www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
Effective URL:
https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
Submission: On October 04 via api (October 4th 2023, 1:47:36 pm UTC) from DE — Scanned from DE

Summary HTTP 80 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 13 IPs in 2 countries across 11 domains to perform 80 HTTP transactions. The main IP is 2606:4700:300b::a29f:f17d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 396652.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 2nd 2023. Valid for: a year.

This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 46	2606:4700:300... 2606:4700:300b::a29f:f17d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:e0:... 2606:4700:e0::ac40:6113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
3	2606:4700:10:... 2606:4700:10::6816:46c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
80	13

46 2606:4700:300b::a29f:f17d (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e0::ac40:6113 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn4.iconfinder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (Portland, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	mandiant.com 1 redirects www.mandiant.com — Cisco Umbrella Rank: 396652	3 MB
14	gstatic.com www.gstatic.com fonts.gstatic.com	1 MB
7	google.com www.google.com — Cisco Umbrella Rank: 11	71 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96 region1.google-analytics.com — Cisco Umbrella Rank: 1878	21 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 4661	28 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	201 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 460	465 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 969	16 KB
1	iconfinder.com cdn4.iconfinder.com — Cisco Umbrella Rank: 146586	4 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	2 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 410	5 KB
80	11

	Domain	Requested by
46	www.mandiant.com	1 redirects www.mandiant.com
12	www.gstatic.com	www.mandiant.com www.google.com www.gstatic.com
7	www.google.com	www.mandiant.com www.gstatic.com www.google.com
3	www.google-analytics.com	www.googletagmanager.com www.mandiant.com
3	static.addtoany.com	www.mandiant.com static.addtoany.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	www.mandiant.com www.googletagmanager.com
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	www.mandiant.com
1	region1.google-analytics.com	www.googletagmanager.com
1	cdn4.iconfinder.com	www.mandiant.com
1	fonts.googleapis.com	www.mandiant.com
1	cdnjs.cloudflare.com	www.mandiant.com
80	13

This site contains links to these domains. Also see Links.

Domain
policies.google.com
careers.google.com
login.mandiant.com
www.mandiant.fr
www.mandiant.de
www.mandiant.it
www.mandiant.jp
www.mandiant.kr
www.mandiant.es
o365blog.com
www.youtube.com
docs.microsoft.com
www.facebook.com
twitter.com
www.linkedin.com
selling.mandiant.com
cloud.google.com

Subject Issuer	Validity	Valid
mandiant.com Cloudflare Inc ECC CA-3	`2023-04-02` - `2024-04-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-04-13` - `2024-05-14`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-18` - `2023-12-19`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
Frame ID: 995BA9542BEC7DCBB2075EF43E35C4E3
Requests: 65 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.24.html
Frame ID: EA2AA7911AA8D546125789E3F312DF33
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=qtz8cptsdeer
Frame ID: 3A42C7FCBA51D97A8BDE6CD2213A2800
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=compact&cb=ul9iuxqaei4j
Frame ID: C623EEA4F3067B292E4ABD94D4151891
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: E2F3A945B9DEC287BA51BD3DBBD1222F
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: CA2FAE0EE22A6BEF70B64BE77C4EF43D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Detecting Microsoft 365 and Azure Active Directory Backdoors | Mandiant

Page URL History Show full URLs

https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors HTTP 301
https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors Page URL

Detected technologies

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

80
Requests

100 %
HTTPS

85 %
IPv6

11
Domains

13
Subdomains

13
IPs

2
Countries

3988 kB
Transfer

7319 kB
Size

1
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/technologies/cookies?hl=en
Title: Learn more

Search URL Search Domain Scan URL

URL: https://careers.google.com/
Title: Careers Life at Mandiant and open roles

Search URL Search Domain Scan URL

URL: https://login.mandiant.com/
Title: Sign in to Advantage

Search URL Search Domain Scan URL

URL: https://www.mandiant.fr/
Title: Français

Search URL Search Domain Scan URL

URL: https://www.mandiant.de/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://www.mandiant.it/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://www.mandiant.jp/
Title: 日本

Search URL Search Domain Scan URL

URL: https://www.mandiant.kr/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://www.mandiant.es/
Title: Español

Search URL Search Domain Scan URL

URL: https://o365blog.com/aadinternals/
Title: AADInternals

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=tJkjOnxcw6w
Title: Abusing Azure Active Directory: Who would you like to be today?

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#:~:text=Tier%200%20%2D%20Direct%20Control%20of,all%20the%20assets%20in%20it
Title: Tier 0 assets

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access
Title: Limit or restrict access

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/microsoft-365/enterprise/protect-your-global-administrator-accounts?view=o365-worldwide
Title: global administrator accounts

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication
Title: block legacy authentication

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#filtering-options
Title: synced from on-premises to the cloud

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles
Title: administrative roles

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization
Title: password hash sync

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad
Title: banned passwords lists

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity
Title: cloud and on-premises

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Mandiant

Search URL Search Domain Scan URL

URL: https://twitter.com/Mandiant

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCexu0DP7VKdDByusuTA53FQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mandiant/

Search URL Search Domain Scan URL

URL: https://selling.mandiant.com/mandiant/sso.aspx
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?hl=en-US
Title: Website Privacy Policy

Search URL Search Domain Scan URL

URL: https://cloud.google.com/product-terms#section-15
Title: Terms & Conditions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors HTTP 301
https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

80 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request detecting-microsoft-365-azure-active-directory-backdoors Show response
www.mandiant.com/resources/blog/
Redirect Chain

https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

136 KB
35 KB

3268ms
3268ms

Document
text/html

2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1036043a42d52fe6219153ab1488eb9df7f4e569b8489abd8268fcfc364774f

