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/solid/ 416 B
368 B 52ms
52ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/solid/angle-down.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17cfde48999dcfe173e106d30c3f9f329e6558a1db1fc032876589ec516945f3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:45:58 GMT
server: cloudflare
age: 1054638
etag: W/"660c2836-1a0"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939681ac7-FRA

GET
H2 200 search.svg Show response
ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/ 483 B
408 B 56ms
56ms Fetch
image/svg+xml 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/svgs/regular/search.svg?token=da9381b325
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f3849bcb0803d10f69b84c0c9be9b935ec89306a9e370365629fbe1eb20e37

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:33:23 GMT
server: cloudflare
age: 1054638
etag: W/"660c2543-1e3"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 8750a3b939691ac7-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 313 KB
103 KB 59ms
58ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5dc48b72ff6a045195d18793ec972540af350b7654204ac498b259ec2ac98ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 105057
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 133ms
41ms Script
application/javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=46029
accept-ranges: bytes
content-length: 17238

GET
H2 200 hotjar-3443429.js Show response
static.hotjar.com/c/ 9 KB
4 KB 187ms
79ms Script
application/javascript 18.66.192.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3443429.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.192.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-192-39.muc50.r.cloudfront.net

Software

Resource Hash

b514c9021251fdccd9ca7ef0bfea3eb81e95962f3fdb78d60f9693beafcef161

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Tue, 16 Apr 2024 02:10:32 GMT
via: 1.1 32700c539a5f821aadd3624288c4aeb6.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
etag: W/25e81c8d172b7199b1f14bc822f6dfdc
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: kDRTY4jHS3RXMObqVyCJhKk_rJYbDS1W5QGM1wA6E13L6HM8X6dwuA==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
87 KB 64ms
64ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11089250684

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

df35f77b4f6930c9d470893d1bb267004c3c238d91d190eac0878c26ca21e0ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 88983
x-xss-protection: 0
last-modified: Tue, 16 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H2 200 oktrk.js Show response
static.oktopost.com/ 9 KB
4 KB 160ms
44ms Script
application/javascript 108.138.36.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.oktopost.com/oktrk.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-118.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 15 Apr 2024 04:24:20 GMT
content-encoding: gzip
via: 1.1 349eb6985da057f318665aa6bde74732.cloudfront.net (CloudFront)
last-modified: Mon, 27 Jan 2020 09:47:41 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
age: 79542
etag: W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: uE1WS4cesSccJPQMso_9x4CRkK3wRdK9xDHiVjp9YZSbZNAsxL9xPQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
68 KB 54ms
53ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-84224451-1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

907367f091c381f71b38cc584cc54a1c678cbd4f82ebeff0aa6aca80c85cb42c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69216
x-xss-protection: 0
last-modified: Tue, 16 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H3 200 jilEnH5CqVK0j3M3GHR5 Show response
ws.zoominfo.com/pixel/ 0
646 B 288ms
201ms Script
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
content-length: 0
cf-ray: 8750a3ba8e644522-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 20307279.js Show response
js.hs-scripts.com/ 2 KB
1 KB 237ms
153ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

130ef2f6b5474f931122e35600509422c5610ca27f8e2eb26b731c2e595fee22

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e2e5767e-3040-4ffd-ae2d-8bc56d9889ff
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e2e5767e-3040-4ffd-ae2d-8bc56d9889ff
last-modified: Tue, 16 Apr 2024 02:04:36 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-697677dfc-xn4hd
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8750a3ba8b7f4d38-FRA
expires: Tue, 16 Apr 2024 02:12:02 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 65 KB
18 KB 177ms
41ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

ad7401d2e529b7d3c45e9f5fb1fdcbd16c4cc8d96d74cfaaf0c09896b0cccab3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 21:38:48 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "6615b568-10322"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17836
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
880 B 196ms
156ms Image
image/gif 104.18.176.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.176.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ad11e666-1ca3-4211-ba93-f5ec44af61c0
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ad11e666-1ca3-4211-ba93-f5ec44af61c0
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-9vhtf
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8750a3ba8ff22685-TXL

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
881 B 206ms
155ms Image
image/gif 104.18.192.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.192.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7bf2714a-26ac-4c86-a695-8704b67213c4
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7bf2714a-26ac-4c86-a695-8704b67213c4
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-mc9zn
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8750a3babc50aca4-TXL

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 132ms
41ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-84224451-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 16 Apr 2024 01:38:42 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1910
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 16 Apr 2024 03:38:42 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
251 B 144ms
48ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-H6L2YY031Z&gtm=45je44f0v896979362z8847287713za200&_p=1713233432044&_gaz=1&gcd=13l3lPl2l1&npa=1&dma_cps=sypham&dma=1&cid=204035329.1713233433&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713233432&sct=1&seg=0&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&dt=Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1348
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
251 B 148ms
49ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-H6L2YY031Z&cid=204035329.1713233433&gtm=45je44f0v896979362z8847287713za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 134ms
51ms Image
image/gif 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-H6L2YY031Z&cid=204035329.1713233433&gtm=45je44f0v896979362z8847287713za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1&z=918312952

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackja...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackj...

