ics-cert.kaspersky.com Open in urlscan Pro
185.105.225.103 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants...
Submission: On August 14 via api (August 14th 2023, 11:25:44 am UTC) from DE — Scanned from DE

Summary HTTP 100 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 20 IPs in 5 countries across 13 domains to perform 100 HTTP transactions. The main IP is 185.105.225.103, located in St Petersburg, Russian Federation and belongs to OOOVPS-AS, RU. The main domain is ics-cert.kaspersky.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on September 29th 2022. Valid for: a year.

This is the only time ics-cert.kaspersky.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
61	185.105.225.103 185.105.225.103	200487 (OOOVPS-AS) (OOOVPS-AS)
4	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6812:d63b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c03::9b	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:d73b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1 2	2606:4700::68... 2606:4700::6810:7baf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	65.9.95.88 65.9.95.88	16509 (AMAZON-02) (AMAZON-02)
1 3	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE)
1	2600:9000:212... 2600:9000:2127:ce00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2 2	142.250.185.102 142.250.185.102	15169 (GOOGLE) (GOOGLE)
100	20

61 185.105.225.103 (St Petersburg, Russian Federation)

ASN200487 (OOOVPS-AS, RU)
PTR: fthub.kaspersky.com

ics-cert.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:d63b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c03::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:d73b (United States)

ASN13335 (CLOUDFLARENET, US)

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7baf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-88.prg50.r.cloudfront.net

js.go2sdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f6.1e100.net

12346775.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:ce00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.102 (Grosse Pointe, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	kaspersky.com ics-cert.kaspersky.com go.kaspersky.com	2 MB
8	google.com www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 2770 adservice.google.com — Cisco Umbrella Rank: 116	35 KB
7	doubleclick.net 3 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 114 12346775.fls.doubleclick.net — Cisco Umbrella Rank: 407773 ad.doubleclick.net — Cisco Umbrella Rank: 194	3 KB
7	gstatic.com www.gstatic.com fonts.gstatic.com	598 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 368 www.linkedin.com — Cisco Umbrella Rank: 543 px4.ads.linkedin.com — Cisco Umbrella Rank: 5984	5 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 65	497 KB
5	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3840 onesignal.com — Cisco Umbrella Rank: 1426	83 KB
3	google.de 1 redirects www.google.de — Cisco Umbrella Rank: 5933 adservice.google.de — Cisco Umbrella Rank: 12711	1 KB
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 1042	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 54	21 KB
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 890	374 B
1	go2sdk.com js.go2sdk.com — Cisco Umbrella Rank: 36541	18 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 819	5 KB
100	13

	Domain	Requested by
61	ics-cert.kaspersky.com	ics-cert.kaspersky.com
6	www.gstatic.com	www.google.com www.gstatic.com
5	www.googletagmanager.com	ics-cert.kaspersky.com www.googletagmanager.com www.google-analytics.com
4	www.google.com	ics-cert.kaspersky.com www.gstatic.com www.google.com
3	px.ads.linkedin.com	3 redirects
3	12346775.fls.doubleclick.net	1 redirects www.googletagmanager.com adservice.google.com
3	onesignal.com	cdn.onesignal.com
2	ad.doubleclick.net	2 redirects
2	adservice.google.com	12346775.fls.doubleclick.net
2	unpkg.com	1 redirects
2	www.google.de	ics-cert.kaspersky.com
2	stats.g.doubleclick.net	www.googletagmanager.com
2	region1.analytics.google.com	www.googletagmanager.com
2	www.google-analytics.com	ics-cert.kaspersky.com www.google-analytics.com
2	cdn.onesignal.com	ics-cert.kaspersky.com cdn.onesignal.com
1	adservice.google.de	1 redirects
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	js.go2sdk.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	fonts.gstatic.com	www.google.com
1	go.kaspersky.com	ics-cert.kaspersky.com
100	23

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
www.kaspersky.com
www.sei.cmu.edu

Subject Issuer	Validity	Valid
ics-cert.kaspersky.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-29` - `2023-10-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
go.kaspersky.com Cloudflare Inc ECC CA-3	`2023-04-03` - `2024-04-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
js.go2sdk.com Amazon RSA 2048 M01	`2023-08-06` - `2024-09-02`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
Frame ID: E8E910F8988914F69F70897CB366EF1B
Requests: 87 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=s51cvdygeam0
Frame ID: 45748CC52472C8BB12923804148A29AE
Requests: 8 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq
Frame ID: 97DA966364C21F2EFC810CB7BF353A43
Requests: 3 HTTP requests in this frame

Frame: https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F
Frame ID: BEA938169B1E6A945E53F247FAD73B34
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F
Frame ID: AF5F2352A53B43BDE9DA057F47AEBF9F
Requests: 1 HTTP requests in this frame

Frame: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F
Frame ID: F8CA44F792F470FFB961D1BCD8C8645F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Common TTPs of attacks against industrial organizations. Implants for gathering data | Kaspersky ICS CERT

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

100
Requests

97 %
HTTPS

73 %
IPv6

13
Domains

23
Subdomains

20
IPs

5
Countries

2801 kB
Transfer

7047 kB
Size

18
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/intent/tweet?text=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20gathering%20data&url=https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data&title=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20gathering%20data

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/enterprise-security/threat-intelligence
Title: Kaspersky Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.sei.cmu.edu/our-work/cybersecurity-center-development/authorized-users/index.cfm

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/web-privacy-policy
Title: Privacy policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88

https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js

Request Chain 92

https://12346775.fls.doubleclick.net/activityi;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F HTTP 302
https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Request Chain 94

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1692012340535%26url%3Dhttps%253A%252F%252Fics-cert.kaspersky.com%252Fpublications%252Freports%252F2023%252F07%252F31%252Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzxwW_E3NjcQAAAYnzy2iEgbZorT9EWE5IOUnuVQXp7PRvd1kuhW-LTRhUOPSYlvbN1i4

Request Chain 99

https://adservice.google.de/ddm/fls/i/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F HTTP 302
https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Request Chain 100

https://ad.doubleclick.net/ddm/activity/src=13364882;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005 HTTP 302
https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005

100 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/ 95 KB
25 KB 515ms
363ms Document
text/html 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

e7147eed88d20a832f91a585ca57444da8dd17a038f86b0c83b7792d0ca0f256

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 14 Aug 2023 11:25:38 GMT
link: <https://ics-cert.kaspersky.com/wp-json/>; rel="https://api.w.org/" <https://ics-cert.kaspersky.com/wp-json/wp/v2/publications/8055>; rel="alternate"; type="application/json" <https://ics-cert.kaspersky.com/?p=8055>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
875 B 145ms
55ms Script
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5c522f9116ea6ea47e03ca9f70125e37edc03ca979cee71d7e9a8c844d4de537

