www.deepinstinct.com Open in urlscan Pro
2a05:d014:275:cb01::c8 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Submission: On April 10 via api (April 10th 2024, 2:14:00 am UTC) from TR — Scanned from DE

Summary HTTP 124 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 46 IPs in 4 countries across 36 domains to perform 124 HTTP transactions. The main IP is 2a05:d014:275:cb01::c8, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.deepinstinct.com.
TLS certificate: Issued by R3 on February 17th 2024. Valid for: 3 months.

This is the only time www.deepinstinct.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	2a05:d014:275... 2a05:d014:275:cb01::c8	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
5	2a02:26f0:350... 2a02:26f0:3500:16::215:1495	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
3	151.101.129.167 151.101.129.167	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
1	18.66.102.53 18.66.102.53	16509 (AMAZON-02) (AMAZON-02)
1	99.84.88.115 99.84.88.115	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:89d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	2606:4700:440... 2606:4700:4400::6812:24c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1005	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
2	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.173.154.87 18.173.154.87	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
10	216.58.206.72 216.58.206.72	15169 (GOOGLE) (GOOGLE)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	157.240.252.13 157.240.252.13	32934 (FACEBOOK) (FACEBOOK)
1	34.246.205.163 34.246.205.163	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:4dba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8b11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e7a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	18.173.187.83 18.173.187.83	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:f26c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:237... 2600:9000:237d:8600:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.110 142.250.185.110	15169 (GOOGLE) (GOOGLE)
1	169.63.31.200 169.63.31.200	36351 (SOFTLAYER) (SOFTLAYER)
1	35.171.141.234 35.171.141.234	14618 (AMAZON-AES) (AMAZON-AES)
3	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
124	46

43 2a05:d014:275:cb01::c8 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

www.deepinstinct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

images.contentstack.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.129.167 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.88.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-115.muc50.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:24c4 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1005 (United States)

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.154.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-87.muc50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 216.58.206.72 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.252.13 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.205.163 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-205-163.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4dba (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8b11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e7a3 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.187.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-83.muc50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:f26c (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:237d:8600:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.63.31.200 (United States)

ASN36351 (SOFTLAYER, US)
PTR: c8.1f.3fa9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.171.141.234 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-141-234.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	deepinstinct.com www.deepinstinct.com	856 KB
13	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	448 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 750 www.linkedin.com — Cisco Umbrella Rank: 900 px4.ads.linkedin.com — Cisco Umbrella Rank: 6909	3 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 1014 p.typekit.net — Cisco Umbrella Rank: 1457	78 KB
4	contentstack.io images.contentstack.io — Cisco Umbrella Rank: 12215	175 KB
3	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 4979 forms.hubspot.com — Cisco Umbrella Rank: 10549	4 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2227 www.google.com — Cisco Umbrella Rank: 5	1 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 63735 ibc-flow.techtarget.com — Cisco Umbrella Rank: 59224	2 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 14935	26 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 623	14 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 248	73 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 99	21 KB
3	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 23245	148 KB
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 2233 api.company-target.com — Cisco Umbrella Rank: 9815	967 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	306 B
2	google.de www.google.de — Cisco Umbrella Rank: 4622	126 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 195	408 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 1340	611 B
2	t.co t.co — Cisco Umbrella Rank: 794	604 B
2	qualified.com js.qualified.com — Cisco Umbrella Rank: 50060 app.qualified.com — Cisco Umbrella Rank: 54435	160 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 11847 tag-logger.demandbase.com — Cisco Umbrella Rank: 12364	22 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 1372 script.hotjar.com — Cisco Umbrella Rank: 1732	59 KB
1	gstatic.com www.gstatic.com	201 KB
1	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 26655	279 B
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 7043	1 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 1443	98 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 23909	204 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 4813	17 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 6750	4 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 10116	88 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 4839	22 KB
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 8510	161 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1259	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1860	17 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5117	1 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 4002	48 KB
124	36

	Domain	Requested by
43	www.deepinstinct.com	www.deepinstinct.com
13	www.googletagmanager.com	www.deepinstinct.com www.googletagmanager.com js.hsadspixel.net www.googleoptimize.com
4	px.ads.linkedin.com	3 redirects cdn.bizible.com
4	images.contentstack.io	www.deepinstinct.com
4	use.typekit.net	www.deepinstinct.com use.typekit.net
3	cdn.bizible.com	www.googletagmanager.com www.deepinstinct.com cdn.bizible.com
3	bat.bing.com	www.deepinstinct.com bat.bing.com
3	connect.facebook.net	www.deepinstinct.com connect.facebook.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.deepinstinct.com
3	s.swiftypecdn.com	www.deepinstinct.com s.swiftypecdn.com
2	track.hubspot.com
2	www.google.com	www.deepinstinct.com js.hsleadflows.net
2	www.facebook.com	www.deepinstinct.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	www.google.de	www.deepinstinct.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	analytics.twitter.com	www.deepinstinct.com
2	t.co	www.deepinstinct.com
1	www.gstatic.com	www.google.com
1	forms.hubspot.com	cdn.bizible.com
1	app.qualified.com	js.qualified.com
1	cc.swiftype.com	www.deepinstinct.com
1	tag-logger.demandbase.com	cdn.bizible.com
1	api.hubapi.com	cdn.bizible.com
1	api.company-target.com	cdn.bizible.com
1	id.rlcdn.com	www.deepinstinct.com
1	s.company-target.com	tag.demandbase.com
1	cdn.bizibly.com	www.deepinstinct.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	content.hotjar.io	script.hotjar.com
1	region1.analytics.google.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	px4.ads.linkedin.com	www.deepinstinct.com
1	www.linkedin.com	1 redirects
1	js.qualified.com	www.googletagmanager.com
1	trk.techtarget.com	www.deepinstinct.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	tag.demandbase.com	www.deepinstinct.com
1	static.hotjar.com	www.googletagmanager.com
1	p.typekit.net	use.typekit.net
1	www.googleoptimize.com	www.deepinstinct.com
124	46

This site contains links to these domains. Also see Links.

Domain
portal.deepinstinct.com
info.deepinstinct.com
services.google.com
www.gov.il
amitaico.substack.com
www.securityjoes.com
xelemental.medium.com
go.crowdstrike.com
www.microsoft.com
en.wikipedia.org
www.mandiant.com
research.checkpoint.com
blog.talosintelligence.com
www.group-ib.com
symantec-enterprise-blogs.security.com
villains.fandom.com
op-c.net
www.secureworks.com
www.sentinelone.com
www.proofpoint.com
twitter.com
labs.k7computing.com
0day.bio
www.google.com
github.com
www.mafateehgroup.com
docs.tacticalrmm.com
learn.microsoft.com
www.youtube.com
www.linkedin.com
www.facebook.com

Subject Issuer	Validity	Valid
deepinstinct.com R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.contentstack.io Gandi Standard SSL CA 2	`2023-04-05` - `2024-05-05`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-18` - `2024-04-17`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 01	`2024-04-09` - `2024-06-27`	3 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
qualified.com E1	`2024-03-11` - `2024-06-09`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-03-10` - `2024-06-08`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
hsleadflows.net E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.company-target.com R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh
hubapi.com E1	`2024-03-06` - `2024-06-04`	3 months	crt.sh
*.demandbase.com Amazon RSA 2048 M01	`2023-07-11` - `2024-08-08`	a year	crt.sh
*.swiftype.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-21` - `2024-07-14`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
app.qualified.com R3	`2024-03-21` - `2024-06-19`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Frame ID: 993ADBF01CE42BCE11A2524926E51AE7
Requests: 121 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 0A485A3C701F3BC5EC048884276BC484
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=e0548737-f764-4bff-8023-af73354c8b8f
Frame ID: 4F40B45A66694E014FC068EE93046FFF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DarkBeatC2: The Latest MuddyWater Attack Framework