0
266 B

300ms
187ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&e_ipv6=AQK4HNKR6lnqsgAAAY7kq5GqsqFrQTGbb0uDxqDGV4Q4_yOAwd0IMbVqIj12eRvZXGyMv58
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 58E2CBE4F20D4CDDBBF161AB481CEAD3 Ref B: DUS30EDGE0707 Ref C: 2024-04-16T02:10:33Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYWLT413qdm90EE37PK5g==

Redirect headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: FBA7EE33E86A48C2BAB6DA16D64B540D Ref B: FRAEDGE1908 Ref C: 2024-04-16T02:10:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5168721&time=1713233432812&li_adsId=ba4d6cfe-5d03-4005-9f37-85040fdbc268&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&e_ipv6=AQK4HNKR6lnqsgAAAY7kq5GqsqFrQTGbb0uDxqDGV4Q4_yOAwd0IMbVqIj12eRvZXGyMv58
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYWLT4w4qpS/NOSytKvew==

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
694 B 256ms
166ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 85F733ABE1004A62B19055BF745E1F3D Ref B: FRAEDGE1908 Ref C: 2024-04-16T02:10:32Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://claroty.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYWLT4wifCb3CnaI70yBQ==

GET
H2 200 ping Show response
okt.to/ 0
100 B 379ms
125ms Script
text/javascript 52.20.195.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://okt.to/ping?uri=%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&aid=00143q1r49z36ol&ts=1713233432817

Requested by

Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.20.195.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-195-32.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000;
content-type: text/javascript;charset=UTF-8

GET
H2 200 modules.1bb7849d5667ca754312.js Show response
script.hotjar.com/ 221 KB
55 KB 149ms
50ms Script
application/javascript 54.230.228.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.1bb7849d5667ca754312.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3443429.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.228.47 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-228-47.muc50.r.cloudfront.net

Software

Resource Hash

279fd8daab9081d3f17312be6e5d7bf1634d7ba6edf5a349011c5c922a709453

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 15 Apr 2024 13:12:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 2a656139082dc5343337bc64ea362630.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P5
age: 46706
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55715
last-modified: Mon, 15 Apr 2024 13:11:16 GMT
etag: "12955196ab44183bc0c0e99d5fbabaf4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Kxuo6C_iz8hTNr9rTtOtUEGqRcsB8PHzKWIDIFQkEDBONP3dbANXGQ==

GET
H2 200 / Show response
c.6sc.co/ 7 B
190 B 49ms
41ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:32 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
305 B 174ms
41ms XHR
text/html 2a02:26f0:ab00::214:8e41
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b8503fbaf4056c36c2ddc016b0a9e857f7487fb70b0da10419f77694522c3bcf

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://claroty.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:93::4
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713233432918_34901565_340637901_28_1040_38_79_219";dur=1
content-length: 19
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 142ms
134ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:32 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 136ms
136ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%221a8619a294ad37fe81fcb7766ed37dc1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22Ask-your-CSM-for-a-token%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:33 GMT

GET
H2 200 20307279.js Show response
js.hs-analytics.net/analytics/1713233400000/ 69 KB
22 KB 256ms
165ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1713233400000/20307279.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aeae8446f674a97dfdeea4f422f3622337e0095b66d19bb12b38d5523f1f2850

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: Y98E7BAPTWJA31G5
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: f0770c17-2c89-44ed-a320-371283396482
x-envoy-upstream-service-time: 22
x-amz-id-2: zqPEfd20mHwYTJTchyEttaf4f0T1rGHYeMszOEgiXtj4VulJe3gTFtFIt821W9bi4RcoB5vb44gM423N/3TTTJ8p1ky6kKjEZPgCGjQjQlc=
x-evy-trace-listener: listener_https
x-request-id: f0770c17-2c89-44ed-a320-371283396482
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 15 Apr 2024 19:35:55 GMT
server: cloudflare
etag: W/"e16afc374ee42dd5547699e28851c94b"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-snf7h
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8750a3bc5e9e929f-FRA
expires: Tue, 16 Apr 2024 02:15:33 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 134ms
51ms Script
application/javascript 2606:4700::6810:6cfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6cfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c76dd89a767afd512ce6c6370424f39a632ebb736c16ac37952fbfd97575448

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 357
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.491/bundles/project.js&cfRay=87509b093a744da2-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"020909a609cf986b4a8a88cfb577a8db"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.491/bundles/project.js
date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: _rd02ux3UWoVQsATQDf.p_LxkLPJ6umh
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 1524224e-d9fc-461d-83e7-6e08fc6f439a
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1524224e-d9fc-461d-83e7-6e08fc6f439a
last-modified: Wed, 10 Apr 2024 18:06:23 UTC
server: cloudflare
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-275zq
cf-ray: 8750a3bc7eaf9213-FRA
x-amz-cf-id: 7xV4DpaNnhobb94V9Pz9MTz-2cQTA3-xvgi_KNm2Oi_zNMYvTrpw4g==