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 555
x-xss-protection: 1; mode=block
expires: Mon, 14 Aug 2023 11:25:39 GMT

GET
H2 200 style.min.css
ics-cert.kaspersky.com/wp-includes/css/dist/block-library/ 95 KB
16 KB 72ms
70ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-17ced"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 classic-themes.min.css
ics-cert.kaspersky.com/wp-includes/css/ 291 B
612 B 73ms
71ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/css/classic-themes.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-123"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 swiper.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 19 KB
4 KB 138ms
135ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/swiper.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5f07d43571a20235b2506061c9729d91179d32b8b3c75123aa8fcd45e60d7541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-4d42"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 select2.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 15 KB
3 KB 140ms
137ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/select2.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

31e49ff119a0ddbe6a2c59628e7a7193a97e20992247dd7ffd818f0ab0a6a205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-3b4c"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 selectize.default.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 9 KB
3 KB 141ms
138ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/selectize.default.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

89bbd336534007854ca84e6e1659c1304ea19696ab8f9b04af5a2f67707f6cd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:24 GMT
server: nginx
content-encoding: gzip
etag: W/"63487344-24b5"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 tooltipster.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 7 KB
2 KB 141ms
139ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/tooltipster.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a47d6b5e7293f77a4aaea5a7df20d3830b10acafcce2c54c14befbe3fa5f69ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-1b22"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 tooltipster-light.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 207 B
568 B 142ms
139ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/tooltipster-light.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1745ea436aaa982c56ab869677fd4846dcd07ea2261fb573572b0af35bb13555

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-cf"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 magnific-popup.min.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/ 5 KB
2 KB 142ms
140ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/cdn/magnific-popup.min.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 13 Oct 2022 20:21:23 GMT
server: nginx
content-encoding: gzip
etag: W/"63487343-148b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 style.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 249 KB
54 KB 143ms
141ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b2adb4f008e0cfee4d09dae8a1e4f5c19d2e492ca646326bc026cbcd9874a847

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 30 Jan 2023 07:34:35 GMT
server: nginx
content-encoding: gzip
etag: W/"63d7730b-3e469"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 service.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 1 KB
803 B 205ms
203ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/service.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

63355ec0cc69d2bbc2fd4aedeec5d2eae03e8453192bff018c65da5493d6853a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 18 Apr 2022 12:28:43 GMT
server: nginx
content-encoding: gzip
etag: W/"625d597b-422"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 post.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 71 KB
16 KB 205ms
203ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/post.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

9011d877f13b080cfffe09ecf451453de5b60c1af56b35f488561d309edb32b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:49:03 GMT
server: nginx
content-encoding: gzip
etag: W/"64a728bf-11cc5"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 simplebar.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/libs/ 4 KB
2 KB 205ms
204ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/libs/simplebar.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

c9e76321a30fe79540c5a5fe74410d3ca813e12e13065b2eb79ce4e969443d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Aug 2022 09:49:34 GMT
server: nginx
content-encoding: gzip
etag: W/"62ff5cae-f32"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 fix.css
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/ 3 KB
1 KB 205ms
204ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/fix.css?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1d3745f80b6110a92a9c4eb260a1f34c93b118e2898f0af2bc83d1894c67f63a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:59:10 GMT
server: nginx
content-encoding: gzip
etag: W/"64a72b1e-b59"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 X27_enlighterjs.min.css
ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/ 78 KB
12 KB 206ms
204ms Stylesheet
text/css 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/X27_enlighterjs.min.css?ver=M75GyXRxHHGm8B9

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

2db9f73aadc19fc7a482d18f2ad3626268a76237e4d64f07d46214ca3fed20d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 14 Aug 2023 11:25:38 GMT
server: nginx
content-encoding: gzip
etag: W/"64da0f32-1388a"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 logo-ics.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 7 KB
3 KB 136ms
127ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/logo-ics.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

55fb0a022d2809bd202995a210109bdd7ff494af4fd47336902b2fbd952c808a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 06 Oct 2021 14:27:01 GMT
server: nginx
content-encoding: gzip
etag: W/"615db235-1c7b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 telegram.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 1 KB
989 B 136ms
127ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/telegram.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fc9310308aaf2b1b2b0dd07ac2458a8c27075f269107bae5c8d1523a1b433406

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 23 Mar 2022 22:19:08 GMT
server: nginx
content-encoding: gzip
etag: W/"623b9cdc-449"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 twitter.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 2 KB
1 KB 137ms
127ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/twitter.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

cb23d15260f981e96001c4ed717434452f702481486e3b181b11334e857044b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:44:34 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08d82-850"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 in.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 868 B
884 B 137ms
128ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/in.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

30960da3876f4fe08239419423e5f31d9715e50fac4c892f6d6087c2a817d752

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 12:34:17 GMT
server: nginx
content-encoding: gzip
etag: W/"611fa149-364"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 email.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 1 KB
893 B 137ms
128ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/email.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

190615a6ddc58e11e24bce9d742205deac48e47037dd32bab36574536af1e7c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:44:31 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08d7f-4c4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 kruglov.jpg
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/ 250 KB
250 KB 137ms
128ms Image
image/jpeg 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/kruglov.jpg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

177fa440deacfe8aa6b3d01e431308c1cab3c165d2f9175ce4a3e63952dd6cb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 24 Nov 2021 13:02:31 GMT
server: nginx
etag: "619e37e7-3e6e3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/jpeg
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 255715
x-xss-protection: 1; mode=block

GET
H2 200 kopeycev.jpg
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/ 33 KB
33 KB 137ms
128ms Image
image/jpeg 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2021/11/kopeycev.jpg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1fbf65ee83992c5928497d41fbb6da61f884761dda468d2dbaa3c851c2a0b65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 24 Nov 2021 13:08:10 GMT
server: nginx
etag: "619e393a-8301"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/jpeg
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 33537
x-xss-protection: 1; mode=block

GET
H2 200 snegirev.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2022/06/ 29 KB
30 KB 137ms
129ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2022/06/snegirev.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fa9df2917ec7c5bbb641eadbcf39890a04fcae497df7fd6b566db6f88e1b8f11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 23 Jun 2022 15:27:05 GMT
server: nginx
etag: "62b48649-74e9"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 29929
x-xss-protection: 1; mode=block

GET
H2 200 table_of_contents.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 4 KB
2 KB 73ms
72ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/table_of_contents.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