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=2764800, stale-if-error=3600, stale-while-revalidate=3600
cf-cache-status: EXPIRED
cf-ray: 810de06d2c335ba4-FRA
content-encoding: gzip
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Wed, 04 Oct 2023 13:47:28 GMT
expect-ct: max-age=86400
expires: Sun, 19 Nov 1978 05:00:00 GMT
last-modified: Wed, 04 Oct 2023 13:47:25 GMT
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
surrogate-control: max-age=86400
vary: Cookie,Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: v-8d56f1ca-62bc-11ee-b641-ef0c4d604c79
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

Redirect headers

cache-control: public, max-age=900
cf-cache-status: MISS
cf-ray: 810de068ca665ba4-FRA
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Wed, 04 Oct 2023 13:47:25 GMT
expect-ct: max-age=86400
expires: Wed, 04 Oct 2023 14:02:25 GMT
location: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-redirect-id: 3076
x-request-id: v-8cebb216-62bc-11ee-a25f-8ba6b2e1ab93
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

GET
H2 200 google_tag.script.js Show response
www.mandiant.com/sites/default/files/google_tag/google_tag_manager/ 348 B
419 B 421ms
419ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/google_tag/google_tag_manager/google_tag.script.js?s20ayp

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b7eb2b28fbf8ad29058540ee28e8b49701e0e47351ff25d3b688fcef9b2a88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 68
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 280
x-request-id: v-8e832552-62ba-11ee-ac2e-b37889c8f844
last-modified: Wed, 04 Oct 2023 13:32:58 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0819cc55ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 css_99A_wxbs0PBomLoEkJxyfTEWUMJPU78MRQg6gq6Dyx0.css
www.mandiant.com/sites/default/files/css/ 20 KB
5 KB 397ms
396ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_99A_wxbs0PBomLoEkJxyfTEWUMJPU78MRQg6gq6Dyx0.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7d03fc316ecd0f06898ba04909c727d311650c24f53bf0c45083a82ae83cb1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 341
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 4774
x-request-id: v-fdaa37fc-62a8-11ee-88c6-bf3457146184
last-modified: Wed, 06 Sep 2023 10:47:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0819cc35ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
www.mandiant.com/sites/default/files/css/ 662 KB
78 KB 47ms
45ms Stylesheet
text/css 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c57a249aa494671298ccf0f4e34804f904d1844f52b8bfec1a60b47906ec52fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1231
date: Wed, 04 Oct 2023 13:47:28 GMT
content-encoding: gzip
via: varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 64
x-cache: HIT
x-ah-environment: prod
content-length: 79670
x-request-id: v-f453e158-62a8-11ee-9de5-4bdbf3ca683b
last-modified: Wed, 04 Oct 2023 11:23:58 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0819cc45ba4-FRA
expires: Wed, 18 Oct 2023 13:47:28 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 23 KB
5 KB 41ms
18ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5003288
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4364
last-modified: Thu, 22 Jun 2023 11:02:18 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942a3a-110c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lziQivqNpg%2BSTvGgDH9LdlRB9EzTfdpWpOryuZ9Aj4N5FQ0udVUcRKRGG%2FAw%2B8IzaxrBs7jrvFmwaSSbFwvQg4bDAJhuvpqOwKny13ItoslM8gkHnosKh9SUkTuk49os5Hp4kOgzlkyn0y4OoseV3xHU"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 810de081ba0492c6-FRA
expires: Mon, 23 Sep 2024 13:47:28 GMT

GET
H2 200 css2
fonts.googleapis.com/ 10 KB
2 KB 44ms
19ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

640f2bf8138db0c5d698fb37b044d7788afdf119737a76ae2ccca2710f6c2244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 04 Oct 2023 13:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 04 Oct 2023 13:47:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 04 Oct 2023 13:47:28 GMT

GET
H2 200 cookienotificationbar.min.css
www.gstatic.com/glue/cookienotificationbar/ 8 KB
2 KB 41ms
17ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

369564d916b5510b303fd6a5fa4d1a6c722e92da8b0657ce42f59c6e7d50f4b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1628
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 16:08:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Wed, 04 Oct 2023 13:47:28 GMT

GET
H2 200 icon-close-512.png
cdn4.iconfinder.com/data/icons/ionicons/512/ 4 KB
4 KB 71ms
20ms Image
image/webp 2606:4700:e0::ac40:6113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn4.iconfinder.com/data/icons/ionicons/512/icon-close-512.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e0::ac40:6113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:29 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 1528439
cf-polished: origFmt=png, origSize=8351
content-disposition: inline; filename="icon-close-512.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3858
x-request-id: 7165b323-d9d3-489b-8116-01f3f5916213
cf-bgj: imgq:100,h2pri
last-modified: Fri, 15 Sep 2023 01:28:12 GMT
server: cloudflare
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=59b4PMIannT6EKA3hZB4b852FiOTDv7sIwhisE6U9SPLTAkqMK%2FOKakY7Qd01oX4jRxHDbnQsNcyMLQ%2FZoOOhlnHHIAwNwXlTfaODEmBo4%2FpXyLlhhkQPeKogaN5cGDdAzy9c9Xr9zoD3uguZUGcoj1p"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 810de0846cd09153-FRA
expires: Thu, 03 Oct 2024 13:47:29 GMT

GET
H2 200 defenders-advantage-guide-to-activate.png
www.mandiant.com/sites/default/files/2023-06/ 130 KB
130 KB 406ms
403ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-06/defenders-advantage-guide-to-activate.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