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

124
Requests

98 %
HTTPS

51 %
IPv6

36
Domains

46
Subdomains

46
IPs

4
Countries

2504 kB
Transfer

6892 kB
Size

41
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.deepinstinct.com/
Title: Login

Search URL Search Domain Scan URL

URL: https://info.deepinstinct.com/request-a-demo
Title: Request Demo

Search URL Search Domain Scan URL

URL: https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf
Title: shared

Search URL Search Domain Scan URL

URL: https://www.gov.il/en/departments/about/newabout
Title: INCD

Search URL Search Domain Scan URL

URL: https://www.gov.il/he/departments/publications/reports/alert_1721
Title: shared

Search URL Search Domain Scan URL

URL: https://amitaico.substack.com/p/the-other-pyramids
Title: Pyramid of Pain

Search URL Search Domain Scan URL

URL: https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
Title: BiBi wiper

Search URL Search Domain Scan URL

URL: https://xelemental.medium.com/homeland-justice-albania-wiper-3c7e7edd43cc
Title: Homeland Justice

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
Title: BanishedKitten

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
Title: investigation

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Kill_chain#Cyber
Title: Cyber Kill Chain

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against
Title: investigation

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/
Title: FoxShell

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/introducing-shrouded-snooper/
Title: ShroudedSnooper

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
Title: DEV-1084

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/muddywater-infrastructure/
Title: SimpleHarm

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms
Title: 2

Search URL Search Domain Scan URL

URL: https://villains.fandom.com/wiki/Lord_Nemesis
Title: Lord Nemesis

Search URL Search Domain Scan URL

URL: https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/
Title: report

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Title: According

Search URL Search Domain Scan URL

URL: https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us
Title: Cobalt Mirage

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/
Title: TunnelVision

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Title: Mint Sandstorm

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign
Title: recent

Search URL Search Domain Scan URL

URL: https://twitter.com/k3yp0d/status/1770954280049975757
Title: another

Search URL Search Domain Scan URL

URL: https://twitter.com/xDarkBitx/with_replies
Title: made

Search URL Search Domain Scan URL

URL: https://labs.k7computing.com/index.php/muddywater-back-with-darkbit/

Search URL Search Domain Scan URL

URL: https://0day.bio/
Title: 0Day forums

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=%22stark-industries%22+%22malware%22
Title: known

Search URL Search Domain Scan URL

URL: https://github.com/yogeshojha/rengine
Title: reNgine

Search URL Search Domain Scan URL

URL: https://www.mafateehgroup.com/about/
Title: mafateehgroup.com

Search URL Search Domain Scan URL

URL: https://docs.tacticalrmm.com/
Title: Tactical RMM.

Search URL Search Domain Scan URL

URL: https://twitter.com/1ZRR4H/status/1772107339757232497
Title: reported

Search URL Search Domain Scan URL

URL: https://twitter.com/chux13786509/status/1768642677484949748
Title: observed

Search URL Search Domain Scan URL

URL: https://twitter.com/Intel_Ops_io/status/1772586606639132955
Title: Intel-Ops

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_script_blocks?view=powershell-7.4
Title: scriptblock

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCYerfisJf3hc9QOWmic1G9Q

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/deep-instinct

Search URL Search Domain Scan URL

URL: https://twitter.com/DeepInstinctSec

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DeepInstinctInc

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1712715235247%26li_adsId%3Dd41ed5d2-0429-44e8-b4c0-305ab688779a%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%252Fblog%252Fdarkbeatc2-the-latest-muddywater-attack-framework%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQJboYgj64YzLQAAAY7FyIIIH7M6m-5uEoy92s24mnIgtgioU0irnkcZ_Tztd9FpYSfWYsTL

124 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request darkbeatc2-the-latest-muddywater-attack-framework Show response
www.deepinstinct.com/blog/ 170 KB
27 KB 390ms
338ms Document
text/html 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

9868c23a7f08f3b18037fb675b583d8ffcd971ff2247fb9004abe43b8aa4eb90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 238
cache-control: public,max-age=0,must-revalidate
cache-status: "Next.js"; hit "Netlify Edge"; fwd=stale
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 10 Apr 2024 02:13:54 GMT
etag: "kzwqyb5uc43p6e-df"
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
strict-transport-security: max-age=31536000
surrogate-control: max-age=300, stale-while-revalidate=900, stale-if-error=900
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nextjs-date: Wed, 10 Apr 2024 02:13:54 GMT
x-nf-request-id: 01HV2WGYWD9C8BPNFBTK0EZSCW
x-xss-protection: 1

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 126 KB
48 KB 159ms
50ms Script
application/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4339aa2a30dddab3c704be71663ec8ed8c9bfbeb79748cf5b507f625632c0f13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 48652
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 10 Apr 2024 02:13:54 GMT

GET
H2 200 62c9f84af6283043.css
www.deepinstinct.com/_next/static/css/ 33 KB
7 KB 9ms
8ms Stylesheet
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/62c9f84af6283043.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ7479ZV3NDXR426VYNE
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38402
cache-status: "Netlify Edge"; hit
etag: "12e801962e10f6d1010c18a06f69df7b-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7182

GET
H2 200 b3c831d72c60daeb.css
www.deepinstinct.com/_next/static/css/ 15 KB
3 KB 9ms
9ms Stylesheet
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b3c831d72c60daeb.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ74Z6XQNNCDEHSDJ9JH
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "b612c4d93b4d750f521d7cf025d5fdd3-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3473

GET
H2 200 ddca67f80ea11511.css
www.deepinstinct.com/_next/static/css/ 889 B
1021 B 8ms
7ms Stylesheet
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/ddca67f80ea11511.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ74X12Q293TACJ5QG5D
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 38402
cache-status: "Netlify Edge"; hit
etag: "bf94acaf8c7e8837fa3d2ad39b6a0f87-ssl"
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 889

GET
H2 200 5935-76bf011ee3d88f83.js Show response
www.deepinstinct.com/_next/static/chunks/ 30 KB
10 KB 12ms
12ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5935-76bf011ee3d88f83.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZDSPNDENE9JCX95BKF1
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "711c7a0bda1d2a5419580350a0ac2def-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 10227

GET
H2 200 7029-3230841eb82dea3f.js Show response
www.deepinstinct.com/_next/static/chunks/ 123 KB
37 KB 15ms
12ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7029-3230841eb82dea3f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1W38104CVH169V7G1
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "163091f8d515307568ca14bd7c244cee-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 37347

GET
H2 200 6839.c8ee40f8e73e0e22.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 13ms
11ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/6839.c8ee40f8e73e0e22.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE0337M4NJ3GEZ6X9JA
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "42b37c98d571c31326f0ce7f5b379979-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1059

GET
H2 200 webpack-29002f1662bf7c0b.js Show response
www.deepinstinct.com/_next/static/chunks/ 7 KB
3 KB 12ms
10ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE10TZNX72BXFY7ZGCR
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "08ae6cd137e5a9f44ce8da97bbdf3bdf-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3350

GET
H2 200 framework-314c182fa7e2bf37.js Show response
www.deepinstinct.com/_next/static/chunks/ 138 KB
43 KB 21ms
19ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/framework-314c182fa7e2bf37.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1XB3WRM52YV7T1KWH
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "842190aeeb138e17ecbd4e80395b04db-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 43634