67c26a5fecf3cf8d59f0525c9026dddf05d60ff355b28380d0edaa39934ec850

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 20 Apr 2023 21:37:42 GMT
server: nginx
content-encoding: gzip
etag: W/"6441b0a6-e6c"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 rss-vector-footer.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 779 B
856 B 137ms
129ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/rss-vector-footer.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

d0b124b8f696eba5c0d222ec4d34eea1d44e372001121a61f5048f34cda8840e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 19 Jan 2023 05:01:03 GMT
server: nginx
content-encoding: gzip
etag: W/"63c8ce8f-30b"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 key.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/ 696 B
804 B 137ms
129ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/icons/key.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

fe9d09bad67180679d03b4770178e713030ed0f67118d9efa98f4f15165de2ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:05:02 GMT
server: nginx
content-encoding: gzip
etag: W/"60c0843e-2b8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 footer_cert.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 11 KB
4 KB 137ms
129ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/footer_cert.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

31a1988204c7cd76f06d2dbd82b0ee536ce8f004f1e7afd8dfb411229bbb43c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Nov 2021 18:28:44 GMT
server: nginx
content-encoding: gzip
etag: W/"6197ecdc-2b4e"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 kaspersky.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/ 3 KB
2 KB 137ms
129ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/img/kaspersky.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

13c01fc2e94ee7c569128355c1e85f6a8c85b6f34a26270215d4b1a3fe3f72ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 09:04:53 GMT
server: nginx
content-encoding: gzip
etag: W/"60c08435-d69"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery-3.6.4.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 88 KB
36 KB 77ms
77ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/jquery-3.6.4.min.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 20 Apr 2023 21:00:44 GMT
server: nginx
content-encoding: gzip
etag: W/"6441a7fc-15ec3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 libs.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 478 KB
167 KB 72ms
72ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

da924ffa322b79af0af2e0c4ac8ee6beb62e16c0313d723dda9f8d27c7bbdb96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 12 Jul 2022 20:37:33 GMT
server: nginx
content-encoding: gzip
etag: W/"62cddb8d-778a0"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 ScrollMagic.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 17 KB
7 KB 136ms
136ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ScrollMagic.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

da9dad45994fa30a773ffd383f0daba950926e1c95fc807b644554825ac34bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:17 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d579-4416"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 debug.addIndicators.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 7 KB
3 KB 136ms
136ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/debug.addIndicators.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5c15402dcdd0b03490883b62681c0d676af10894c7ce55218650d0f3827c6f0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:30 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d586-1bb8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 select2.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 67 KB
23 KB 136ms
136ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/select2.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

1870b7c456eb7af4346917168392449543a7717617c53b4c3ae03be1c5803d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:16 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d578-10b24"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 selectize.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 45 KB
18 KB 136ms
127ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/selectize.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

f82d00e4896a9aee107123f1ae51a9699c49d38563b118cabbe1bcda49795099

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:15 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d577-b309"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery.tooltipster.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 17 KB
6 KB 136ms
124ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/jquery.tooltipster.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:20 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d57c-4473"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 jquery.magnific-popup.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 20 KB
8 KB 136ms
124ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/jquery.magnific-popup.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 23 Aug 2022 13:26:22 GMT
server: nginx
content-encoding: gzip
etag: W/"6304d57e-4ef8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 inputmask.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 93 KB
33 KB 136ms
124ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/inputmask.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

0f24ca5085d2d3181b6d4b20158b5282e9f0cf024afce687f8b9611833a17405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 21 Sep 2021 07:58:20 GMT
server: nginx
content-encoding: gzip
etag: W/"6149909c-17329"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 forms2.min.js Show response
go.kaspersky.com/js/forms2/js/ 208 KB
70 KB 160ms
55ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.kaspersky.com/js/forms2/js/forms2.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 13 Jul 2023 18:50:22 GMT
server: cloudflare
age: 1490
etag: "201e3f-34099-60062cdee3780"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 7f68d6a0891192b7-FRA
expires: Mon, 14 Aug 2023 15:25:39 GMT

GET
H2 200 simplebar.min.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/ 64 KB
24 KB 136ms
124ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/libs/simplebar.min.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b6e9507fb570c499c7f80306e10f49aedc4b83ace08371c4024e1ebd04aa7b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Aug 2022 09:41:19 GMT
server: nginx
content-encoding: gzip
etag: W/"62ff5abf-10140"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 script.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 277 KB
77 KB 136ms
125ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/script.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

c4c16e7aaba6f1771a33267ffa6a2edb3147ee8654e119794419219fed6c3061

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:43:42 GMT
server: nginx
content-encoding: gzip
etag: W/"64a7277e-454b7"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 post.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 14 KB
5 KB 136ms
125ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/post.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

802201fb0c8df6708dfc7f2425f573e040cd4a4ce277a5e834972c5a70bc49bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 05 Jul 2023 22:43:49 GMT
server: nginx
content-encoding: gzip
etag: W/"64a5f225-3922"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 search.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 376 KB
131 KB 136ms
125ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/search.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

a81fd0cb9f98399373bd142e503674322f3ece668d07731663da3fa925451030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:43:42 GMT
server: nginx
content-encoding: gzip
etag: W/"64a7277e-5e071"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 ajax.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 0
411 B 136ms
125ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ajax.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 18 Jun 2021 10:35:22 GMT
server: nginx
etag: "60cc76ea-0"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 cvsscalc30.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 20 KB
7 KB 136ms
126ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/cvsscalc30.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

515bc9f8975260083cab2128b2fd713331077149edfb309b08e8a3a9a4bba885

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 22 Jun 2021 10:58:44 GMT
server: nginx
content-encoding: gzip
etag: W/"60d1c264-4f08"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 commit.js Show response
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/ 50 KB
11 KB 136ms
126ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/js/commit.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b657648fea8dfd40797f82706fd82b2771a7c18aedac16ceaa3a64851f38b9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 06 Jul 2023 20:54:17 GMT
server: nginx
content-encoding: gzip
etag: W/"64a729f9-c743"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 X27_enlighterjs.min.js Show response
ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/ 62 KB
21 KB 136ms
127ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/plugins/enlighter/cache/X27_enlighterjs.min.js?ver=M75GyXRxHHGm8B9

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

b2d31599822dae1353d655633c6dbd9454ef2138d172798f4a91119eedd6d89d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 14 Aug 2023 11:25:39 GMT
server: nginx
content-encoding: gzip
etag: W/"64da0f33-f756"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 151ms
62ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 2034
etag: W/"2a3bbde818bef34d53a0df862ead5d5f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7f68d6a07e42085d-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Thu, 17 Aug 2023 11:25:39 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 496 KB
123 KB 145ms
50ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2c1b5b69adadca970544ff9ed4c2757ed64d8fcb4f0dfc41d7fb9ae0f79a83f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125956
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:39 GMT