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 137ms
54ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c19b3e1b4412d65f2867422b94958aef88fb30739eb739e2c7dc2ea53dc0e38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 357
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1057/bundles/project.js&cfRay=87509b0a6ac39b5d-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"dd91c2fb61034a195eb738df46ca4b3a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1057/bundles/project.js
date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: 8Bjrd.XOcIxETBdGX4ErcbsqVOQTF3Nz
via: 1.1 b9e3ae23b2e5d7b2e1c159467ba23f34.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: eac8da72-10ef-4fa0-a8f4-f8ca0a76c918
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: eac8da72-10ef-4fa0-a8f4-f8ca0a76c918
last-modified: Fri, 12 Apr 2024 14:29:24 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wr6KD59D8Kds9oir%2F9aHIA%2FCob1GEqkU23En%2BiWmBWv8ZvgXb62%2F01SxE%2BPn3AHLJQ1tA%2FXB0JW56OdsZr49jQyHKuAtwCmvhSySzXHS5HcbVtSAzGPob72Wb1rvs7kX7nqGSkwt72l5nRVa"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-n7dww
cf-ray: 8750a3bc8aaf3665-FRA
x-amz-cf-id: JUgnmeaUgWAf3xSubSvYURYP_sR36VUq4uXiY6Dg55e0cKVA5F8U0A==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 135ms
48ms Script
application/javascript 2606:4700::6811:e4a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:e4a3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb4e5cc6483bbd68941a52e05a7f209dc6a56121cdbae91ba596159c73b9d29

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: TWPsXpJy5mppDy11Ah2d7Z.E9NUoSMax
via: 1.1 c3d335addde48969fafe25d4064cee80.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 486
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.547/bundles/pixels-release.js&cfRay=875097dec81590d6-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: d4b1f208-f959-4707-bbd9-96282d5c09ca
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d4b1f208-f959-4707-bbd9-96282d5c09ca
last-modified: Mon, 15 Apr 2024 17:11:29 UTC
server: cloudflare
etag: W/"12a97d041f49c166ec4b1644f76ae8fe"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-bsp24
cf-ray: 8750a3bc999e5d76-FRA
x-amz-cf-id: c5VcJFCfKsnzowK8hdorf-2dlBoooUT2QY3JezapLEBtB1U_-P1-5g==
x-hs-target-asset: adsscriptloaderstatic/static-1.547/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/20307279/ 82 KB
24 KB 346ms
346ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/20307279/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56fd6ac00de2e21a09cbd192538fa98e5760d347064942418aa32b146cfa0444

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: HcRbkkXUT._iAsAXuhu0xw7p19klPIVQ
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: YKNDRJ1QR4KY7N7R
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 0f68fb51-e6ce-48f8-b946-c3f3522ef65a
x-envoy-upstream-service-time: 20
x-amz-id-2: ZvZMogiGVQQv5tukyveaa0cEQPBSFvvCInFNVe35TDZ/JdCw19Jxmk+Dg9/vMtTkC+J7WZyZaoo=
x-evy-trace-listener: listener_https
x-request-id: 0f68fb51-e6ce-48f8-b946-c3f3522ef65a
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 15 Apr 2024 15:54:04 GMT
server: cloudflare
etag: W/"879f40e9082bd4c6346f691422ba36c5"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://nexusconnect.io
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-pvzd8
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8750a3bb8c308ffe-FRA
expires: Tue, 16 Apr 2024 02:15:33 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
204 B 47ms
47ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=854620339&t=pageview&_s=1&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&ul=de-de&de=UTF-8&dt=Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=85199462&gjid=1793524409&cid=204035329.1713233433&tid=UA-84224451-1&_gid=241015562.1713233433&_r=1&gtm=457e44f0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&npa=1&z=489540263

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 52ms
52ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-84224451-1&cid=204035329.1713233433&jid=85199462&gjid=1793524409&_gid=241015562.1713233433&npa=1&_u=YADAAUAAAAAAACAAI~&z=297096188

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 details Show response
epsilon-globalaccelerator.6sense.com/v3/company/ 42 B
327 B 223ms
146ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon-globalaccelerator.6sense.com/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 7d23a3cba9c9e734b155c86294109c51ccd1b340b990dda6616427ba39b988db

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token Ask-your-CSM-for-a-token
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
X-6s-CustomID: WebTag1.0 1a8619a294ad37fe81fcb7766ed37dc1
Referer
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 2740107473501707054
date: Tue, 16 Apr 2024 02:10:33 GMT
server: nginx
vary: Origin
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://claroty.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 42

OPTIONS
H2 200 details
epsilon-globalaccelerator.6sense.com/v3/company/ 0
0 130ms
43ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon-globalaccelerator.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://claroty.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Tue, 16 Apr 2024 02:10:33 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 1577306300697979101

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 135ms
135ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A93%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:33 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 137ms
53ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84224451-1&cid=204035329.1713233433&jid=85199462&npa=1&_u=YADAAUAAAAAAACAAI~&z=1687288639

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 52ms
51ms Image
image/gif 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84224451-1&cid=204035329.1713233433&jid=85199462&npa=1&_u=YADAAUAAAAAAACAAI~&z=1687288639