GET
H2 200 main-c5b7e6d77b82bab5.js Show response
www.deepinstinct.com/_next/static/chunks/ 124 KB
35 KB 13ms
11ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1EE24MPXVVGZEXA25
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "f5b74e619e9eb5d06577186ed77b231a-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 35776

GET
H2 200 _app-88813e0d1ae2e973.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 450 B
536 B 11ms
9ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/_app-88813e0d1ae2e973.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE18J92AVRGHRJ8DNQ9
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "50537b790c14aad9a5df48742d265dfa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 450

GET
H2 200 5675-5d8e1c18eb2a06a1.js Show response
www.deepinstinct.com/_next/static/chunks/ 9 KB
4 KB 11ms
9ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5675-5d8e1c18eb2a06a1.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1QVX97T47E7BD8DYQ
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "ae4ef7f9e1361f41374b10337ad35c3b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3726

GET
H2 200 8882-efb8f68e8ac16c1e.js Show response
www.deepinstinct.com/_next/static/chunks/ 27 KB
10 KB 16ms
14ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/8882-efb8f68e8ac16c1e.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1JVB5RHH1KFSJQ1Z3
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "e9c9a5087b21357b065e593c5a56f0d3-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 9855

GET
H2 200 1053-69c3e67c1a3e9c2f.js Show response
www.deepinstinct.com/_next/static/chunks/ 89 KB
30 KB 13ms
11ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1053-69c3e67c1a3e9c2f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE1H9DEQ1VMP1C8X0J9
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "78b7ac861927eedc433e1fd1aff23deb-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 31080

GET
H2 200 512-de9e9b45ad8341f5.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
6 KB 16ms
15ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/512-de9e9b45ad8341f5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE5J318J8VPJ0HNMT1A
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "f23770c964cb4a5c463e6f0d11791c33-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 5572

GET
H2 200 %5Bpid%5D-7f7601d838d136ca.js Show response
www.deepinstinct.com/_next/static/chunks/pages/blog/ 547 B
633 B 17ms
15ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/blog/%5Bpid%5D-7f7601d838d136ca.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE5H8V1XQE10BFR45S6
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "f101ba9e2d84013ead218fe806d71a13-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 547

GET
H2 200 _buildManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 8 KB
2 KB 17ms
16ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_buildManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE5JWYMWRTGXFSSMN0J
date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "8d7e44c890b374fe3291edb4d40e58a2-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1529

GET
H2 200 _ssgManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 455 B
542 B 18ms
16ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_ssgManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE5MRDXP4SYD1EG9TBJ
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "c28c1e4abeeaf5ddbabf351bc59836fa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 455

GET
H2 200 zka3qml.css
use.typekit.net/ 3 KB
993 B 385ms
347ms Stylesheet
text/css 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zka3qml.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 10 Apr 2024 02:13:54 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 770

GET
H2 200 fig01-threat-actors-behind-the-attack.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/ 64 KB
65 KB 37ms
7ms Image
image/png 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/fig01-threat-actors-behind-the-attack.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300703
x-cache: HIT, HIT
fastly-io-info: ifsz=65512 idim=959x352 ifmt=png ofsz=65485 odim=959x352 ofmt=png
content-disposition: inline; filename=fig01-threat-actors-behind-the-attack.png
fastly-stats: io=1
content-length: 65485
x-request-id: bdc22ad351705a5892f096edccb75e2d
x-served-by: cache-sjc1000100-SJC, cache-fra-eddf8230041-FRA
x-runtime: 70ms
server: contentstack
x-timer: S1712715235.580793,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "VEnI2SRgCKF7O3N/g1JMMt8mHvFARxWKJS+kxe7JNsE"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 5, 0

GET
H2 200 fig02-faketivism.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/ 95 KB
95 KB 37ms
7ms Image
image/png 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/fig02-faketivism.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300706
x-cache: HIT, HIT
fastly-io-info: ifsz=97816 idim=886x430 ifmt=png ofsz=97214 odim=886x430 ofmt=png
content-disposition: inline; filename=fig02-faketivism.png
fastly-stats: io=1
content-length: 97214
x-request-id: 78e5fd9f36532b4badb661294655a29a
x-served-by: cache-sjc10044-SJC, cache-fra-eddf8230041-FRA
x-runtime: 64ms
server: contentstack
x-timer: S1712715235.580793,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "dOM9Tlik+m9shWIGyZg+b6nO+tORUueAg4gj+nZYapU"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 5, 0

GET
H2 200 fig03-current-muddywater-campign.png
www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/ 63 KB
63 KB 9ms
9ms Image
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/fig03-current-muddywater-campign.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ93PRCPMW9H1QDQ8TXW
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300711
x-cache: MISS, HIT
fastly-io-info: ifsz=74622 idim=1086x341 ifmt=png ofsz=64213 odim=1086x341 ofmt=png
content-disposition: inline; filename=fig03-current-muddywater-campign.png
fastly-stats: io=1
content-length: 64213
x-request-id: 8f80c28561388a4a21b0b01320e1ca26
x-served-by: cache-sjc10041-SJC, cache-iad-kjyo7100033-IAD
x-runtime: 97ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700491.590967,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "v+vVzFipZI8vegdG4hRmEEU8Un0vcYa4X5FK2gUgmIc"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig04-uploader-information-at-kinneretacil.jfif
www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/ 22 KB
22 KB 10ms
9ms Image
image/jpeg 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/fig04-uploader-information-at-kinneretacil.jfif

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ9AB6EJZZJ8SQVNZ5DY
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300701
x-cache: MISS, HIT
fastly-io-info: ifsz=22606 idim=1429x292 ifmt=jpeg ofsz=22606 odim=1429x292 ofmt=jpeg
content-disposition: inline; filename=fig04-uploader-information-at-kinneretacil.jfif
fastly-stats: io=1
content-length: 22606
fastly-io-warning: Failed to shrink image
x-request-id: ef003cee43b78d5c4189393012af90f7
x-served-by: cache-sjc1000142-SJC, cache-iad-kjyo7100105-IAD
x-runtime: 44ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700490.204844,VS0,VE3
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "wKbkTH77ViUEbiMLak1GQ7udMH+1721nLL9a+kZWHuE"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig05-uploader_info-salary.png
www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/ 16 KB
16 KB 9ms
8ms Image
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/fig05-uploader_info-salary.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZ9M3BV0DEW4A2TY8VX8
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300714
x-cache: MISS, HIT
fastly-io-info: ifsz=16145 idim=1115x486 ifmt=png ofsz=16115 odim=1115x486 ofmt=png
content-disposition: inline; filename=fig05-uploader_info-salary.png
fastly-stats: io=1
content-length: 16115
fastly-io-warning: Failed to shrink image
x-request-id: 6fe01d74490c19f267c2ad23d4ef0af1
x-served-by: cache-sjc10042-SJC, cache-iad-kcgs7200173-IAD
x-runtime: 60ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700491.613736,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "PMiaPw5iDMnKjyE27Yu4yThV25UYkXcjvoPCbYdHF2w"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig06-darkbit_muddy.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/ 5 KB
5 KB 9ms
7ms Image
image/png 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/fig06-darkbit_muddy.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300708
x-cache: HIT, HIT
fastly-io-info: ifsz=6674 idim=486x114 ifmt=png ofsz=4766 odim=486x114 ofmt=png
content-disposition: inline; filename=fig06-darkbit_muddy.png
fastly-stats: io=1
content-length: 4766
x-request-id: e03e0186ba2e75f781dfb62f58df43cc
x-served-by: cache-sjc1000093-SJC, cache-fra-eddf8230041-FRA
x-runtime: 53ms
server: contentstack
x-timer: S1712715235.752822,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "vmzGr3PB1WNT/Qy+VppMOcSoI5k7kl9iWEFGri9t0g4"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 4, 0