834cda0be10787417a47240202b776751235b6d14521976d11fbf5734333c3f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 485
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 132685
x-request-id: v-fc6680da-62a8-11ee-8ba1-4b1373d7b5a3
last-modified: Fri, 30 Jun 2023 10:32:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0841df05ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 esg-logo.png
www.mandiant.com/sites/default/files/inline-images/ 44 KB
44 KB 421ms
418ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/inline-images/esg-logo.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

921fbb814b7230690438275f49488ea721567be50a54efdd194e52bc5058d803

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 468
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 45049
x-request-id: v-fc685220-62a8-11ee-9f8e-b73eb8170085
last-modified: Fri, 02 Jun 2023 07:53:29 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0842df15ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 report.svg
www.mandiant.com/sites/default/files/2022-11/ 1 KB
717 B 407ms
405ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2022-11/report.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 465
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fe5fb8a2-62a8-11ee-95be-53352957f007
last-modified: Thu, 17 Nov 2022 10:42:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0842df25ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 close-icon.svg
www.mandiant.com/themes/custom/mandiant_theme/images/ 215 B
321 B 412ms
410ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/images/close-icon.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa8523773ec663ec32c3612167a9b2b5b1aeb047314d95dd9923b1ad9e0c489a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 319
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fea5ec46-62a8-11ee-aa9a-1b6948b23f46
last-modified: Fri, 04 Nov 2022 06:57:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0842df35ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 js_v743Hn_dAOm0Grpq6-lyIw9m1CMeIg6VR6nrrICP4lo.js Show response
www.mandiant.com/sites/default/files/js/ 103 KB
35 KB 402ms
402ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_v743Hn_dAOm0Grpq6-lyIw9m1CMeIg6VR6nrrICP4lo.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfbe371e7fdd00e9b41aba6aebe972230f66d4231e220e9547a9ebac808fe25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 892
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 35455
x-request-id: v-f9a1e81c-62a8-11ee-ab28-2bfce7331ff5
last-modified: Wed, 06 Sep 2023 10:47:44 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0841de95ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 41ms
17ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d4250f3f6326369abc9feca5096bc687ee46000809e1b5bbb042cd4285e1dc09

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 04 Oct 2023 13:47:29 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 40ms
20ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51e6d23e4a97f15652c1709f999062fcced9990b5090dde0d22b869247ea0869

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:29 GMT
via: e7s
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 11842
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 24 Sep 2023 10:29:33 GMT
server: cloudflare
etag: W/"c09-60618514a9dca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=172800
cf-ray: 810de0843b832c29-FRA

GET
H2 200 js_ut22-Xd5RoHxYB60ZS4rmHMrmW74oB081gQNGX4ftYY.js Show response
www.mandiant.com/sites/default/files/js/ 459 KB
132 KB 56ms
52ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_ut22-Xd5RoHxYB60ZS4rmHMrmW74oB081gQNGX4ftYY.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

baddb6f977794681f1601eb4652e2b98732b996ef8a01d3cd6040d197e1fb586

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1253
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 226
x-cache: HIT
x-ah-environment: prod
content-length: 134612
x-request-id: v-f477eb70-62a8-11ee-bab4-1fe27b876072
last-modified: Wed, 04 Oct 2023 08:06:53 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0841dec5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 accordion.frontend.js Show response
www.mandiant.com/modules/contrib/ckeditor_accordion/js/ 10 KB
3 KB 401ms
398ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/modules/contrib/ckeditor_accordion/js/accordion.frontend.js?s20ayp

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d5e5ce7eff2e417f3a3de1b61fb564712a14571393164dc4146dd94c99b95ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 389
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
age: 860
x-cache: HIT
x-ah-environment: prod
content-length: 2642
x-request-id: v-8e964f42-62ba-11ee-a0fd-f365f52c099b
last-modified: Fri, 17 Feb 2023 05:37:15 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 810de0841dee5ba4-FRA
expires: Wed, 18 Oct 2023 13:33:09 GMT

GET
H2 200 js_EndR9TYA4dXiqr2GB478bpkzEEeSQB0Tuo9UvyeOm-U.js Show response
www.mandiant.com/sites/default/files/js/ 29 KB
8 KB 418ms
415ms Script
text/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_EndR9TYA4dXiqr2GB478bpkzEEeSQB0Tuo9UvyeOm-U.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

127751f53600e1d5e2aabd86078efc6e9933104792401d13ba8f54bf278e9be5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1200
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 7824
x-request-id: v-f4749ea2-62a8-11ee-9386-0f90377665e6
last-modified: Wed, 06 Sep 2023 10:47:45 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0841def5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 cookienotificationbar.min.js Show response
www.gstatic.com/glue/cookienotificationbar/ 17 KB
6 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ad73868410cff1f60dba2e6425cec69e621be852b1e89e28339a5c857ba6ea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6397
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 16:08:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Wed, 04 Oct 2023 13:47:29 GMT