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 302ms
167ms XHR
application/json 52.50.100.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=3443429&gzip=1
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.50.100.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-100-69.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f5286f06671542af1693b4f92c17639b0967af0960196235917470b20a7a2adb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 16 Apr 2024 02:10:33 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 433 B
1 KB 154ms
153ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=20307279&currentUrl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: cb7f311b-c9de-4021-93d0-41f6a4644f00
content-encoding: br
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: cb7f311b-c9de-4021-93d0-41f6a4644f00
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZXbnlEl%2FdzEeVu8KhGD2FeQEFUgvFW%2BtgAxdLB1A5kVz0DVDu23Jy96Lry%2BdtQ5dme88UUGCFCHYQXIMKkz5MVCOvTCJnJG%2FnVFdACzwUR4CZ1GXTM1EFwiELZY97q5a7%2Bj3cB8ObGpg9e9qcBuIiWwehKivbEV6co%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8750a3bd4b093665-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-m6nvf

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 116 B
398 B 145ms
144ms XHR
application/json 2606:4700::6810:6cfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=20307279&utk=

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6cfe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

943ded0a2adddb140465921e9f3a050f1fb064974efebe3ef311e9e75b6a2fa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f09f076c-f1ed-41b1-836a-318136404108
x-envoy-upstream-service-time: 6
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f09f076c-f1ed-41b1-836a-318136404108
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://claroty.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-275zq
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8750a3bd4edb9213-FRA

OPTIONS
H2 200 view
js.hs-banner.com/v2/activity/ 0
0 417ms
332ms Preflight
application/octet-stream 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://claroty.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 8750a3be48c50414-FRA
content-length: 0
content-type: application/octet-stream
date: Tue, 16 Apr 2024 02:10:33 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 1
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-pvzd8
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 3aa9af0f-6965-4c79-b15d-0ddf55db6b92
x-request-id: 3aa9af0f-6965-4c79-b15d-0ddf55db6b92

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
865 B 135ms
48ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/20307279/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 16 Apr 2024 02:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 16 Apr 2024 02:01:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 Apr 2024 02:10:33 GMT

POST
H2 204 view
js.hs-banner.com/v2/activity/ 0
0 168ms
168ms Fetch 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-banner.com/v2/activity/view

Requested by

Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/20307279/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-hubspot-correlation-id: 25608eab-362d-4402-a909-0a1ab07e06de
x-envoy-upstream-service-time: 27
x-evy-trace-route-configuration: listener_http/all, listener_https/all
x-evy-trace-listener: listener_http, listener_https
x-request-id: 25608eab-362d-4402-a909-0a1ab07e06de
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-virtual-host: all, all
x-evy-trace-served-by-pod: iad02/private-hubapi-td/envoy-proxy-76d78f4b75-vs9h6, iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-vhl7w
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
access-control-max-age: 604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8750a3c0599a0414-FRA

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
537 B 152ms
152ms Image
image/gif 104.18.176.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.176.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: c84e8a7f-e7e1-485d-901a-b192c98d8bb5
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c84e8a7f-e7e1-485d-901a-b192c98d8bb5
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-m6nvf
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8750a3be2a862685-TXL

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
580 B 192ms
192ms Image
image/gif 104.18.192.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.192.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ef63d6b5-2b5f-4b82-b70a-2c312114a531
x-envoy-upstream-service-time: 10
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ef63d6b5-2b5f-4b82-b70a-2c312114a531
last-modified: Tue, 16 Apr 2024 02:10:33 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-qpnsw
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8750a3be3fc2aca4-TXL

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 130ms
41ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://claroty.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 07:36:31 GMT
x-content-type-options: nosniff
age: 239642
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 13 Apr 2025 07:36:31 GMT

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 135ms
48ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa8204005ed25e30f3ee56dbad3afa3c011e12636e75decf2b1aaf22a1c326dd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
x-amz-version-id: jWuK40m0MUEUayB9sycJH0u7f85X3F2r
content-encoding: gzip
cf-cache-status: DYNAMIC
via: 1.1 12414973c2da1422517a5a4e585ff6a8.cloudfront.net (CloudFront)
x-amz-cf-pop: TXL50-P5
age: 48596
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Mar 2024 07:02:18 GMT
server: cloudflare
etag: W/"2cd903354c7c864dbd543d268219ef1d"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 8750a3c04a08aca4-TXL
x-amz-cf-id: SPnbEvz3cm70oMyqSvq8pgjyFJrIp2pXqYKvxcXpv1eY6Hji5BRNeg==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 242ms
158ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=726726051&v=1.1&a=20307279&rcu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&t=Unpacking+the+Blackjack+Group%27s+Fuxnet+Malware+%7C+Claroty&cts=1713233433545&rv=1&vi=10fd320bac5c83da36e0a7143e702065&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 02ae058e-eb4f-423f-8701-d4674a90795c
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 9
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 02ae058e-eb4f-423f-8701-d4674a90795c
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sSQ4lntW4bo2QZC9gt98RDclD7PImlfHutGZnrzGz6fOJtx%2FE54VAipa%2F9vxf3S8FTu7%2ByS2zPnjWP24dxZtClyAvpS4S6xnYGAx7D0GdEjGExxjFBP5VxvlkcCnC73L77IF64dVr7EQpm%2FyvsEU"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-zs6tk
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8750a3c058cd9bc8-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
745 B 250ms
169ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=4ec0d86c-87f7-4863-8c01-93bea20ffd85&fci=5f8e9306-dc50-495f-a3f7-714769bd2e6b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=726726051&v=1.1&a=20307279&rcu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&t=Unpacking+the+Blackjack+Group%27s+Fuxnet+Malware+%7C+Claroty&cts=1713233433545&rv=1&vi=10fd320bac5c83da36e0a7143e702065&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6d8216e6-5539-4699-970c-bcee053a2322
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 14
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6d8216e6-5539-4699-970c-bcee053a2322
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BSnpGwOGrFRuBiYavnTiHMKVL5d963wTuuKANOpyVqWNQwN6nVNgY16dIAU9YmHxsW5zqUbT8nUfYV5LY2OBnZaJkKw2T9l6SxloldDjda1Qwu9Bl9lHxLQ292P3TVRSW9q0mJhmbtOXs%2BIZIiG9"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-jm4tn
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8750a3c058ce9bc8-FRA
x-robots-tag: none