GET
H2 200 wp-emoji-release.min.js Show response
ics-cert.kaspersky.com/wp-includes/js/ 18 KB
6 KB 136ms
130ms Script
application/javascript 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 28 Jun 2023 22:12:33 GMT
server: nginx
content-encoding: gzip
etag: W/"649cb051-4904"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ 441 KB
178 KB 138ms
40ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ics-cert.kaspersky.com/
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40018
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H2 200 search.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 2 KB
1 KB 119ms
119ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/search.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

7fc0056c4e8fb3c755fa7ae276931566ae8b635948b6f663ae6812b9fafc8742

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:02 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e2-789"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 breadcrumbs-arrow.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 1 KB
1 KB 118ms
118ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/breadcrumbs-arrow.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

aa60c8b27a9a97424a86c8ac244c0d6b6986e0062ecde772de2a07aa446959d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:04 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e4-54e"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 pdf_white.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 566 B
712 B 115ms
115ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/pdf_white.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

70ba6d4d54217bc2d539a1bbee55ce4aac3e73ec717fc802784cbe767442f35e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:03 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9e3-236"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 arrow-up_green.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 294 B
630 B 115ms
115ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/arrow-up_green.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5c713c5088e6e5670a082c76b5945af0bdf14874cabc5f3cbf2f967c2ace0ed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:10 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9ea-126"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

GET
H2 200 MuseoSansCyrl-500.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 44 KB
45 KB 115ms
115ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/MuseoSansCyrl-500.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

91612bae01a48954d84ad43d0753b720742d72730d13582f2d315fd21dadb561

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:26 GMT
server: nginx
etag: "611f98a6-b060"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 45152
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Medium.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
46 KB 115ms
114ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Medium.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

5d08cf4192fbf7d68490f54b84f4d4d784126d0c7e3a72a95f9014eb07cbc92f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 05 Apr 2022 12:44:38 GMT
server: nginx
etag: "624c39b6-b500"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 46336
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Light.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
46 KB 115ms
114ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Light.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

e6c4ea7a876a3217a3ed3b77f102bcf88b06334e573b145af0c6018c78ce308a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 05 Apr 2022 12:43:27 GMT
server: nginx
etag: "624c396f-b5b4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 46516
x-xss-protection: 1; mode=block

GET
H2 200 KasperskySans-Bold.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 45 KB
45 KB 115ms
114ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/KasperskySans-Bold.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

2d223e51ec208d5f2b3c41dc05814044632a911344fd0031d5986c3d5bae35df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:24 GMT
server: nginx
etag: "611f98a4-b2ec"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 45804
x-xss-protection: 1; mode=block

GET
H2 200 230731-ttps-p2-pic1.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 20 KB
21 KB 166ms
165ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/230731-ttps-p2-pic1.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

8c1557795104f33886b66873c635a7b8ef9cb4405390a0f0d45947ea1154adc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 10:14:09 GMT
server: nginx
etag: "64c0f1f1-50d8"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 20696
x-xss-protection: 1; mode=block

GET
H2 200 230731-ttps-p2-pic2.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 82 KB
83 KB 166ms
165ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/230731-ttps-p2-pic2.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

671acdc94f3d05d75cf2c40469a5e5bfa1d8e09cd3c8b84aee083683a33f9837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 10:16:29 GMT
server: nginx
etag: "64c0f27d-14813"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 83987
x-xss-protection: 1; mode=block

GET
H2 200 230731-ttps-p2-pic3.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 3 KB
4 KB 167ms
166ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/230731-ttps-p2-pic3.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

ada6841876bb494610299e56020e604517bdfcb1ecd1a3dff7a06f8b45daee59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Jul 2023 10:17:04 GMT
server: nginx
etag: "64c0f2a0-c8c"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 3212
x-xss-protection: 1; mode=block

GET
H2 200 230731-ttps-p2-picd1-en.png
ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/ 67 KB
68 KB 167ms
166ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/uploads/sites/27/2023/07/230731-ttps-p2-picd1-en.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

db55565121291c4dd036ebdfa67079dd7e6e0e3722d648da4b0693d9b2d13427

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Sun, 30 Jul 2023 16:55:33 GMT
server: nginx
etag: "64c69605-10c88"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68744
x-xss-protection: 1; mode=block

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 134ms
39ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 14 Aug 2023 09:44:23 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6076
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 14 Aug 2023 11:44:23 GMT

GET
H2 200 check_white.svg
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/ 2 KB
1 KB 159ms
159ms Image
image/svg+xml 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/images/icons/check_white.svg

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

0778cd2f1eba0c56ac2c8995079e044d7c80c67345a51799a2e86f70d6ff5f7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 17:44:10 GMT
server: nginx
content-encoding: gzip
etag: W/"611fe9ea-7e3"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/svg+xml
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-xss-protection: 1; mode=block

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
226 B 47ms
46ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=695840367&t=pageview&_s=1&dl=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&ul=en-us&de=UTF-8&dt=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20gathering%20data%20%7C%20Kaspersky%20ICS%20CERT&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1670161353&gjid=487827376&cid=1040194566.1692012339&tid=UA-88685013-1&_gid=549523828.1692012339&_r=1&_slc=1&z=423633595

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b29d761d258ea9026f97b4470609b066558fe004a8e42199a5e40b1116d79b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ics-cert.kaspersky.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 556 KB
143 KB 49ms
48ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

91ed372e022b2edb0be495f94a0016b1ddc68ed868761c5c6a4a9d1335c51247

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 145809
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:39 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 233 KB
81 KB 56ms
56ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f6e6f99d4bad861a2dd396bb9357f7c6b47bbbaad1f37e6d06ae7532bc4885c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82870
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 14 Aug 2023 11:25:39 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 59ms
58ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.2.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1047
etag: W/"7f9669464fe15e6a516c0eb693b26dbb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7f68d6a3097f085d-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Thu, 17 Aug 2023 11:25:39 GMT

GET
H2 200 MuseoSansCyrl-300.woff
ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/ 44 KB
44 KB 74ms
74ms Font
font/woff 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/fonts/MuseoSansCyrl-300.woff