GET
H2 200 fontloader.built.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 7 KB
2 KB 431ms
429ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1221
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 2334
x-request-id: v-fc67e4e8-62a8-11ee-ac56-d311e24d163e
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0842df45ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 report.svg
www.mandiant.com/sites/default/files/2022-11/ 1 KB
665 B 425ms
424ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2022-11/report.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 465
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fe5fb8a2-62a8-11ee-95be-53352957f007
last-modified: Thu, 17 Nov 2022 10:42:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0842df65ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 menu-drop-down.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 207 B
344 B 45ms
44ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/menu-drop-down.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3c4f02f1f6a5e491336064c0d0bdcd6914d5794a431a359c1f684cec8ed77f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1160
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 226
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fc6cb5a4-62a8-11ee-bc66-8b5c80da61e6
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0844e085ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 see-what.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 740 B
522 B 39ms
38ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/see-what.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22d544d04a6282b544aa3fbc8e024e41f00902673fe34f774092c02d4e7d6712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1168
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 226
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f56d6668-62a8-11ee-a5ef-23ec372c17da
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0845e0d5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 incident-response.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 777 B
544 B 32ms
32ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/incident-response.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860f45e645e33a50a9a34186d5c0558df4198829fe98679a4a6e1e754fca1aeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1161
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 226
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f56d6668-62a8-11ee-a172-5325d095c1de
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0845e0e5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 incident.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 1023 B
605 B 379ms
376ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/incident.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d1049d86e454e70f1d3e650f3ec7dc009ebef2f7ec2e9f44b74cb290ed9e4d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1141
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fc6fec6a-62a8-11ee-a9f8-cb3f0bae14d2
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e185ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 contact-sales.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 613 B
495 B 51ms
48ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/contact-sales.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

887dea1b760d630afcbae650e3259dc18ef1a7fe3137ab715a56005a69f921b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1156
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 226
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f58b99ee-62a8-11ee-9937-6f4f4a3e4100
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e195ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 contact.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 716 B
537 B 474ms
471ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/contact.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ca72eec4efadc4587d29f2216ccd9cd54309463c74a5a3029b3dca9485f995a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1136
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fc6c553c-62a8-11ee-b6ef-531e08f7d4a2
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e1a5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 support.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 4 KB
2 KB 471ms
468ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/support.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c82aa23b61483cc87f28ec6c4492a28c46dcb38bf471fd4a6ca40984ee6fb59e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1185
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f59ec3fc-62a8-11ee-9aab-2fa438aded11
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e1b5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 sign-in.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 630 B
428 B 34ms
31ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/sign-in.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf204863b72594d7da599f0ad2cfb43573b91d2ef348983d8890f64ba9858d1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1166
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 56
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f5aeaa24-62a8-11ee-a76a-9b7340a3bdc3
last-modified: Wed, 26 Oct 2022 19:35:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e1c5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 menu-arrow-white.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 752 B
448 B 60ms
58ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/menu-arrow-white.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f41b6056bfd2eb59371fabdc40b3970f02458ee463aa92385fe214fb00aebae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1166
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 56
x-cache: HIT
x-ah-environment: prod
x-request-id: v-f5b54f78-62a8-11ee-8bfc-eb418186337a
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e1d5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 advantage-arrow.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 203 B
284 B 469ms
467ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/advantage-arrow.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f16edf69b3b38abc839a83da5041cb4b2ed08b54017faa471b4e2da1cc8393c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1143
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fc6c9dda-62a8-11ee-a79f-53c0aaf84086
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e1e5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 gray-circle.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/ 9 KB
9 KB 471ms
469ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/backgrounds/gray-circle.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 695
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 8943
x-request-id: v-f9ee55d0-62a8-11ee-83e8-3b2af8108cec
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0846e1f5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 cyber-defense-self-assessment-background-image.png
www.mandiant.com/sites/default/files/2023-05/ 440 KB
441 KB 472ms
471ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2023-05/cyber-defense-self-assessment-background-image.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

943fd20cc1415adb436d84b5c33b49c9873ae1241df51b2507284bcfc19203db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 465
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 450481
x-request-id: v-fc71ee16-62a8-11ee-94a9-73420f58b05e
last-modified: Mon, 29 May 2023 11:19:40 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0846e215ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 magenta-to-red-gradient.jpg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 61 KB
61 KB 607ms
606ms Image
image/jpeg 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/magenta-to-red-gradient.jpg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 947
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 62175
x-request-id: v-fc6ee900-62a8-11ee-9176-bb941c275638
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0846e225ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 white-cta-arrow.svg
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 750 B
482 B 470ms
469ms Image
image/svg+xml 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/white-cta-arrow.svg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1132
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
x-cache: HIT
x-ah-environment: prod
x-request-id: v-fc6ed46a-62a8-11ee-b104-0344a17faa68
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1209600
cf-ray: 810de0846e235ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 134 KB
134 KB 606ms
605ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1192
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 136986
x-request-id: v-f7191d68-62a8-11ee-a084-d740d5f9aa06
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0846e245ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 148 KB
148 KB 37ms
36ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1470
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 226
x-cache: HIT
x-ah-environment: prod
content-length: 151244
x-request-id: v-f5a16c1a-62a8-11ee-929d-23d080f2b6dd
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0846e275ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
56 KB 656ms
655ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1419
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 57572
x-request-id: v-f7d21ad4-62a8-11ee-b510-1fc033958f25
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0847e285ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 581ms
580ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1486
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 56020
x-request-id: v-f71bdac6-62a8-11ee-8966-8b50be2f311d
last-modified: Wed, 26 Oct 2022 19:35:15 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0847e2a5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 GoogleSansDisplay-Medium.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
154 KB 565ms
562ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSansDisplay-Medium.ttf

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f76ce833f021609c95e4f7aa037a19cfb33bcfe5dd6e25ead5b6fb61add6050

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 649
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 157860
x-request-id: v-fc8cdb40-62a8-11ee-9c98-2b1aef1086f5
last-modified: Wed, 22 Feb 2023 07:03:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0847e2e5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 GoogleSans-Regular.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
155 KB 574ms
571ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSans-Regular.ttf