GET
H2 200 favicon.svg
claroty.com/img/ 1 KB
909 B 112ms
112ms Other
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/img/favicon.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

95401ddb551c7b54e882e38efaf5e19905478635b8f0566f71f4ba8aa40f9e1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 16 Mar 2023 23:39:46 GMT
server: nginx
etag: W/"6413a8c2-51b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 195 B
556 B 227ms
227ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 01c77d3db354404ca8bec445535cf75ea2d84f363bd298270ddb00d2c1d94ffa

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer f677a162dd1677780802
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Referer
visited_url: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware

Response headers

date: Tue, 16 Apr 2024 02:10:34 GMT
via: 1.1 8c6a3292194745111bdc6d985ce4344e.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: MRS52-P5
x-powered-by: Express
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
apigw-requestid: WS-kIgO2vHcEM4g=
server: cloudflare
etag: W/"c3-Fk88Fg2clveTPokszzGSwvbYLDg"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 8750a3c28b876a78-TXL
x-amz-cf-id: PopnUyj3r7rQpnj4oQc3DdJc46Rf0WuGI0W_CneTWgD--fRCyPVu9g==

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ 0
0 310ms
229ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
apigw-requestid: WS-kFihOPHcEMiQ=
cf-cache-status: DYNAMIC
cf-ray: 8750a3c119ca6a78-TXL
date: Tue, 16 Apr 2024 02:10:33 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 e6fa1c9191449608305126abd895ecaa.cloudfront.net (CloudFront)
x-amz-cf-id: JBy1jUFEwFYjCkjyG2eXSRSyGmiv-obcRUWxa5Jg2-xAXdGHwdruAA==
x-amz-cf-pop: MRS52-P5
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 135ms
135ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A32%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:33 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 135ms
135ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=https%3A%2F%2Fepsilon-globalaccelerator.6sense.com&q=%7B%22name%22%3A%22https%3A%2F%2Fepsilon-globalaccelerator.6sense.com%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1534.6000003814697%2C%22duration%22%3A354.29999923706055%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1534.6000003814697%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1888.8999996185303%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A401%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=&d=1&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:33 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:33 GMT

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/ 0
0 282ms
200ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://claroty.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8750a3c4792e4504-TXL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 16 Apr 2024 02:10:34 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 86 KB
26 KB 150ms
142ms Script
application/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30e56b8ea8620ad4338d19c01c39c349bd2e614716adff78dec000cbab05158d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:34 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 1833
x-guploader-uploadid: ABPtcPpfo7kyKG2ZtTln5sl5h-FyaHmQ42HGWa1qAoRywza55JXCjdsdMMG_2ddBTziHojWNO80
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Mar 2024 09:53:49 GMT
server: cloudflare
etag: W/"b53466e5475228f081a9e4df4b319aae"
x-goog-hash: crc32c=T+Sa9g==, md5=tTRm5UdSKPCBqeTfSzGarg==
x-goog-generation: 1710237229773246
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 87941
cf-ray: 8750a3c40fc04522-TXL
expires: Tue, 16 Apr 2024 02:40:01 GMT

GET
H3 200 / Show response
ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/ 3 KB
2 KB 273ms
273ms Fetch
text/javascript 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

19998ea3ca16b6e2445110414739a731fe273942d5d2d426c680bbcdea3f7640

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/javascript
visited-url: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
Referer: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware
_vtok: ODAuMjU1LjcuMTE2
_zitok: 533334cc53f152ca36b01713233434
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 8750a3c5c95e4522-TXL

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ 0
0 184ms
183ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://claroty.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://claroty.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8750a3c549f24504-TXL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 16 Apr 2024 02:10:34 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 782 B
749 B 282ms
281ms Fetch
application/json 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

5bf40fd813caa5ad6ca1784528f7486ac90e46c97705072e2c54b1831d5746bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: bearer 48a696505cb61dcf5003fbd6445383
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 02:10:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"30e-K2uMheKcD+P17AdcegLXECaJ0To"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://claroty.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
cf-ray: 8750a3c66a1f4522-TXL