GET
H2 200 fig07-freeupload.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/ 10 KB
10 KB 8ms
7ms Image
image/png 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/fig07-freeupload.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300701
x-cache: HIT, HIT
fastly-io-info: ifsz=10140 idim=1127x56 ifmt=png ofsz=10110 odim=1127x56 ofmt=png
content-disposition: inline; filename=fig07-freeupload.png
fastly-stats: io=1
content-length: 10110
fastly-io-warning: Failed to shrink image
x-served-by: cache-sjc1000121-SJC, cache-fra-eddf8230041-FRA
x-runtime: 47ms
x-request-id: 2c930eb3fe8e8db71acdbfe9fd0f2ca6
server: contentstack
x-timer: S1712715235.752896,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "CEzcrV5QqWebRUiDirfFaaWk+AJPzpKZW2GdNo1NG+Q"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 5, 0

GET
H2 200 fig08-setting_powershell.png
www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/ 16 KB
17 KB 18ms
17ms Image
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/fig08-setting_powershell.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE5Z86VDBZDA3A9K0P7
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300704
x-cache: MISS, HIT
fastly-io-info: ifsz=31883 idim=975x393 ifmt=png ofsz=16384 odim=975x393 ofmt=png
content-disposition: inline; filename=fig08-setting_powershell.png
fastly-stats: io=1
content-length: 16384
x-request-id: 7d063db2060a9a2771322d5e35cc4f00
x-served-by: cache-sjc1000114-SJC, cache-iad-kjyo7100111-IAD
x-runtime: 68ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700491.626268,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "tMzTzAePC2mduhoWWL08QdmnCEzhK2qRsCO7q0ncweg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig09-8946172.png
www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/ 11 KB
12 KB 18ms
17ms Image
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/fig09-8946172.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE50HVTM29GQHGFJYT5
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300705
x-cache: MISS, HIT
fastly-io-info: ifsz=19931 idim=997x173 ifmt=png ofsz=11526 odim=997x173 ofmt=png
content-disposition: inline; filename=fig09-8946172.png
fastly-stats: io=1
content-length: 11526
x-request-id: ec9fc83b992e027811e55099b9a0e4ae
x-served-by: cache-sjc1000143-SJC, cache-iad-kiad7000070-IAD
x-runtime: 56ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700491.630947,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "udEo+45YI5JQNwd9RtBJhX29jtb6aexXu+JLlOswPTs"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig10-7878123.png
www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/ 13 KB
13 KB 19ms
18ms Image
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/fig10-7878123.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZE579RCV8YME5AQBV06
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 14744
fastly-io-served-by: vpop-haf2300709
x-cache: MISS, HIT
fastly-io-info: ifsz=23526 idim=977x364 ifmt=png ofsz=13011 odim=977x364 ofmt=png
content-disposition: inline; filename=fig10-7878123.png
fastly-stats: io=1
content-length: 13011
x-request-id: b98674c462cc83a8c2c22324382fa302
x-served-by: cache-sjc10047-SJC, cache-iad-kiad7000149-IAD
x-runtime: 47ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712700491.620988,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "aNLsCZiogfaK+dI13wowFMHlRypXq+Kq01w25juCPkg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 297 KB
102 KB 135ms
55ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

64e61d41f7b5951150d282f71796a52f304e2280002f466df61fc89e44e85e3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103794
x-xss-protection: 0
last-modified: Wed, 10 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Apr 2024 02:13:54 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 19ms
7ms Stylesheet
text/css 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zka3qml&ht=tk&f=10954.13454.13466.28969&a=83637106&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
last-modified: Fri, 23 Jun 2023 17:09:47 GMT
server: nginx
etag: "6495d1db-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 l
use.typekit.net/af/04ec74/00000000000000000001205b/27/ 29 KB
29 KB 31ms
9ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/04ec74/00000000000000000001205b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
server: nginx
etag: "1c4557ace28950fbc49487c3a85660222d5fe232"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29588

GET
H2 200 l
use.typekit.net/af/1709eb/000000000000000000010b60/27/ 24 KB
24 KB 30ms
8ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
server: nginx
etag: "9bd0488a91630a3c738a4d950e0b0b7930bcb98f"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24740

GET
H2 200 l
use.typekit.net/af/442215/000000000000000000010b5a/27/ 23 KB
23 KB 28ms
7ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/442215/000000000000000000010b5a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:54 GMT
server: nginx
etag: "9523c64514161c03124fab238b18113d17bad9eb"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23800

GET
H2 200 image
www.deepinstinct.com/_next/ 286 KB
286 KB 174ms
173ms Image
image/avif 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fwww.deepinstinct.com%2Fimage%2Fblt488afd138c53fee8%2F660dc3726c4a396121e472ec%2FDI_Threat_Research_Team_Blog_930x400.png&w=1680&q=100

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNRK2P5B6NN3DEDRX2S
content-security-policy
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 41646
cross-origin-resource-policy: cross-origin
content-length: 292898
last-modified: Tue, 09 Apr 2024 14:39:48 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; fwd=miss
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=31536000
x-imgix-origin-passthrough: Cache-Control=max-age%3D31536000&Content-Security-Policy=&X-Nf-Cache-Control=
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 13ms
13ms Image
image/avif 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fblt14ca71678553d70e%2F6305444727ca1b5cd53ebd62%2Fkenin-simon.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNR2VC6PJHKM6QKE5CP
content-security-policy: script-src 'none'
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 42288
cross-origin-resource-policy: cross-origin
content-length: 4851
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 12ms
12ms Image
image/avif 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fbltfdfca743f7ac9662%2F630e2d5d8bdc107d4a01ba3f%2F800x800-blue-monogram.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNR0WXVZX5F41FA5R9W
content-security-policy: script-src 'none'
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 42288
cross-origin-resource-policy: cross-origin
content-length: 5220
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 5518.abf70040ebe14552.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
7 KB 9ms
8ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5518.abf70040ebe14552.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNY05PV0Y462PX480BR
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38402
cache-status: "Netlify Edge"; hit
etag: "a1bb3610d16d40d3994a04e335eb2f7b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7381

GET
H2 200 4c213f3cb0a0d816.css
www.deepinstinct.com/_next/static/css/ 1 KB
406 B 11ms
10ms Stylesheet
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/4c213f3cb0a0d816.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNYDYFN667K2386K8N3
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38401
cache-status: "Netlify Edge"; hit
etag: "6eccd5b5ee90f21ffe9daf5e31693980-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 298

GET
H2 200 1114.36c11ded4c40c351.js Show response
www.deepinstinct.com/_next/static/chunks/ 5 KB
2 KB 9ms
9ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1114.36c11ded4c40c351.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNY7JD5S9FQADXVBPKP
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "be2cb73604d20aae800d9673a2b8cb00-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1666

GET
H2 200 7743.1cc5d0e5cea43aba.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 11ms
11ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7743.1cc5d0e5cea43aba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZNZWHGFE8ZHV6NB1VWS
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38402
cache-status: "Netlify Edge"; hit
etag: "b01362f8cfc3944820c788efd91353e8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1124