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

8d5cd94631173b6f37f652afe93483949846d80d76afe1c5fa2d9a561182c066

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/wp-content/themes/new_ics_cert/assests/css/style.css?ver=6.2.2
Origin: https://ics-cert.kaspersky.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 20 Aug 2021 11:57:25 GMT
server: nginx
etag: "611f98a5-aeb4"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: font/woff
access-control-allow-origin: https://ics-cert.kaspersky.com
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 44724
x-xss-protection: 1; mode=block

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 4574 55 KB
31 KB 69ms
69ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=s51cvdygeam0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9bdcfdbc18b3ddf6261fa6114eee711aefa81f99030becd4d9a14d841a46bbee

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MwYmYWuYLBUsQkV4alI4Jw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 31522
content-security-policy: script-src 'report-sample' 'nonce-MwYmYWuYLBUsQkV4alI4Jw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:39 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 260 KB
87 KB 50ms
49ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-NSVBRC7S52&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b2fe500cd00a2a9779cb5e31c7b56dd83d6c8a280ed5a92aaf369fcb091876a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89486
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 14 Aug 2023 11:25:39 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
259 B 135ms
46ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-93LQN8J8DF&gtm=45je3890&_p=695840367&_gaz=1&ul=en-us&sr=1600x1200&cid=1040194566.1692012339&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&dt=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20gathering%20data%20%7C%20Kaspersky%20ICS%20CERT&sid=1692012339&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:39 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
250 B 150ms
47ms Ping
text/plain 2a00:1450:400c:c03::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-93LQN8J8DF&cid=1040194566.1692012339&gtm=45je3890&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93LQN8J8DF&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:39 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 164ms
77ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-93LQN8J8DF&cid=1040194566.1692012339&gtm=45je3890&aip=1&z=1040548334

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 4574 55 KB
24 KB 124ms
39ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=s51cvdygeam0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 10:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4817
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 10:05:22 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 4574 441 KB
177 KB 142ms
57ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40018
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/422be36b-503e-4627-a36f-992622a95746/ 3 KB
2 KB 54ms
50ms Script
text/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/422be36b-503e-4627-a36f-992622a95746/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1294b4148c3fb902d191e4389452c52723ed253797575adcff0c193bb84f0576

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
age: 96
cf-polished: origSize=3396
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 1810c5fe-2e76-4f95-aa87-3cde7e1c8950
x-runtime: 0.074059
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"17d19a67068b6b00d5d65c90fdb71233"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 7f68d6a3faa9085d-FRA
access-control-allow-headers: SDK-Version
expires: Mon, 14 Aug 2023 12:25:39 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 54ms
53ms Stylesheet
text/css 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:39 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1897
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 7f68d6a4ac6090d4-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Wed, 13 Sep 2023 11:25:39 GMT

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/422be36b-503e-4627-a36f-992622a95746/ 240 B
773 B 128ms
81ms Fetch
application/json 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/422be36b-503e-4627-a36f-992622a95746/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97160b6dd11e6c712dac3618caa0b31927e95e0dedee9b9b205fbd2245ca0349

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: ec300afe-2d3e-486e-b7f3-dbe294b9f1e1
x-runtime: 0.011452
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"97160b6dd11e6c712dac3618caa0b319"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept, Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 7f68d6a5886230c9-FRA
access-control-allow-headers: SDK-Version

GET
DATA 200
OK truncated
/ Frame 4574 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4574 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 4574 2 KB
2 KB 39ms
38ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 09:40:05 GMT
x-content-type-options: nosniff
age: 265535
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Fri, 18 Aug 2023 09:40:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 4574 15 KB
16 KB 129ms
39ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 02:58:03 GMT
x-content-type-options: nosniff
age: 203257
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Aug 2024 02:58:03 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 4574 102 B
134 B 54ms
54ms Other
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=3kTz7WGoZLQTivI-amNftGZO

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a9c87b1ce80a8696f4790411959bb5cf0ccf1bc0a9c8cf2477c88a44e1104f4b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq&co=aHR0cHM6Ly9pY3MtY2VydC5rYXNwZXJza3kuY29tOjQ0Mw..&hl=de&v=3kTz7WGoZLQTivI-amNftGZO&size=normal&cb=s51cvdygeam0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 14 Aug 2023 11:25:40 GMT

GET
H2 200 logo_for_push_ics_cert.png
ics-cert.kaspersky.com/wp-content/themes/ics_theme/assets/picture/ 9 KB
10 KB 68ms
68ms Image
image/png 185.105.225.103
OOOVPS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ics-cert.kaspersky.com/wp-content/themes/ics_theme/assets/picture/logo_for_push_ics_cert.png

Requested by

Host: ics-cert.kaspersky.com
URL: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.105.225.103 St Petersburg, Russian Federation, ASN200487 (OOOVPS-AS, RU),

Reverse DNS

fthub.kaspersky.com

Software

nginx /

Resource Hash

24d0839fe019a3a2bf30ad9b50ed65935a2718c921e32147db3439a58bd8210a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/publications/reports/2023/07/31/common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 18:33:07 GMT
server: nginx
etag: "601aec63-248f"
x-frame-options: sameorigin
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 9359
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 97DA 7 KB
1 KB 52ms
52ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8121a8f7c991e1014fd303a3f7639bec580415e4264f6cd899c4ef065ee4dc86

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_Tke-CfRjWe8-oakOjk8lg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1156
content-security-policy: script-src 'report-sample' 'nonce-_Tke-CfRjWe8-oakOjk8lg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:40 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 97DA 55 KB
24 KB 40ms
39ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 10:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4818
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 10:05:22 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/ Frame 97DA 441 KB
177 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/3kTz7WGoZLQTivI-amNftGZO/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=3kTz7WGoZLQTivI-amNftGZO&k=6Lc4EwkUAAAAAMHZJ47EcbYQ2SNuyT-nYvVtRfqq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 00:18:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40019
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181564
x-xss-protection: 0
last-modified: Sun, 06 Aug 2023 12:02:10 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Aug 2024 00:18:41 GMT

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@3.4.0/dist/
Redirect Chain

https://unpkg.com/web-vitals/dist/web-vitals.iife.js
https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js

7 KB
3 KB

48ms
48ms

Script
application/javascript

2606:4700::6810:7baf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@3.4.0/dist/web-vitals.iife.js

Protocol

Server

2606:4700::6810:7baf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a85cb4f69ef025b2b86a217f8e999a8f30f43181f15017115e807dd5b021766

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2998833
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01H50GSNCF9XS0KF9AQ76GBM9D-fra
server: cloudflare
etag: W/"1b98-Vi0si64rTaloQm7ZXLxPFpdaTq8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7f68d6a85fd82bb8-FRA