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 135ms
135ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A33%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:34 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 139ms
139ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:35 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:35 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 136ms
136ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A35%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:36 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:36 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 135ms
135ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=69c410a3-d708-4840-8fbd-35070cfb8a1f&session=09704153-9e5a-46c5-8280-86ec81a41437&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2016%20Apr%202024%2002%3A10%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Claroty%20Team82%20has%20analyzed%20the%20Fuxnet%20malware%20developed%20by%20the%20Blackjack%20hacking%20group%20and%20used%20in%20an%20cyberattack%20against%20Moscow-based%20Moscollector%2C%20a%20sewage%20and%20communication%20infrastructure%20company.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Unpacking%20the%20Blackjack%20Group%27s%20Fuxnet%20Malware%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Funpacking-the-blackjack-groups-fuxnet-malware&pageViewId=1cc1f758-87c9-42cc-824c-f43294429051&v=1.1.16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 02:10:37 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 16 Apr 2024 02:10:37 GMT

Verdicts & Comments Add Verdict or Comment

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
claroty.com/	1970-01-20 19:54:00	Name: XSRF-TOKEN Value: eyJpdiI6IjA3UE10SlpZQXFpeEVQRUJIMTFOWlE9PSIsInZhbHVlIjoidnFjWSt4czRhQTYzV1greWliVFpGZFhMNVc1ZkY3T2FMTEVveEtoSFpnRy9kOVhGN0VjanBaN3FaWWd1TFRnYlVRU3VxMHFlbkJPa09WZjVxS25KckpiL1ZIdzhHL3EwZGVTNVQ2ZzNTeEJUNmF5L1F1TFR2MUpkWlNaWmxheDAiLCJtYWMiOiI4ZGQ4ZWNmMmI3ZWFhZDZiMzg2OWJlNDQxZTgzYzNhYjQxMzJlY2E3OWZmZDQwYjJiM2FiYjBlYWQ0OWYwYzNjIiwidGFnIjoiIn0%3D
claroty.com/	1970-01-20 19:54:00	Name: claroty_session Value: eyJpdiI6InVPZFc4V1ZpczE2UjRDT0pJV25nYVE9PSIsInZhbHVlIjoiRlMvaTN2am5NemJCek5ISFVGSzZ1T3Yra0pwdUFheS9ZdDQvcWxuRGpDc0lQYVVEWW5aa3dDdE1yYzl2N2JhR0M5akhpOHlocGEwdUozUk5zQ0pNN1REb1Z0aXFqZWNkdkljSmpzU3JDUWFsSzFybC9yNTBZdXFZQzFaUU96RzYiLCJtYWMiOiIwM2YzOGM2Njk1OGE3MmQ5Mzg1Yzk2MDRiZThlZGIzNjJjNjAxYTkxYThmNzM4NDhhYzY4ZmNjNDZhOWNkMTg2IiwidGFnIjoiIn0%3D
.hsforms.net/	1970-01-20 19:53:55	Name: __cf_bm Value: qbB5oorVtsZrtxJcYwwu0ARZ2QnBpA7xjdh2nsDi1Ws-1713233432-1.0.1.1-z6f9rrHDXp2D_hQzFd6YezmWWJeyZ4LfwFU3MpUYKkY5yM.DIk0Ak86gvkDxnK16iW2cFF54kJdmbrZD5t94zQ
.claroty.com/	1970-01-21 04:39:29	Name: _biz_uid Value: 4298e2bc9f7741f4db2da10088ac73aa
.claroty.com/	1970-01-21 04:39:29	Name: _biz_nA Value: 1