GET
H2 200 st.js Show response
s.swiftypecdn.com/install/v2/ 416 KB
110 KB 42ms
6ms Script
text/javascript 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-fra-eddf8230094-FRA
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
via: 1.1 varnish
age: 240
x-timer: S1712715235.118659,VS0,VE0
etag: "644bc37d-1b6c6"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=300, public, max-age=300, public
accept-ranges: bytes
content-length: 112326
x-cache-hits: 2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
95 KB 52ms
52ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e4c3f2f93bb46fbbe1393eee90b5e6fda04011704c567a03eb20e07f249ba295

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96712
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 10 Apr 2024 02:13:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 120ms
35ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 10 Apr 2024 01:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1547
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 10 Apr 2024 03:48:08 GMT

GET
H2 200 hotjar-1665869.js Show response
static.hotjar.com/c/ 9 KB
4 KB 70ms
38ms Script
application/javascript 18.66.102.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-53.fra56.r.cloudfront.net

Software

Resource Hash

547e38cee489f1d5390acfb819cf153b04c87d0d5a19bec0a5924d5d0120ae63

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 891011d51eb2353ebe8601f5b6467070.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/ee411fcfc2edff61ffb9ec76f2534ce1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: xisT7nmIvXrJERS0HuW-OznAItk60VBOHT7Y_BV8vox5frAcRrOp4A==

GET
H2 200 8430ce879b38826d.min.js Show response
tag.demandbase.com/ 77 KB
22 KB 464ms
424ms Script
application/javascript 99.84.88.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/8430ce879b38826d.min.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.88.115 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-88-115.muc50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

05e0bd8cf7d2075f2758c6a75758d56c0528b119bd8560f9a72d40756575faa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: XAxyGC7JC9kKfigFiDNRnEw79lEVPyiK
content-encoding: gzip
via: 1.1 22a1b3c2f1a7b6d72ce563a230b92a90.cloudfront.net (CloudFront)
date: Wed, 10 Apr 2024 02:13:56 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
last-modified: Fri, 29 Mar 2024 23:37:42 GMT
server: AmazonS3
etag: W/"228e9ad763bd17ea00667061aa254171"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: q48h-4SAMHf9jQ7CQ1fhUuZRs2azXppRd9Rz2r_Z7o2vbirC3ZTerw==

GET
H2 200 2183098.js Show response
js.hs-scripts.com/ 2 KB
1 KB 164ms
133ms Script
application/javascript 2606:4700::6810:89d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/2183098.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acfb6774d0de7956f44fd713fcd31ef4b13d1fa6cd14f5451f66f3295dd6a309

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 80e9702d-4bea-482d-b02e-c84e90ad686e
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 80e9702d-4bea-482d-b02e-c84e90ad686e
last-modified: Wed, 10 Apr 2024 00:41:08 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-697677dfc-xn4hd
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 871f386c2c849766-FRA
expires: Wed, 10 Apr 2024 02:15:25 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 241 KB
84 KB 66ms
66ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba987ce07e5a8c926d739f6d02705a26c9fdaf25deaf8e1cb0ffff667986b609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85926
x-xss-protection: 0
last-modified: Wed, 10 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Apr 2024 02:13:55 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 39ms
7ms Script
application/javascript 2a02:26f0:3500:16::215:148d
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=19729
accept-ranges: bytes
content-length: 17238

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 35ms
7ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kiad7000168-IAD, cache-fra-etou8220131-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 23ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bda2cf571d7ea45f68afcdc87f968090dbf4bbdec2c7d6d19ce591b3980c296f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Apr 2024 02:13:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57850
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1326, tbw=2783, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: PRogvAMZxqGl9unBX/KiSuYPTvBpJDe6F/MNir7puwCZiWkKA2Vg3eI2Q1Y5b0Os4Y+5XTEUa7PCQGkx/I0CDw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 59ms
32ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 10 Apr 2024 02:13:54 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 17B9764D8E2D4B8BA649D84424B59644 Ref B: FRAEDGE1106 Ref C: 2024-04-10T02:13:55Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 43ms
7ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

5f9fac8d51134fcba0174a1c8d00d921b09bcfa2159cab80c016d9c0c0e8453c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Thu, 04 Apr 2024 16:22:12 GMT
server: ECS (frb/67D4)
age: 18099
etag: "42f0b43fac86da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25391

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 76ms
38ms Script
text/javascript 2606:4700:4400::6812:24c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 38422
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 871f386c3d5b1909-FRA
expires: Wed, 10 Apr 2024 02:33:55 GMT

GET
H2 200 qualified.js Show response
js.qualified.com/ 657 KB
160 KB 468ms
440ms Script
text/javascript 2606:4700::6812:1005
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

723118031279b31991091fc6ee32db023b9961b923b4f0a3ea4cbcb6766279e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
via: 1.1 spaces-router (devel)
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 881b7032-7e43-901f-392c-284740aa2d8d
pragma: no-cache
x-runtime: 0.026827
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"723118031279b31991091fc6ee32db02"
x-download-options: noopen
vary: Accept,Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 871f386c6ac92c7b-FRA
expires: Wed, 10 Apr 2024 06:13:55 GMT

GET
H2 200 prevention-for-storage.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 22 KB
7 KB 11ms
11ms Fetch
application/json 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/prevention-for-storage.json?pid=prevention-for-storage

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWAW4XFVFWNWRSX61BN
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Tue, 09 Apr 2024 22:39:32 GMT
age: 12906
x-nextjs-matched-path: /en/[pid]
content-length: 6411
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "70xc33uog9hny-df-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js
www.deepinstinct.com/_next/static/chunks/pages/ 0
1 KB 8ms
8ms Other
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWASG3JFEHJFQSQRX28
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 partners.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 26 KB
7 KB 249ms
249ms Fetch
application/json 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/partners.json?pid=partners

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWA37NQBP2E9BBJ195B
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 1180
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=stale
etag: "iu627gl25hkq0-df-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 10 Apr 2024 02:13:55 GMT
cache-control: public,max-age=0,must-revalidate
x-nextjs-matched-path: /en/[pid]

GET
H2 200 blog.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 111 KB
30 KB 202ms
202ms Fetch
application/json 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/blog.json?pid=blog

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWAM0KG3TKN9FAV41CH
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 75
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=stale
etag: "aphoups31t2fcw-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 10 Apr 2024 02:13:55 GMT
cache-control: public,max-age=0,must-revalidate
x-nextjs-matched-path: /en/[pid]

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/ 252 KB
62 KB 477ms
477ms Fetch
application/json 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWBEZE0Z47K2B2AFCX3
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 1894
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "lfd5y5u6h55hv0-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 10 Apr 2024 02:13:55 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 0
4 KB 8ms
8ms Other
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWBFZE0N2Z5AFEQXZK9
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/ 251 KB
62 KB 298ms
298ms Fetch
application/json 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZWBCTWK4NCJRMMCJMVC
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 1893
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "u0xpnp7rl5hhp-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Wed, 10 Apr 2024 02:13:55 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 NW3rMrxBqJx71BachJFa.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 615ms
597ms XHR
application/json 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/NW3rMrxBqJx71BachJFa.json

Requested by

Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.167 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: */*
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish
x-permitted-cross-domain-policies: none
age: 0
x-cache: MISS
content-length: 4251
x-xss-protection: 1; mode=block
x-request-id: ddaf52408113dbb297e26640f2961fd5
x-served-by: cache-fra-eddf8230042-FRA
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 May 2023 16:51:29 GMT
x-timer: S1712715235.254445,VS0,VE591
etag: W/"0b4dc992c692095d33a1f63f87bd38a6"
x-download-options: noopen
x-frame-options: SAMEORIGIN
access-control-max-age: 7200
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 5 KB
1 KB 8ms
8ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZXDGY42FSWY341CB5ZB
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1256