Redirect headers

date: Mon, 14 Aug 2023 11:25:40 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01H7SW7FMKN8FH45Q0D1S28RY5-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 501
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /web-vitals@3.4.0/dist/web-vitals.iife.js
cache-control: public, s-maxage=600, max-age=60
cf-ray: 7f68d6a7ef442bb8-FRA

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 148ms
40ms Script
application/x-javascript 2a02:26f0:480:f::213:7edd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jul 2023 09:07:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=86395
accept-ranges: bytes
content-length: 4862

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 169 KB
63 KB 55ms
55ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12346775

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b85a83f83538475178f718d673e84bc3410d76a47b4992291aff5f4889458e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63964
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Aug 2023 11:25:40 GMT

GET
H2 200 tune.js Show response
js.go2sdk.com/v2/ 18 KB
18 KB 143ms
46ms Script
application/javascript 65.9.95.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.go2sdk.com/v2/tune.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-88.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 14 Aug 2023 03:39:39 GMT
via: 1.1 6ec6c63eb2f7ec00507af95b1621674c.cloudfront.net (CloudFront)
last-modified: Wed, 06 Jan 2021 18:55:14 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 27962
x-amz-server-side-encryption: AES256
etag: "074c9e70b17ef9db8aced963fef4e2d9"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 17921
x-amz-cf-id: 4YET3kQ1-GuW516bAMerdxcHXZqC8UVqVEI3o65cw2yzWsnvWHLTww==

GET
H2

200

activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Frep... Show response
12346775.fls.doubleclick.net/ Frame BEA9
Redirect Chain

https://12346775.fls.doubleclick.net/activityi;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2F...
https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.k...

1013 B
627 B

145ms
144ms

Document
text/html

172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12346775

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f6.1e100.net

Software

cafe /

Resource Hash

71278e4a1cadeb9844deeedadeab7e000e98b0d345cb280e1ceb56280d72937f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ics-cert.kaspersky.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 451
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:40 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:40 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/39138/domain/ics-cert.kaspersky.com/ 36 B
374 B 141ms
41ms XHR
application/json 2600:9000:2127:ce00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/39138/domain/ics-cert.kaspersky.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ce00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://ics-cert.kaspersky.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:05:31 GMT
content-encoding: gzip
via: 1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1208
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: Q_LyO1_0qeitN3uKq19i6Sr68Lb1MFY7rAmYRB4HReAI1osv08DtyA==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-indus...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-indus...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1692012340535%26url%3Dhttps%253A%252F%252Fics-cert.kaspersky.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-indus...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-indu...

0
265 B

315ms
215ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzxwW_E3NjcQAAAYnzy2iEgbZorT9EWE5IOUnuVQXp7PRvd1kuhW-LTRhUOPSYlvbN1i4
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 11:25:40 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9419A1E139AB445787F96DC3A4B66326 Ref B: FRAEDGE1215 Ref C: 2023-08-14T11:25:41Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYC4FKU+em88h5cBIkaqA==

Redirect headers

date: Mon, 14 Aug 2023 11:25:40 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 93B0011BD21F498899F178D42699A375 Ref B: FRAEDGE1115 Ref C: 2023-08-14T11:25:41Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1692012340535&url=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzxwW_E3NjcQAAAYnzy2iEgbZorT9EWE5IOUnuVQXp7PRvd1kuhW-LTRhUOPSYlvbN1i4
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYC4FKQLIFRoF1X2UwuTg==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 48ms
47ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-NSVBRC7S52&gtm=45je3890&_p=695840367&_gaz=1&cid=1040194566.1692012339&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1692012340&sct=1&seg=0&dl=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F&dt=Common%20TTPs%20of%20attacks%20against%20industrial%20organizations.%20Implants%20for%20gathering%20data%20%7C%20Kaspersky%20ICS%20CERT&en=FCP&_fv=1&_ss=1&ep.metricId=v3-1692012340568-4936161762771&ep.debugTarget=(not%20set)&ep.rating=good&epn.valueRounded=1042&ep.effectiveConnectionType=4g
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-NSVBRC7S52&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
54 B 48ms
47ms Ping
text/plain 2a00:1450:400c:c03::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-NSVBRC7S52&cid=1040194566.1692012339&gtm=45je3890&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-NSVBRC7S52&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://ics-cert.kaspersky.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 80ms
80ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-NSVBRC7S52&cid=1040194566.1692012339&gtm=45je3890&aip=1&z=2093872735

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ics-cert.kaspersky.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F202... Show response
adservice.google.com/ddm/fls/i/ Frame AF5F 1012 B
826 B 344ms
146ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Requested by

Host: 12346775.fls.doubleclick.net
URL: https://12346775.fls.doubleclick.net/activityi;dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fb1e8a83433da2bb72235234bef0adef46f8ada323c332512da0860b44dbc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://12346775.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 451
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:41 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F202... Show response
12346775.fls.doubleclick.net/ddm/fls/r/ Frame F8CA
Redirect Chain

https://adservice.google.de/ddm/fls/i/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky....
https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.k...

6 KB
681 B

243ms
243ms

Document
text/html

172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f6.1e100.net

Software

cafe /

Resource Hash

e79f07efdba7e03789d41c9f87c22bef1ac19de8b2f737735621bc6b10fde704

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 656
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:41 GMT
expires: Mon, 14 Aug 2023 11:25:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 14 Aug 2023 11:25:41 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005
adservice.google.com/ddm/fls/z/ Frame F8CA
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=13364882;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005?
https://ad.doubleclick.net/ddm/activity/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;o...
https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;or...

42 B
118 B

146ms
145ms

Image
image/gif

2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005

Requested by

Host: 12346775.fls.doubleclick.net
URL: https://12346775.fls.doubleclick.net/ddm/fls/r/dc_pre=CMjFm5SF3IADFRGgnwoddT8P5w;src=12346775;type=globalc;cat=globa0;ord=8051772057346;auiddc=167262012.1692012340;u1=B2C;u2=no_locale;u4=ics-cert.kaspersky.com;u5=%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F;u6=;u7=undefined-1040194566.1692012339;u9=_publications_reports_2023_07_31_common-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data_;gtm=45fe3890;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fics-cert.kaspersky.com%2Fpublications%2Freports%2F2023%2F07%2F31%2Fcommon-ttps-of-attacks-against-industrial-organizations-implants-for-gathering-data%2F

Protocol

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12346775.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Aug 2023 11:25:42 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=13364882;dc_pre=CI7G65SF3IADFT2VywEddiEBOA;type=invmedia;cat=kaspe00v;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=4708924061352.005
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