.claroty.com/	1970-01-21 04:39:29	Name: _biz_pendingA Value: %5B%22ipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D4298e2bc9f7741f4db2da10088ac73aa%26_biz_l%3Dhttps%253A%252F%252Fclaroty.com%252Fteam82%252Fresearch%252Funpacking-the-blackjack-groups-fuxnet-malware%26_biz_t%3D1713233432558%26_biz_i%3DUnpacking%2520the%2520Blackjack%2520Group's%2520Fuxnet%2520Malware%2520%257C%2520Claroty%26_biz_n%3D0%26rnd%3D314148%22%5D
.claroty.com/	1970-01-20 22:03:29	Name: _gcl_au Value: 1.1.1344923416.1713233433
claroty.com/	1970-01-21 05:29:53	Name: _gd_visitor Value: 69c410a3-d708-4840-8fbd-35070cfb8a1f
claroty.com/	1970-01-20 19:54:07	Name: _gd_session Value: 09704153-9e5a-46c5-8280-86ec81a41437
.hsforms.com/	1970-01-20 19:53:55	Name: __cf_bm Value: US8hK5eR5gtOo4LclgsMmUcV355Qy1YwWJXhywYjKw8-1713233432-1.0.1.1-u3gKEKeox_ia5TeDM5RplWwtSM4vrXNpnc0TOQ4aOY_q4_brQhVOeyfrEKvE62CqGmn_K_drYG0cdTIIqnDJiQ
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: iZewlIeW5SxcO8JO5gsMaWegWCXch9Ru02UwpzVASLQ-1713233432871-0.0.1.1-604800000
.zoominfo.com/	1970-01-20 19:53:55	Name: __cf_bm Value: Z2bLBkAPu0gioc2_1c0DMLRrKzSYlLjNseTg3cySvIM-1713233432-1.0.1.1-B5DOe_n88NvyxbQWxaaK4yT86QbsP_GKAzum05ITufS.iFz6ddZ58keh_PGIADurILQbtBQEgsDURlk1Et.dYw
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: y1ZHWMzBBlCn0FtpxlUlyssiYbFqWamlRShoqwJZ_Hs-1713233432890-0.0.1.1-604800000
.claroty.com/	1970-01-21 05:29:53	Name: _ga Value: GA1.2.204035329.1713233433
.claroty.com/	1970-01-20 19:55:19	Name: _gid Value: GA1.2.241015562.1713233433
.claroty.com/	1970-01-20 19:53:53	Name: _gat_gtag_UA_84224451_1 Value: 1
.claroty.com/	1970-01-21 04:39:29	Name: _hjSessionUser_3443429 Value: eyJpZCI6IjlmNzAyOWViLTk3NzctNWQ1Yi1iNGY0LTU3OGIwNjE4MDI2MCIsImNyZWF0ZWQiOjE3MTMyMzM0MzMwNTgsImV4aXN0aW5nIjp0cnVlfQ==
.claroty.com/	1970-01-20 19:53:55	Name: _hjSession_3443429 Value: eyJpZCI6ImUyOGEyNGU2LWQzMzctNDYzMC05NzFlLTJhN2EyYWU0ZjgxNyIsImMiOjE3MTMyMzM0MzMwNTksInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.linkedin.com/	1970-01-21 04:39:29	Name: bcookie Value: "v=2&2a50c745-b4ef-47ae-8587-b5e117f4a42d"
.linkedin.com/	1970-01-21 00:13:05	Name: li_gc Value: MTswOzE3MTMyMzM0MzI7MjswMjHzzdsOHDKgGRrHFCMpSGIJJKwudwQF3NHOQaKoka/iUA==
.linkedin.com/	1970-01-20 19:55:19	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3246:u=1:x=1:i=1713233433:t=1713319833:v=2:sig=AQF7GtrC8UZjsTcvRG9GsISiOV_BQaI2"
.hubspot.com/	1970-01-20 19:53:55	Name: __cf_bm Value: UpEShpKOW26tT4jK3J196TqlSniKc4voh352vfD52_s-1713233433-1.0.1.1-oNaqd6uEIIikWqpBNUgn_EeGcD1p6QzUdB7HtPnYA4eM4PyHxpD7T26Fb4H1HUYanOD7ygiAyc5Yv7f25VCseQ
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: qLu5dB.Vqzscy.dPToJ2IFnA5YSldGyYVQDjbaRPlYk-1713233433780-0.0.1.1-604800000
.claroty.com/	1970-01-21 04:39:29	Name: _zitok Value: 533334cc53f152ca36b01713233434