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db8889219047b9dab1299759fc44d56af45ee4e683961df1d54d1f0ef783690a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 639
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 157868
x-request-id: v-fc895ec0-62a8-11ee-b40b-5fa57dd1d59f
last-modified: Wed, 22 Feb 2023 07:04:30 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0847e2f5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 GoogleSans-Medium.ttf
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/ 154 KB
155 KB 51ms
48ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/google-sans/GoogleSans-Medium.ttf

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ec4c07fa6575aecd81e6087d091d41a69e45a89b29ee147db3f09323e6f5638

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 701
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 226
x-cache: HIT
x-ah-environment: prod
content-length: 157980
x-request-id: v-fc8a4aa6-62a8-11ee-a18c-cbea1fad2e8b
last-modified: Wed, 22 Feb 2023 07:03:43 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0847e305ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 azure-1.png
www.mandiant.com/sites/default/files/inline-images/ 178 KB
178 KB 571ms
570ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/inline-images/azure-1.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75b6533d32f7f3f0940ab39d7f7f754604e2a21bfa667033c797c4775cc42259

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1
date: Wed, 04 Oct 2023 13:47:29 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 182278
x-request-id: v-47ba8d14-62af-11ee-8041-13f0e83c364e
last-modified: Fri, 29 Oct 2021 16:13:02 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0850e6a5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 azure365-2.png
www.mandiant.com/sites/default/files/inline-images/ 133 KB
134 KB 572ms
572ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/inline-images/azure365-2.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77fcdb56e3c633dffd102e538b867f9923e829a98c6873ce0770b0e6468a3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1
date: Wed, 04 Oct 2023 13:47:30 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 136428
x-request-id: v-4c246816-62af-11ee-a289-83ab4cabc5d8
last-modified: Fri, 29 Oct 2021 16:13:58 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0850e6b5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 azure365-3.png
www.mandiant.com/sites/default/files/inline-images/ 86 KB
86 KB 598ms
598ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/inline-images/azure365-3.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af0177fd48477283c00f506b65c15743f70ba158a9e9319f3be871594643c8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1
date: Wed, 04 Oct 2023 13:47:30 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 88212
x-request-id: v-4cff366c-62af-11ee-9485-e364e3724f13
last-modified: Fri, 29 Oct 2021 16:14:41 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0850e6c5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 azure365-4.png
www.mandiant.com/sites/default/files/inline-images/ 73 KB
73 KB 573ms
572ms Image
image/png 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/inline-images/azure365-4.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae4b398bdc7b66996930a58e370d33762e5ce6ec5dcec2abd3de2e8f4211334a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1
date: Wed, 04 Oct 2023 13:47:30 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 74795
x-request-id: v-519be80a-62af-11ee-83d0-e3fbb3a6a60f
last-modified: Fri, 29 Oct 2021 16:15:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0850e6d5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H2 200 974.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 11 KB
3 KB 477ms
476ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?ed9f0d

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_ut22-Xd5RoHxYB60ZS4rmHMrmW74oB081gQNGX4ftYY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1204
date: Wed, 04 Oct 2023 13:47:30 GMT
content-encoding: gzip
via: varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 3375
x-request-id: v-feb591f0-62a8-11ee-a5e5-7b35f4bbc980
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0875f665ba4-FRA
expires: Wed, 18 Oct 2023 13:47:30 GMT

GET
H2 200 404.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 406 B
374 B 135ms
135ms Script
application/javascript 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_ut22-Xd5RoHxYB60ZS4rmHMrmW74oB081gQNGX4ftYY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1158
date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: gzip
via: varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 59
x-cache: HIT
x-ah-environment: prod
content-length: 263
x-request-id: v-ff68854e-62a8-11ee-9a81-4fd7d1b5ef27
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0875f675ba4-FRA
expires: Wed, 18 Oct 2023 13:47:29 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ 466 KB
187 KB 59ms
6ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190978
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 11:03:05 GMT

GET
H2 200 sm.24.html Show response
static.addtoany.com/menu/ Frame EA2A 677 B
542 B 57ms
56ms Document
text/html 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.24.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a4192e762a449dfd6e63bee835e0941627223c9159e8219acdd01881a1ac175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1856648
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 810de0875f112c29-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 04 Oct 2023 13:47:29 GMT
etag: W/"2a5-5edb40e6d10d8"
last-modified: Fri, 18 Nov 2022 00:47:55 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: e2s
x-content-type-options: nosniff

GET
H3 200 core.f4498a6a.js Show response
static.addtoany.com/menu/modules/ 70 KB
25 KB 304ms
34ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.f4498a6a.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f3c20825909bb222fd8ec5db0a985fb397c20a97d8362858ccfffb576e13a77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:30 GMT
via: e7s
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 875669
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 24 Sep 2023 10:29:31 GMT
server: cloudflare
etag: W/"11650-606185138cb5e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 810de088e8152c6f-FRA

GET
H3 200 2a.json Show response
www.gstatic.com/glue/cookienotificationbar/config/ 517 B
239 B 17ms
16ms Fetch
application/json 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/config/2a.json?hl=en

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39935709bbe74f29c462d3e2d7f0fec9a9b1924a360b1d98df6dfb8bbfac2e2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:29 GMT
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 213
x-xss-protection: 0
last-modified: Tue, 13 Jun 2023 17:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Wed, 04 Oct 2023 13:47:29 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 397 KB
111 KB 277ms
59ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/google_tag/google_tag_manager/google_tag.script.js?s20ayp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d1a4863fdbb6baee1a48b8d1f0457bc66633442764f835d7ab39101e003961fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113616
x-xss-protection: 0
last-modified: Wed, 04 Oct 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 04 Oct 2023 13:47:30 GMT