85 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.onesignal.com/	1970-01-20 14:00:14	Name: __cf_bm Value: asTHEp4mfFuQX_jtNkuVValHL_AfIGUc_ruCGGQ2SQk-1692012339-0-AcQcwUtATjKxiMcEtck9YNA+tZVNmWLJgcumW7j/PZOq6rqp1qe++ZoO7NpdWd9TISG841GoyzoL8HAAXMmjVpY=
.go.kaspersky.com/	1970-01-20 14:00:14	Name: __cf_bm Value: .g3z4GF7Q7hI2sdjyvtKOwE9FMUdJs4UJpd5A0ODuCc-1692012339-0-AQDhx40g0o+cWybwo0dm7zUo8mPIExjAYSzm/UOqsQ3EBcqduHl+ofFn3eycgVyev56QZbV5RlR4UYoUIgtPbAE=
.kaspersky.com/	1970-01-20 14:01:38	Name: _gid Value: GA1.2.549523828.1692012339
.kaspersky.com/	1970-01-20 14:00:12	Name: _gat Value: 1
.kaspersky.com/	1970-01-20 23:36:12	Name: _ga_93LQN8J8DF Value: GS1.2.1692012339.1.0.1692012339.60.0.0
ics-cert.kaspersky.com/	1970-01-20 23:36:12	Name: CookieConsent Value: {stamp:1474951395=='\|Cnecessary:true\|Cpreferences:true\|Cstatistics:true\|Cmarketing:true\|Cver:1\|Cutc:1459526845\|Cregion:'not_gdpr'}
.kaspersky.com/	1970-01-20 16:09:48	Name: _gcl_au Value: 1.1.167262012.1692012340
.kaspersky.com/	1970-01-20 23:36:12	Name: _ga Value: GA1.1.1040194566.1692012339
.kaspersky.com/	1970-01-20 23:36:12	Name: _ga_NSVBRC7S52 Value: GS1.1.1692012340.1.0.1692012340.60.0.0
ics-cert.kaspersky.com/	1970-01-20 14:01:38	Name: ln_or Value: eyIzOTEzOCI6ImQifQ%3D%3D
.linkedin.com/	1970-01-20 16:09:48	Name: li_sugr Value: 7e545a6c-cf1b-4afe-ba9e-3bbf1320ab36
.linkedin.com/	1970-01-20 22:45:48	Name: bcookie Value: "v=2&b425c23e-315b-49d5-81de-8b07d17cb2be"
.linkedin.com/	1970-01-20 14:01:38	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2612:u=1:x=1:i=1692012340:t=1692098740:v=2:sig=AQHdDJeslqKNYsbJTnaJvWX7FOkkbMYa"
.linkedin.com/	1970-01-20 14:43:24	Name: UserMatchHistory Value: AQK2JJ0XW7A4wgAAAYnzy2bNrHOv7ovz0D4QhJ8RApNx38RWirlDf20ubcP3S0OOC1TcJSRvgu_W2w
.linkedin.com/	1970-01-20 14:43:24	Name: AnalyticsSyncHistory Value: AQKcd4ulqLRozgAAAYnzy2bNNKIk5mXpUwvBrT3WcXPj1egGZZTRR_l2dHaJmuChcd-6TYBEF3dthX5FBv-cug
.www.linkedin.com/	1970-01-20 22:45:48	Name: bscookie Value: "v=1&202308141125419a3e86c0-f3ea-4d9e-809d-1bc0753d8ccdAQFK2l5Y0xRMZ5OcMjogdy1ZwpvwX43J"
.linkedin.com/	1970-01-20 18:19:24	Name: li_gc Value: MTswOzE2OTIwMTIzNDE7MjswMjHj6mM1EScZhYelRxnq5TaOcR8N524VYHl6ZgCgZwbjLA==
.doubleclick.net/	1970-01-20 23:21:48	Name: IDE Value: AHWqTUmoKlm9bPGWbc2_caCgUh1m9vUyUBdym_UPN6oshwu4tL8pTL2iclt0r81qY80