GET
H2 200 7e11275f8e6fc085.css Show response
www.deepinstinct.com/_next/static/css/ 14 KB
3 KB 8ms
8ms Fetch
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/7e11275f8e6fc085.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZXD03G1WN7RGRTKRFBS
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38400
cache-status: "Netlify Edge"; hit
etag: "a08d329af0ca27ab60ede65e07cd2abf-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3169

GET
H2 200 adsct
t.co/i/ 43 B
377 B 137ms
116ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=3752c27c-1fbf-476c-87b8-babd65d4bc5b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=86d62b9b-04da-466f-b15e-5eeec7b6a133&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 109
date: Wed, 10 Apr 2024 02:13:55 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 9bc2cb435e6a3b40
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 5feec6c5166101780ef333e7f4ca5655c73f14ca3f0e1eb190ddb9560e3d7169
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 136ms
116ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=3752c27c-1fbf-476c-87b8-babd65d4bc5b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=86d62b9b-04da-466f-b15e-5eeec7b6a133&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 109
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 9834ea8c61d58362
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 98d028588a9001620fa6340f5bae52796967c8927a543f7f4101ac1a5bb92dc3
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
227 B 220ms
198ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=fa701724-a8c2-4166-a6f8-9394008038a1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=86d62b9b-04da-466f-b15e-5eeec7b6a133&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 192
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 4dcf03ee1ff737e6
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 5feec6c5166101780ef333e7f4ca5655c73f14ca3f0e1eb190ddb9560e3d7169
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
217 B 202ms
192ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=fa701724-a8c2-4166-a6f8-9394008038a1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=86d62b9b-04da-466f-b15e-5eeec7b6a133&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 185
date: Wed, 10 Apr 2024 02:13:54 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 60056678daadb1d0
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 98d028588a9001620fa6340f5bae52796967c8927a543f7f4101ac1a5bb92dc3
content-length: 43

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1712715235247%26li_adsId%3Dd41ed5d2-0429-44e8-b4c0-305ab688779a%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mud...

0
265 B

172ms
150ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQJboYgj64YzLQAAAY7FyIIIH7M6m-5uEoy92s24mnIgtgioU0irnkcZ_Tztd9FpYSfWYsTL
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.deepinstinct.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 779A44B6D7664D3DB717E0C8A838F081 Ref B: FRAEDGE1521 Ref C: 2024-04-10T02:13:55Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYVtJc+iZvgMiO2QfkTFA==

Redirect headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 5BA77EC92BE4438BB251E8762941E4EC Ref B: FRAEDGE1217 Ref C: 2024-04-10T02:13:55Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712715235247&li_adsId=d41ed5d2-0429-44e8-b4c0-305ab688779a&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQJboYgj64YzLQAAAY7FyIIIH7M6m-5uEoy92s24mnIgtgioU0irnkcZ_Tztd9FpYSfWYsTL
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYVtJc7rksCAHeQhVwQAQ==

GET
H2 200 468591697375107 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 64ms
63ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/468591697375107?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f3e455aab43c84d676775111c19d7998853e5ace9a6271e41462c8c8a15c018a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Apr 2024 02:13:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=14, rtx=0, c=62, mss=1326, tbw=63156, tp=-1, tpl=-1, uplat=56, ullat=0
pragma: public
x-fb-debug: QzDuOlBkWnT8MWJVipcjMgPzbTI1RVais1kKyCMinS2u0j0hVDWe4jzNEO9fLKwPlQX6Ac1Kbh+G7DKOFK+Ygw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js Show response
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 10 KB
4 KB 19ms
19ms Script
application/javascript 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZXXP99P5M93ZZRKA05Z
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 40136
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 b5a64cbe6880b7dc.css Show response
www.deepinstinct.com/_next/static/css/ 16 KB
4 KB 8ms
8ms Fetch
text/css 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b5a64cbe6880b7dc.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WGZXXD4S2F611AJ6N8F2T
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 38400
cache-status: "Netlify Edge"; hit
etag: "a85bff580d8ffd9cf629505d2f37a034-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3637

GET
H2 204 17571311.js Show response
bat.bing.com/p/action/ 0
116 B 32ms
32ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17571311.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 10 Apr 2024 02:13:54 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9DD386D78C0D4366B818315DAE75094D Ref B: FRAEDGE1106 Ref C: 2024-04-10T02:13:55Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
285 B 82ms
81ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17571311&Ver=2&mid=957e9a23-5022-4682-a5de-6d888da7fcb3&sid=fb7f3310f6df11eebf8a21d220bd6454&vid=fb7f68d0f6df11eeaf012d9b64425272&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=800&sh=600&sc=24&tl=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&p=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&r=&lt=831&evt=pageLoad&sv=1&rn=97102

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 10 Apr 2024 02:13:54 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0A3765479C0141BAA59C3CFA4F997850 Ref B: FRAEDGE1106 Ref C: 2024-04-10T02:13:55Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.429236d560f51d186b8b.js Show response
script.hotjar.com/ 221 KB
55 KB 59ms
14ms Script
application/javascript 18.173.154.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.429236d560f51d186b8b.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-87.muc50.r.cloudfront.net

Software

Resource Hash

fa8cabe3021c19ba54e07d28a7722cd4bfdef39dea07207518113f7e161166bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 10:18:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 9564791ed47030dad53c797ee814c66e.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 402949
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55714
last-modified: Fri, 05 Apr 2024 10:17:11 GMT
etag: "f153d7cc62fba42a4a256996815cbb73"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: LRdXzDFKb-9s07OS9u9Mafwk6rhFuMlEB_qUw8qYiWF85KlMj5hI4w==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
257 B 53ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-P5MMKMDSNW&gtm=45je4480v868549395z878451102za200&_p=1712715234745&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=139518710.1712715235&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1712715235&sct=1&seg=0&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1159
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
257 B 61ms
18ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P5MMKMDSNW&cid=139518710.1712715235&gtm=45je4480v868549395z878451102za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 43ms
43ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tdp=G-P5MMKMDSNW;68549395;1;6;0&rtg=8451102&rlo=29&slo=15&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 td
www.googletagmanager.com/ 0
15 B 43ms
43ms Image
image/gif 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tdp=G-P5MMKMDSNW;68549395;1;6;0&rtg=8451102&rlo=29&slo=15&z=0
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.206.72 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: tzfraa-aa-in-f8.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
server: Golfe2
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 44ms
43ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtm.init&eid=0&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ccdgaadslink.1ogtgooglesignals.1ccdgaregscope.1ccdemdownload.1ccdemoutboundclick.1ccdempageview.1ccdemscroll.1ccdemsitesearch.1ccdemvideo.1ccdconversionmarking.1ccdautoredact.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaadslink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ccdautoredact.2ccdgalast&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 119ms
47ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-P5MMKMDSNW&cid=139518710.1712715235&gtm=45je4480v868549395z878451102za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=2028464720