GET
H2 200 PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 71 KB
71 KB 592ms
592ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1462
date: Wed, 04 Oct 2023 13:47:30 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 72380
x-request-id: v-f6fa9816-62a8-11ee-ade8-63f24a182dc4
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de0878f765ba4-FRA
expires: Wed, 18 Oct 2023 13:47:30 GMT

GET
H2 200 5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
fonts.gstatic.com/s/googlesanstext/v21/ 14 KB
15 KB 115ms
18ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v21/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 04:28:23 GMT
x-content-type-options: nosniff
age: 379147
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14796
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:47:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 04:28:23 GMT

GET
H2 200 4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2
fonts.gstatic.com/s/googlesans/v58/ 22 KB
22 KB 108ms
10ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrw2IJllpyk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Fri, 29 Sep 2023 19:24:51 GMT
x-content-type-options: nosniff
age: 411759
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22308
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Sep 2024 19:24:51 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 38ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 04 Oct 2023 11:49:43 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 7067
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 04 Oct 2023 13:49:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 271 KB
90 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d3d225a0743fbd6e744cc6b7f1333ff1f416596d823bee12a3b82ce8e2378fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92023
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 04 Oct 2023 13:47:30 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 3A42 59 KB
34 KB 38ms
32ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=qtz8cptsdeer

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c8931fba5480b4d740c4b3bcb7e3eac78fb4570aac40ab32c34033a5da1c1993

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UZutJyRtNJo5Jyr4Riz5pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-UZutJyRtNJo5Jyr4Riz5pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 13:47:30 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame C623 58 KB
33 KB 31ms
30ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=compact&cb=ul9iuxqaei4j

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

299719ddc794c9a04cca70d3b08e9a9c2a33f0a3dd291034bf9fa59c9c19707d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-F5UbfRwU8saJWcuiu1Fdww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-F5UbfRwU8saJWcuiu1Fdww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 13:47:30 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
57 KB 611ms
611ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1330
date: Wed, 04 Oct 2023 13:47:31 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 57764
x-request-id: v-f7ccc96c-62a8-11ee-ad37-67cd5d918a51
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de08be94f5ba4-FRA
expires: Wed, 18 Oct 2023 13:47:31 GMT

GET
H2 200 Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 572ms
571ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 1297
date: Wed, 04 Oct 2023 13:47:31 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 55968
x-request-id: v-f7ce251e-62a8-11ee-93b0-632b0339014d
last-modified: Wed, 26 Oct 2022 19:35:15 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de08be9515ba4-FRA
expires: Wed, 18 Oct 2023 13:47:31 GMT

GET
H2 200 Barlow-MediumItalic.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 59 KB
59 KB 569ms
567ms Font
text/plain 2606:4700:300b::a29f:f17d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-MediumItalic.woff2

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:300b::a29f:f17d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_xXokmqSUZxKYzPD040gE-QTRhE9SuL_sGmC0eQbsUvs.css
Origin: https://www.mandiant.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-cache-hits: 484
date: Wed, 04 Oct 2023 13:47:31 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-cache: HIT
x-ah-environment: prod
content-length: 60612
x-request-id: v-2171baf2-62a9-11ee-be51-7bf694e47664
last-modified: Wed, 26 Oct 2022 19:35:15 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 810de08c09615ba4-FRA
expires: Wed, 18 Oct 2023 13:47:31 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 10ms
10ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1853491924&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdetecting-microsoft-365-azure-active-directory-backdoors&ul=en-us&de=UTF-8&dt=Detecting%20Microsoft%20365%20and%20Azure%20Active%20Directory%20Backdoors%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGAAgAABAAAAAAAEKk~&cid=145669278.1696427251&tid=UA-203244293-1&_gid=209903332.1696427251&gtm=45He3a20n81T72STLD&cg1=threat%20research&cg2=resources&cd2=Pageview&cd3=1696427250302.mtz5qvsh&cd4=2023-10-04T15%3A47%3A30.302%2B02%3A00&cd5=&cd15=mike%20burns&cd16=sep%2030%2C%202020&cd24=unknown&gcs=G100&cd1=145669278.1696427251&z=967806282

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 04 Oct 2023 00:14:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 48793
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame C623 55 KB
24 KB 11ms
10ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=compact&cb=ul9iuxqaei4j

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 12:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5647
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 12:13:23 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame C623 466 KB
187 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9865
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190978
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 11:03:05 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 3A42 55 KB
24 KB 14ms
14ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 12:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5647
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 12:13:23 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 3A42 466 KB
187 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9865
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190978
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 11:03:05 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
255 B 56ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=45je3a20&_p=1853491924&gcs=G100&gtm_up=1&cid=145669278.1696427251&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1696427250&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdetecting-microsoft-365-azure-active-directory-backdoors&dt=Detecting%20Microsoft%20365%20and%20Azure%20Active%20Directory%20Backdoors%20%7C%20Mandiant&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 04 Oct 2023 13:47:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame C623 102 B
135 B 20ms
19ms Other
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=lLirU0na9roYU3wDDisGJEVT

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=compact&cb=ul9iuxqaei4j
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 04 Oct 2023 13:47:30 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 3A42 102 B
135 B 18ms
18ms Other
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=lLirU0na9roYU3wDDisGJEVT

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=qtz8cptsdeer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 04 Oct 2023 13:47:30 GMT

GET
H2 200 nr-rum-1.242.0.min.js Show response
js-agent.newrelic.com/ 44 KB
16 KB 85ms
6ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.242.0.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