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12346775.fls.doubleclick.net
ad.doubleclick.net
adservice.google.com
adservice.google.de
cdn.linkedin.oribi.io
cdn.onesignal.com
fonts.gstatic.com
go.kaspersky.com
ics-cert.kaspersky.com
js.go2sdk.com
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
snap.licdn.com
stats.g.doubleclick.net
unpkg.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
104.17.73.206
13.107.42.14
142.250.185.102
172.217.16.198
185.105.225.103
2001:4860:4802:32::36
2600:9000:2127:ce00:2:53b2:240:93a1
2606:4700::6810:7baf
2606:4700::6812:d63b
2606:4700::6812:d73b
2620:1ec:21::14
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:810::200e
2a00:1450:4001:827::2003
2a00:1450:4001:829::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c03::9b
2a02:26f0:480:f::213:7edd
65.9.95.88
0778cd2f1eba0c56ac2c8995079e044d7c80c67345a51799a2e86f70d6ff5f7e
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0f24ca5085d2d3181b6d4b20158b5282e9f0cf024afce687f8b9611833a17405
1294b4148c3fb902d191e4389452c52723ed253797575adcff0c193bb84f0576
13c01fc2e94ee7c569128355c1e85f6a8c85b6f34a26270215d4b1a3fe3f72ef
1745ea436aaa982c56ab869677fd4846dcd07ea2261fb573572b0af35bb13555
177fa440deacfe8aa6b3d01e431308c1cab3c165d2f9175ce4a3e63952dd6cb3
1870b7c456eb7af4346917168392449543a7717617c53b4c3ae03be1c5803d3c
190615a6ddc58e11e24bce9d742205deac48e47037dd32bab36574536af1e7c2
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1d005e54c557c7b45e4dbbe2abb05bf33bb52631faed17189da60940b07c25ae
1d3745f80b6110a92a9c4eb260a1f34c93b118e2898f0af2bc83d1894c67f63a
1fb1e8a83433da2bb72235234bef0adef46f8ada323c332512da0860b44dbc11
1fbf65ee83992c5928497d41fbb6da61f884761dda468d2dbaa3c851c2a0b65a
24d0839fe019a3a2bf30ad9b50ed65935a2718c921e32147db3439a58bd8210a
2d223e51ec208d5f2b3c41dc05814044632a911344fd0031d5986c3d5bae35df
2db9f73aadc19fc7a482d18f2ad3626268a76237e4d64f07d46214ca3fed20d6
30960da3876f4fe08239419423e5f31d9715e50fac4c892f6d6087c2a817d752
31a1988204c7cd76f06d2dbd82b0ee536ce8f004f1e7afd8dfb411229bbb43c3
31e49ff119a0ddbe6a2c59628e7a7193a97e20992247dd7ffd818f0ab0a6a205
3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
515bc9f8975260083cab2128b2fd713331077149edfb309b08e8a3a9a4bba885
55fb0a022d2809bd202995a210109bdd7ff494af4fd47336902b2fbd952c808a
5c15402dcdd0b03490883b62681c0d676af10894c7ce55218650d0f3827c6f0f
5c522f9116ea6ea47e03ca9f70125e37edc03ca979cee71d7e9a8c844d4de537
5c713c5088e6e5670a082c76b5945af0bdf14874cabc5f3cbf2f967c2ace0ed9
5d08cf4192fbf7d68490f54b84f4d4d784126d0c7e3a72a95f9014eb07cbc92f
5f07d43571a20235b2506061c9729d91179d32b8b3c75123aa8fcd45e60d7541
63355ec0cc69d2bbc2fd4aedeec5d2eae03e8453192bff018c65da5493d6853a
671acdc94f3d05d75cf2c40469a5e5bfa1d8e09cd3c8b84aee083683a33f9837
67c26a5fecf3cf8d59f0525c9026dddf05d60ff355b28380d0edaa39934ec850
6a85cb4f69ef025b2b86a217f8e999a8f30f43181f15017115e807dd5b021766
70ba6d4d54217bc2d539a1bbee55ce4aac3e73ec717fc802784cbe767442f35e
71278e4a1cadeb9844deeedadeab7e000e98b0d345cb280e1ceb56280d72937f
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b85a83f83538475178f718d673e84bc3410d76a47b4992291aff5f4889458e6
7fc0056c4e8fb3c755fa7ae276931566ae8b635948b6f663ae6812b9fafc8742
802201fb0c8df6708dfc7f2425f573e040cd4a4ce277a5e834972c5a70bc49bb
8121a8f7c991e1014fd303a3f7639bec580415e4264f6cd899c4ef065ee4dc86
89bbd336534007854ca84e6e1659c1304ea19696ab8f9b04af5a2f67707f6cd0
8c1557795104f33886b66873c635a7b8ef9cb4405390a0f0d45947ea1154adc4
8d5cd94631173b6f37f652afe93483949846d80d76afe1c5fa2d9a561182c066
9011d877f13b080cfffe09ecf451453de5b60c1af56b35f488561d309edb32b4
91612bae01a48954d84ad43d0753b720742d72730d13582f2d315fd21dadb561
91ed372e022b2edb0be495f94a0016b1ddc68ed868761c5c6a4a9d1335c51247
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a
97160b6dd11e6c712dac3618caa0b31927e95e0dedee9b9b205fbd2245ca0349
9bdcfdbc18b3ddf6261fa6114eee711aefa81f99030becd4d9a14d841a46bbee
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a47d6b5e7293f77a4aaea5a7df20d3830b10acafcce2c54c14befbe3fa5f69ab
a81fd0cb9f98399373bd142e503674322f3ece668d07731663da3fa925451030
a9c87b1ce80a8696f4790411959bb5cf0ccf1bc0a9c8cf2477c88a44e1104f4b
aa60c8b27a9a97424a86c8ac244c0d6b6986e0062ecde772de2a07aa446959d7
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ada6841876bb494610299e56020e604517bdfcb1ecd1a3dff7a06f8b45daee59
b29d761d258ea9026f97b4470609b066558fe004a8e42199a5e40b1116d79b98
b2adb4f008e0cfee4d09dae8a1e4f5c19d2e492ca646326bc026cbcd9874a847
b2d31599822dae1353d655633c6dbd9454ef2138d172798f4a91119eedd6d89d
b2fe500cd00a2a9779cb5e31c7b56dd83d6c8a280ed5a92aaf369fcb091876a0
b657648fea8dfd40797f82706fd82b2771a7c18aedac16ceaa3a64851f38b9b8
b6e9507fb570c499c7f80306e10f49aedc4b83ace08371c4024e1ebd04aa7b8b
c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1
c4c16e7aaba6f1771a33267ffa6a2edb3147ee8654e119794419219fed6c3061
c9e76321a30fe79540c5a5fe74410d3ca813e12e13065b2eb79ce4e969443d11
cb23d15260f981e96001c4ed717434452f702481486e3b181b11334e857044b7
cca8ce472cbf8c44acf7ac24067c2d6075acd1e0cd4c9003de6055289ac5c68a
d0b124b8f696eba5c0d222ec4d34eea1d44e372001121a61f5048f34cda8840e
d2c1b5b69adadca970544ff9ed4c2757ed64d8fcb4f0dfc41d7fb9ae0f79a83f
da924ffa322b79af0af2e0c4ac8ee6beb62e16c0313d723dda9f8d27c7bbdb96
da9dad45994fa30a773ffd383f0daba950926e1c95fc807b644554825ac34bf7
db55565121291c4dd036ebdfa67079dd7e6e0e3722d648da4b0693d9b2d13427
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6c4ea7a876a3217a3ed3b77f102bcf88b06334e573b145af0c6018c78ce308a
e7147eed88d20a832f91a585ca57444da8dd17a038f86b0c83b7792d0ca0f256
e79f07efdba7e03789d41c9f87c22bef1ac19de8b2f737735621bc6b10fde704
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f6e6f99d4bad861a2dd396bb9357f7c6b47bbbaad1f37e6d06ae7532bc4885c1
f82d00e4896a9aee107123f1ae51a9699c49d38563b118cabbe1bcda49795099
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fa9df2917ec7c5bbb641eadbcf39890a04fcae497df7fd6b566db6f88e1b8f11
fc9310308aaf2b1b2b0dd07ac2458a8c27075f269107bae5c8d1523a1b433406
fe9d09bad67180679d03b4770178e713030ed0f67118d9efa98f4f15165de2ee

ics-cert.kaspersky.com Open in urlscan Pro 185.105.225.103 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

100 Requests

97 %HTTPS

73 %IPv6

13 Domains

23 Subdomains

20 IPs

5 Countries

2801 kBTransfer

7047 kBSize

18 Cookies

6 Outgoing links

Redirected requests

100 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

ics-cert.kaspersky.com Open in urlscan Pro
185.105.225.103 Public Scan

Screenshot
Live screenshot

Full Image

100
Requests

97 %
HTTPS

73 %
IPv6

13
Domains

23
Subdomains

20
IPs

5
Countries

2801 kB
Transfer

7047 kB
Size

18
Cookies

100 HTTP transactions
2 data transactions