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 51ms
51ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtag.config&eid=1&u=AAAAAAAIAAAAACA&h=Ag&epr=1G.2G&tr=1gct&ti=1gct&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 50ms
50ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=*&eid=2&u=AAAAAAAIAAAAACA&h=Ag&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 49ms
49ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&e=gtm.init&eid=0&u=AAAAAAAIAAAAACA&h=Ag&tr=5ogt1pdatav2.5ccdgafirst.5setproductsettings.5ccdgaadslink.5ogtgooglesignals.5ccdgaregscope.5ccdemdownload.5ccdemoutboundclick.5ccdempageview.5ccdemscroll.5ccdemsitesearch.5ccdemvideo.5ccdconversionmarking.5ccdautoredact.5ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaadslink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ccdautoredact.2ccdgalast&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 118ms
117ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1712715235300&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16780454
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPobTv41y8_SkvIv89oJQLY0gbeuoG-9DdnDWAgmhBmehFTD_Iv0QPu-PsJgVGixwT-5nw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Wed, 10 Apr 2024 03:13:55 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 147ms
109ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1712715235300&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.deepinstinct.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 10 Apr 2024 02:13:55 GMT
expires: Wed, 10 Apr 2024 02:13:55 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPoWh80vVEhJD5UuEoz0_jn_UHWiakP49ys01XkKedYG4TW4fFV9ZUi3M25mn7onB4Qv6QMulQe2Yg

GET
H3 200 332937911623471 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 74ms
73ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/332937911623471?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105%2C184%2C183%2C185%2C190%2C191%2C192%2C188%2C180%2C122%2C150%2C179%2C181%2C113%2C144%2C135%2C139%2C119%2C174%2C216%2C106%2C217%2C152%2C110%2C133%2C126%2C114

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra3.fbcdn.net

Software

Resource Hash

89973ccfb4b15890115d7c461e836f841a377e057d011416fd797b8602ae8eb7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Apr 2024 02:13:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=23, mss=1232, tbw=4649, tp=12, tpl=0, uplat=66, ullat=0
pragma: public
x-fb-debug: bxSye8sJ/lKha6d2wPxS+JywwQajBzunzFvMWrN04LJ/uw42H74eMzS2JVZi3+tPOcFUAZ+x1+0jJ5wNkbsiQg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 43ms
42ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=760166092&t=pageview&_s=1&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=en-us&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=800x600&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=571839156&gjid=39652122&cid=139518710.1712715235&tid=UA-69598329-1&_gid=1536705883.1712715235&_r=1&_slc=1&gtm=45He4480n8152PC3MWv78451102za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=978397284

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 162ms
86ms XHR
application/json 34.246.205.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=1665869&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.429236d560f51d186b8b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.246.205.163 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-205-163.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 5334886e325d68dc18a3e8c9f406b6acbac0c6014366586345dcb3f1bc1c40ef

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 10 Apr 2024 02:13:55 GMT
content-length: 56
vary: Origin
content-type: application/json

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 18ms
18ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69598329-1&cid=139518710.1712715235&jid=571839156&gjid=39652122&_gid=1536705883.1712715235&npa=1&_u=YCDACEAABAAAACAAI~&z=541787904

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2183098.js Show response
js.hs-analytics.net/analytics/1712715000000/ 68 KB
22 KB 438ms
422ms Script
text/javascript 2606:4700::6810:4dba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1712715000000/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4dba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa0395c7d91df251b50d8dec4347ac7b0e8860316764832c1342fe249001fc6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: C1R3VK6WPNKCBYBK
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: bc707bd0-7bdb-4126-9eff-8e11f9162531
x-envoy-upstream-service-time: 26
x-amz-id-2: tg4WIgFIPwBjonJlfAyv4WXpd/ZO3vEeEdK3zpsj671mZ64Tsd+pdve4jpxkg756VNkHsC7bdhJahz4PQNrbSb45LkfaFRiM
x-evy-trace-listener: listener_https
x-request-id: bc707bd0-7bdb-4126-9eff-8e11f9162531
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 05 Apr 2024 18:50:29 GMT
server: cloudflare
etag: W/"26a6b54bc353c66041ac4568f3969e8d"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-snf7h
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 871f386d6ac4912b-FRA
expires: Wed, 10 Apr 2024 02:18:55 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 39ms
13ms Script
application/javascript 2606:4700::6812:8b11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8b11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 43695
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=871b0da59c00717a-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"d252299cef5b9176cf0435e72e0baeeb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js
date: Wed, 10 Apr 2024 02:13:55 GMT
x-amz-version-id: FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc
via: 1.1 53b70ac9dc46d1c13992b291cf22a9aa.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 10ca213f-e6b4-4529-91f6-a658f5cc5eb5
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-request-id: 10ca213f-e6b4-4529-91f6-a658f5cc5eb5
last-modified: Wed, 03 Apr 2024 09:27:53 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-z4v48
cf-ray: 871f386d7a3c361d-FRA
x-amz-cf-id: QI1FRHphvRJ_GZ06a6oHIylmEqU_m9LCGT_esqcft-M7NY-lGOP3ng==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 49ms
21ms Script
application/javascript 2606:4700::6811:e7a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:e7a3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66e9a17c05981ae02d122a6845f9f904f13edeae0973af6fdbc44bb77ee5bbf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-amz-version-id: NPmBAW9YLDyQDhAGPmBdyF1DJfeS0dQT
via: 1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 365
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.546/bundles/pixels-release.js&cfRay=871f2f82cb8a198f-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: bec6f1b6-b200-4a60-a9a8-c9e8e60e8ba9
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: bec6f1b6-b200-4a60-a9a8-c9e8e60e8ba9
last-modified: Thu, 04 Apr 2024 13:54:33 UTC
server: cloudflare
etag: W/"437693b047b4419d0e2549e3f640e3c1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-gxvrq
cf-ray: 871f386d79112c37-FRA
x-amz-cf-id: x5satZZluuW4opfyUAJkHuaLNuQdTIdi_jSYw0EjMNv2EsIYvxDtCg==
x-hs-target-asset: adsscriptloaderstatic/static-1.546/bundles/pixels-release.js

GET
H2 200 2183098.js Show response
js.hs-banner.com/ 64 KB
17 KB 350ms
321ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-amz-version-id: 3t5xtorRfw4OfG5JJC.Kjqhy62bL4qUy
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 4S5V8H3PFNPF8CGA
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 5d0d4573-21a5-423d-967d-b6cfda945687
x-envoy-upstream-service-time: 37
x-amz-id-2: ZUuTuZUG4+SexM1sBWSt+c4MtPdy3wLZyGzQkjYt7QomABNngEbzAhRU80GIQmSt4ymJk/sP3AClexPq+FW00M7MQ9B/0iaC
x-evy-trace-listener: listener_https
x-request-id: 5d0d4573-21a5-423d-967d-b6cfda945687
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 29 Mar 2024 16:21:55 GMT
server: cloudflare
etag: W/"4554e0b29ba73627bf46cee13e80176e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6dfb9475dd-k2c5l
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 871f386d9c1971b5-FRA
expires: Wed, 10 Apr 2024 02:18:55 GMT

GET
H2 200 ipv
cdn.bizible.com/ 43 B
305 B 7ms
6ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-417244810&_biz_u=e499e020ec9d4202d12d490fc24dba39&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1712715235407&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&_biz_n=0&rnd=339645&cdn_o=a&_biz_z=1712715235408

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Mon, 08 Apr 2024 02:02:36 GMT
server: ECS (frb/67BA)
age: 173479
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
204 B 18ms
7ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=e499e020ec9d4202d12d490fc24dba39&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1712715235409&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&rnd=348734&cdn_o=a&_biz_z=1712715235409