467942d7490565f9eeffb703101620ee5a56c38f57312919d5a74cab073779eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-amz-version-id: ZbbGSpfDbusF6mSs7Sl2uV56L034ouIe
content-encoding: br
via: 1.1 varnish
date: Wed, 04 Oct 2023 13:47:31 GMT
strict-transport-security: max-age=300
x-amz-request-id: WZZTE5YMWC5D2K82
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15733
x-amz-id-2: jJzhd2T1nTmkBkfCoamJiYB2YGUXn1R2PBAC8IEHPTzqaJq8jQ0e2fAJTuivuWPWfErHP6HxpeE=
x-served-by: cache-fra-eddf8230035-FRA
last-modified: Tue, 26 Sep 2023 03:02:38 GMT
server: AmazonS3
x-timer: S1696427251.330340,VS0,VE0
etag: "7443b88e37d38843fd5e2ddf0fdc5d9e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 5878

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1853491924&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Fdetecting-microsoft-365-azure-active-directory-backdoors&ul=en-us&de=UTF-8&dt=Detecting%20Microsoft%20365%20and%20Azure%20Active%20Directory%20Backdoors%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Resource%20Type&ea=threat%20research&el=null&_u=aGgAgAABAAAAAAAEKk~&cid=145669278.1696427251&tid=UA-203244293-1&_gid=2146025248.1696427251&gtm=45He3a20n81T72STLD&cg1=threat%20research&cg2=resources&cd3=1696427251310.4k0fdsqg&cd4=2023-10-04T15%3A47%3A31.310%2B02%3A00&cd5=&cd15=mike%20burns&cd16=sep%2030%2C%202020&cd24=unknown&gcs=G100&cd1=145669278.1696427251&z=1360356715

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Oct 2023 21:22:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 59099
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame E2F3 7 KB
1 KB 41ms
40ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d1393226d36aff0904968562315242b98d4770583124c91095649bf3895ed843

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xTnJ2sYM6M-8Hf2pnEtVNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-xTnJ2sYM6M-8Hf2pnEtVNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 13:47:31 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame CA2F 7 KB
1 KB 27ms
26ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7b3e631540e32d4fff9803af7038ac257cc27e2f148f6ddd3ab3cf6490977f5b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lr47bxOphh9iSwsjuy6SYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-lr47bxOphh9iSwsjuy6SYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 13:47:31 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame E2F3 55 KB
24 KB 12ms
11ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 12:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5648
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 12:13:23 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame E2F3 466 KB
187 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9866
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190978
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 11:03:05 GMT

POST
H/1.1 200
OK NRJS-890ead692fb1e944fb6 Show response
bam.nr-data.net/1/ 40 B
465 B 365ms
253ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-890ead692fb1e944fb6?a=1404479750&v=1.242.0&to=YlRVYERZV0ZSWhINX1sedldCUVZbHH0UEUBUXWtaWVxcaXBWCBBCWl1bUURkd1pXXDANVUJyWFpCSlZZX1wUSQ5DWFJD&rst=6519&ck=0&s=724cfe07f502947a&ref=https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors&qt=1&ap=2768&be=3999&fe=2364&dc=956&at=ThNWFgxDREg%3D&perf=%7B%22timing%22:%7B%22of%22:1696427244888,%22n%22:0,%22r%22:0,%22re%22:731,%22f%22:731,%22dn%22:731,%22dne%22:731,%22c%22:731,%22s%22:731,%22ce%22:731,%22rq%22:732,%22rp%22:4000,%22rpe%22:4008,%22di%22:4949,%22ds%22:4949,%22de%22:4955,%22dc%22:6362,%22l%22:6362,%22le%22:6363%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=4581&fcp=4581
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.242.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d

Request headers

Referer: https://www.mandiant.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
content-type: text/plain

Response headers

Date: Wed, 04 Oct 2023 13:47:31 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.mandiant.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 810de0920b3a9159-FRA
Content-Length: 40

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame CA2F 55 KB
24 KB 30ms
26ms Stylesheet
text/css 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 12:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5648
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 12:13:23 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame CA2F 466 KB
187 KB 31ms
27ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9866
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190978
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 04:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 03 Oct 2024 11:03:05 GMT