38 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'battery'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'document-domain'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'navigation-override'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'web-share'.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://epsilon-globalaccelerator.6sense.com/v3/company/details Message: Failed to load resource: the server responded with a status of 401 ()
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
c.6sc.co
cdn.bizible.com
claroty.com
content.hotjar.io
cta-service-cms2.hubspot.com
epsilon-globalaccelerator.6sense.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.hubspot.com
js.zi-scripts.com
ka-p.fontawesome.com
kit.fontawesome.com
okt.to
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.oktopost.com
stats.g.doubleclick.net
track.hubspot.com
ws-assets.zoominfo.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
104.16.117.43
104.18.176.125
104.18.192.125
104.18.37.212
108.138.36.118
13.107.42.14
13.248.142.121
138.197.228.97
142.250.185.132
142.250.74.195
152.195.15.58
18.66.192.39
2.17.100.184
2001:4860:4802:32::36
2606:4700:4400::ac40:93bc
2606:4700:4400::ac40:991b
2606:4700::6810:6cfe
2606:4700::6810:7674
2606:4700::6810:8bd1
2606:4700::6810:a0a8
2606:4700::6811:e4a3
2606:4700::6812:8e77
2620:1ec:21::14
2a00:1450:4001:810::200e
2a00:1450:4001:811::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:831::2008
2a00:1450:400c:c00::9a
2a02:26f0:3500:16::215:149b
2a02:26f0:ab00::214:8e41
52.20.195.32
52.50.100.69
54.230.228.47
01c77d3db354404ca8bec445535cf75ea2d84f363bd298270ddb00d2c1d94ffa
043a4ec31168345ebe7c4de609fd71a61c3fda959fc67e3db2f075ede09ae03d
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0ede3ffda856f66ed7d3685f59716dfec3a38aedf5701ad54125d8b8889ba572
130ef2f6b5474f931122e35600509422c5610ca27f8e2eb26b731c2e595fee22
13f3849bcb0803d10f69b84c0c9be9b935ec89306a9e370365629fbe1eb20e37
17cfde48999dcfe173e106d30c3f9f329e6558a1db1fc032876589ec516945f3
19998ea3ca16b6e2445110414739a731fe273942d5d2d426c680bbcdea3f7640
19be36b532c3147a005317cbc940c69b7137c7980a462525055393d3cfd20b30
24b19f3adb4b93ae4e7c14e7fc2b17ffa34ca6a03518b7b0fc18117b8c9ee214
2517eb1a7ae21f813fe2b074dd0ba1091bc5ad60356750b04de79a6328960c71
279fd8daab9081d3f17312be6e5d7bf1634d7ba6edf5a349011c5c922a709453
30e56b8ea8620ad4338d19c01c39c349bd2e614716adff78dec000cbab05158d
3eb4e5cc6483bbd68941a52e05a7f209dc6a56121cdbae91ba596159c73b9d29
4183a5c823ec18238c04c02d03449b179e41eb95e318d9365b9da937309a02c5
43b962bc3ef0ddc52398c669a6344d1d78954017cd297f5f95654f71a16cd8e9
4c19b3e1b4412d65f2867422b94958aef88fb30739eb739e2c7dc2ea53dc0e38
4d9d9af17df221748b0e58108771b9aa312a7b1caa789e60ccf9167a0e10f420
56fd6ac00de2e21a09cbd192538fa98e5760d347064942418aa32b146cfa0444
5bf40fd813caa5ad6ca1784528f7486ac90e46c97705072e2c54b1831d5746bb
5c076c9a1f9b9651fb91d83cd691cc0796e5d167e072d9fe13253c8f6b442ef9
5c76dd89a767afd512ce6c6370424f39a632ebb736c16ac37952fbfd97575448
5cbbe573b80252da25be2037dc40fc3bc3e0a17e90c41eee77f4da1925b18138
5dc48b72ff6a045195d18793ec972540af350b7654204ac498b259ec2ac98ea7
60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784
655460488a4e86be0c0adbd0af8f537bcc1f077f261f3e95ff8e213af3b33e39
6a121b8e6700c3f60127b06d7ef6188ae3ec5d1a4c55f2353bd7cda35524226e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
7d23a3cba9c9e734b155c86294109c51ccd1b340b990dda6616427ba39b988db
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
907367f091c381f71b38cc584cc54a1c678cbd4f82ebeff0aa6aca80c85cb42c
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
943ded0a2adddb140465921e9f3a050f1fb064974efebe3ef311e9e75b6a2fa5
95401ddb551c7b54e882e38efaf5e19905478635b8f0566f71f4ba8aa40f9e1a
95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538
962c60f1e79f0ca16e7142d53a2eae2ec60d33071a306d010e25cfc262a652c4
976437eebed4b0c67e1d0a7ae80c5eb43946177387055d833af55958522aa393
a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423
ad7401d2e529b7d3c45e9f5fb1fdcbd16c4cc8d96d74cfaaf0c09896b0cccab3
aeae8446f674a97dfdeea4f422f3622337e0095b66d19bb12b38d5523f1f2850
b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9
b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1
b514c9021251fdccd9ca7ef0bfea3eb81e95962f3fdb78d60f9693beafcef161
b8503fbaf4056c36c2ddc016b0a9e857f7487fb70b0da10419f77694522c3bcf
c33c3b4654450ad9afe9d9cb1da4e2ad8f2b601218d4015da547331079865976
c4d04d2b6a041dde11c80d8332f983a58c1031c663ab4f42230899cb82adf4a7
d269e745735d0cff621fefc03710777c918f02475e693312e49164ee589105d7
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc924bdb7298a1d9785ee12b8d0637a528473b8e8bad1be2008c515038b6b7d9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df35f77b4f6930c9d470893d1bb267004c3c238d91d190eac0878c26ca21e0ff
e02675c0b58e43a34fbc81fed80ec2798deb5ddae78a16f9dd5e0e82e84b598a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edb9ff04d5c5bf6738977d073dc2f1c721ba3fb42c684acef3afde5f7fd85098
ee59c007b99f5ce43f5b2d310df1e72968d48ed012667ab0194b812697ad93c5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef410da15ef1307792230bc15984643d4fa47ab902d62496ef98a725b1429e51
f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2
f5286f06671542af1693b4f92c17639b0967af0960196235917470b20a7a2adb
fa8204005ed25e30f3ee56dbad3afa3c011e12636e75decf2b1aaf22a1c326dd
fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

claroty.com Open in urlscan Pro 138.197.228.97 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

90 Requests

99 %HTTPS

52 %IPv6

28 Domains

41 Subdomains

33 IPs

5 Countries

1243 kBTransfer

3209 kBSize

24 Cookies

35 Outgoing links

Redirected requests

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Screenshot
Live screenshot

Full Image

90
Requests

99 %
HTTPS

52 %
IPv6

28
Domains

41
Subdomains

33
IPs

5
Countries

1243 kB
Transfer

3209 kB
Size

24
Cookies

90 HTTP transactions
0 data transactions