Verdicts & Comments Add Verdict or Comment

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.mandiant.com/	1970-01-20 15:13:49	Name: __cf_bm Value: AFxy7VhzjozqPpvEYdu10PoSgdSsHYn2uDdjSCvhpAo-1696427245-0-AfVPp9mfHxjgko+RC8efbvH+v28DOHJ4m9iJEw00sd12jMyFbY7u4sTJUSt/ZqhVHUEl/SNKnDqbrQpZNO8oWYk=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
cdn4.iconfinder.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
js-agent.newrelic.com
region1.google-analytics.com
static.addtoany.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.mandiant.com
151.101.130.137
162.247.241.14
2001:4860:4802:34::36
2606:4700:10::6816:46c5
2606:4700:300b::a29f:f17d
2606:4700::6811:180e
2606:4700:e0::ac40:6113
2a00:1450:4001:802::200a
2a00:1450:4001:806::2008
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2003
2a00:1450:4001:827::200e
2a00:1450:4001:830::2004
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0d1049d86e454e70f1d3e650f3ec7dc009ebef2f7ec2e9f44b74cb290ed9e4d6
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
127751f53600e1d5e2aabd86078efc6e9933104792401d13ba8f54bf278e9be5
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1d5e5ce7eff2e417f3a3de1b61fb564712a14571393164dc4146dd94c99b95ba
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
22d544d04a6282b544aa3fbc8e024e41f00902673fe34f774092c02d4e7d6712
299719ddc794c9a04cca70d3b08e9a9c2a33f0a3dd291034bf9fa59c9c19707d
2f76ce833f021609c95e4f7aa037a19cfb33bcfe5dd6e25ead5b6fb61add6050
34e89fde702aa592d82afbb8d98034150cb3a2e6bd67a922af1edd106cf87fe8
369564d916b5510b303fd6a5fa4d1a6c722e92da8b0657ce42f59c6e7d50f4b1
39935709bbe74f29c462d3e2d7f0fec9a9b1924a360b1d98df6dfb8bbfac2e2e
467942d7490565f9eeffb703101620ee5a56c38f57312919d5a74cab073779eb
4ec4c07fa6575aecd81e6087d091d41a69e45a89b29ee147db3f09323e6f5638
51e6d23e4a97f15652c1709f999062fcced9990b5090dde0d22b869247ea0869
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5a4192e762a449dfd6e63bee835e0941627223c9159e8219acdd01881a1ac175
5ad73868410cff1f60dba2e6425cec69e621be852b1e89e28339a5c857ba6ea0
5b7ce7007d8d2b26888d2e3296348c5b603fe5fef938221fd1c9f217e9804af8
640f2bf8138db0c5d698fb37b044d7788afdf119737a76ae2ccca2710f6c2244
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
75b6533d32f7f3f0940ab39d7f7f754604e2a21bfa667033c797c4775cc42259
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
77fcdb56e3c633dffd102e538b867f9923e829a98c6873ce0770b0e6468a3091
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7b3e631540e32d4fff9803af7038ac257cc27e2f148f6ddd3ab3cf6490977f5b
7b7eb2b28fbf8ad29058540ee28e8b49701e0e47351ff25d3b688fcef9b2a88a
7f3c20825909bb222fd8ec5db0a985fb397c20a97d8362858ccfffb576e13a77
8300ba70904617a47a80e9098fe00b3f7aefd328519318c420289b0bbdfb5e2c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
834cda0be10787417a47240202b776751235b6d14521976d11fbf5734333c3f1
860f45e645e33a50a9a34186d5c0558df4198829fe98679a4a6e1e754fca1aeb
887dea1b760d630afcbae650e3259dc18ef1a7fe3137ab715a56005a69f921b0
8d3d225a0743fbd6e744cc6b7f1333ff1f416596d823bee12a3b82ce8e2378fb
921fbb814b7230690438275f49488ea721567be50a54efdd194e52bc5058d803
943fd20cc1415adb436d84b5c33b49c9873ae1241df51b2507284bcfc19203db
9ca72eec4efadc4587d29f2216ccd9cd54309463c74a5a3029b3dca9485f995a
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
9f41b6056bfd2eb59371fabdc40b3970f02458ee463aa92385fe214fb00aebae
ae4b398bdc7b66996930a58e370d33762e5ce6ec5dcec2abd3de2e8f4211334a
af0177fd48477283c00f506b65c15743f70ba158a9e9319f3be871594643c8ca
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
baddb6f977794681f1601eb4652e2b98732b996ef8a01d3cd6040d197e1fb586
bf204863b72594d7da599f0ad2cfb43573b91d2ef348983d8890f64ba9858d1e
bfbe371e7fdd00e9b41aba6aebe972230f66d4231e220e9547a9ebac808fe25a
c57a249aa494671298ccf0f4e34804f904d1844f52b8bfec1a60b47906ec52fb
c82aa23b61483cc87f28ec6c4492a28c46dcb38bf471fd4a6ca40984ee6fb59e
c8931fba5480b4d740c4b3bcb7e3eac78fb4570aac40ab32c34033a5da1c1993
ce56dc3783735b873af61135d410e3ccec9dfd565a5961fd707e85d1d6b654af
cfbbb6a8bb9482b6bddbba133d70d9ac28fea886ede20ecdaf3110d5c70dba6c
d1393226d36aff0904968562315242b98d4770583124c91095649bf3895ed843
d1a4863fdbb6baee1a48b8d1f0457bc66633442764f835d7ab39101e003961fa
d4250f3f6326369abc9feca5096bc687ee46000809e1b5bbb042cd4285e1dc09
d7f62ccd6d9784466fb9b92202b71a63182de790d0575e13641e027b39e0590e
db8889219047b9dab1299759fc44d56af45ee4e683961df1d54d1f0ef783690a
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e1036043a42d52fe6219153ab1488eb9df7f4e569b8489abd8268fcfc364774f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c4f02f1f6a5e491336064c0d0bdcd6914d5794a431a359c1f684cec8ed77f7
e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d
f16edf69b3b38abc839a83da5041cb4b2ed08b54017faa471b4e2da1cc8393c1
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
f7d03fc316ecd0f06898ba04909c727d311650c24f53bf0c45083a82ae83cb1d
fa8523773ec663ec32c3612167a9b2b5b1aeb047314d95dd9923b1ad9e0c489a
fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6
ff46ab88d5fe2880ee24e0a56c4f423096ea4eb7b80e0fc8032319e26b5a002b

www.mandiant.com Open in urlscan Pro 2606:4700:300b::a29f:f17d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

80 Requests

100 %HTTPS

85 %IPv6

11 Domains

13 Subdomains

13 IPs

2 Countries

3988 kBTransfer

7319 kBSize

1 Cookies

27 Outgoing links

Page URL History

Redirected requests

80 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.mandiant.com Open in urlscan Pro
2606:4700:300b::a29f:f17d Public Scan

Screenshot
Live screenshot

Full Image

80
Requests

100 %
HTTPS

85 %
IPv6

11
Domains

13
Subdomains

13
IPs

2
Countries

3988 kB
Transfer

7319 kB
Size

1
Cookies

80 HTTP transactions
0 data transactions