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Mon, 08 Apr 2024 02:02:29 GMT
server: ECS (frb/6752)
age: 173486
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 21ms
7ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1712715235412&sw=800&sh=600&v=2.9.153&r=stable&ec=0&o=4126&fbp=fb.1.1712715235412.100179460&ler=empty&cdl=API_unavailable&it=1712715235256&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1326, tbw=2788, tp=-1, tpl=-1, uplat=0, ullat=-1
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Apr 2024 02:13:55 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
32 B 17ms
7ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1712715235413&sw=800&sh=600&v=2.9.153&r=stable&ec=0&o=4126&fbp=fb.1.1712715235412.100179460&ler=empty&cdl=API_unavailable&it=1712715235256&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1326, tbw=2788, tp=-1, tpl=-1, uplat=0, ullat=-1
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Apr 2024 02:13:55 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
323 B 118ms
118ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=e499e020ec9d4202d12d490fc24dba39&_biz_h=-417244810&cdn_o=a&jsVer=4.24.04.04

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

5ba9029b7eec68c9a93e1004eab9167875741873f1e2d801164e6ab9e3ef3461

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (frb/6711)
etag: 0C4A268A
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 217

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 119ms
45ms Image
image/gif 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=139518710.1712715235&jid=571839156&npa=1&_u=YCDACEAABAAAACAAI~&z=1518861808

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 45ms
45ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=139518710.1712715235&jid=571839156&npa=1&_u=YCDACEAABAAAACAAI~&z=1518861808

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 10 Apr 2024 02:13:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 4db4e1be-b1c7-4cdc-a658-b6ec0c9efb3a
https://www.deepinstinct.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.deepinstinct.com/4db4e1be-b1c7-4cdc-a658-b6ec0c9efb3a
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 sync
s.company-target.com/s/ Frame 0A48 0
0 145ms
101ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.company-target.com/s/sync?exc=lr
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.71.96.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Wed, 10 Apr 2024 02:13:55 GMT
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 63ms
20ms Image
text/plain 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 462 B
967 B 131ms
93ms XHR
application/json 18.173.187.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&page_title=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.187.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-187-83.muc50.r.cloudfront.net
Software: nginx /
Resource Hash: 3de1321dac18d5ef788ccc3b485fc44a253733c89f69d92df7c6b2b6b2fb65bb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
identification-source: CENTRAL
content-encoding: gzip
via: 1.1 09f78fab17e561a78ea60bb6223c4962.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
x-cache: Miss from cloudfront
request-id: f49d4092-e7f0-4b71-b46c-c928c6d584c6
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
access-control-expose-headers: x-amz-cf-id
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: usBd-jFRwfp03y-DN88F0QypvdVdMpQ9Kr7Kjke1vQ6AtKwO4W_Y9A==
expires: Tue, 09 Apr 2024 02:13:55 GMT

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 115 B
1 KB 145ms
128ms XHR
application/json 2606:4700::6812:f26c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=2183098

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f26c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

338bb102cb02ea5d873ff1df529cab30c5b8c52992cd089c20134d2d692bda69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a5fe6e90-eebb-4e20-889c-803ba9a86507
content-encoding: br
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a5fe6e90-eebb-4e20-889c-803ba9a86507
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-697677dfc-drpwv
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ghvp9VkxpgbL2wXsmWPmMsIWK35EA0AEbVByd5x8nPsa%2FHdqkTmX6YC6D3isj4%2BVtdOfcj7PWkvhxooQm7VthMBIc2xOk1PIyYu7ADCz19oteA00m74BimV9IYVrzQW5EXjpwSuLcvJL%2BaiR"}],"group":"cf-nel","max_age":604800}
cf-ray: 871f386fbc199966-FRA
access-control-allow-headers: *

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
418 B 458ms
412ms XHR
text/html 2600:9000:237d:8600:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=usBd-jFRwfp03y-DN88F0QypvdVdMpQ9Kr7Kjke1vQ6AtKwO4W_Y9A==&api-version=v2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:237d:8600:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
date: Tue, 09 Apr 2024 07:35:03 GMT
via: 1.1 09dddedbac44fa07d4af5f638358fa8a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P2
age: 75304
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-length: 0
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: X4NJ0uh4p1CTe_c7H6cCAKzaf91ZUj6Y5C2dI-8Q1AlwYEDma_7cnQ==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 36ms
35ms Image
image/gif 142.250.185.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=760166092&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=en-us&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=800x600&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDACEABBAAAACAAI~&jid=&gjid=&cid=139518710.1712715235&tid=UA-69598329-1&_gid=1536705883.1712715235&gtm=45He4480n8152PC3MWv78451102za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=Bot&cd5=(Non-Company%20Visitor)&cd6=HE&cd7=DE&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&npa=1&z=1902718832

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 23:35:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 9486
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
s.swiftypecdn.com/assets/ 89 KB
33 KB 7ms
6ms Stylesheet
text/css 151.101.129.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 60
date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: gzip
via: 1.1 varnish
age: 23445
x-cache: HIT
content-length: 33983
x-served-by: cache-fra-eddf8230094-FRA
x-timer: S1712715236.855021,VS0,VE0
etag: "62b9d075-84bf"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
expires: Wed, 09 Apr 2025 19:43:10 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 241 KB
84 KB 70ms
70ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812608847

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

16e0a1ac3dea27133d477a9ef9bc0105b3b6452ff6c1fd5aae0dff8daca31583

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85910
x-xss-protection: 0
last-modified: Wed, 10 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Apr 2024 02:13:55 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 241 KB
84 KB 53ms
53ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f2a52b7603b7a0e0b383000bbda36c681a9ff2b54495c4f290fb89fb7b9487f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85863
x-xss-protection: 0
last-modified: Wed, 10 Apr 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Apr 2024 02:13:55 GMT

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 548ms
127ms Image
image/gif 169.63.31.200
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=zPgdszsQivuSeQwTEHrm&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.63.31.200 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: c8.1f.3fa9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Content-Type: image/gif
Date: Wed, 10 Apr 2024 02:13:56 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Expires: Wed, 10 Apr 2024 02:13:55 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
197 B 162ms
161ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.deepinstinct.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:55 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 5DC8A0D98A1A43A6A62F0103AEB9BB4A Ref B: FRAEDGE1217 Ref C: 2024-04-10T02:13:56Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://www.deepinstinct.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYVtJdA33is7HnDk5iddQ==

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 43ms
43ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtag.config&eid=12&u=AgAAAAAIAAAAACA&h=Ag&z=0

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:56 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK messenger
app.qualified.com/w/1/DxHYmKWTScn3buDp/ Frame 4F40 0
0 578ms
204ms Document
text/html 35.171.141.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=e0548737-f764-4bff-8023-af73354c8b8f

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

35.171.141.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-171-141-234.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1671
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Wed, 10 Apr 2024 02:13:56 GMT
Etag: W/"ffc04c47f61bccb5f16160d48684a4f1"
Link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (devel)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: a2b40b5a-49c0-52c7-ed6f-eac80b30afc3
X-Runtime: 0.024390
X-Xss-Protection: 1; mode=block

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 151ms
125ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=800x600&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2604799944&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1712715237275&vi=99e396ba8d65b2ab523669eb91963867&nc=true&u=160033954.99e396ba8d65b2ab523669eb91963867.1712715237273.1712715237273.1712715237273.1&b=160033954.1.1712715237273&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6e9cf176-57d3-4761-a407-ab9229706050
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 8
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6e9cf176-57d3-4761-a407-ab9229706050
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DvfDp%2BJpqi3SmHUx8yaJAaOirJztSsBUCaKmTRD3wgi2s4%2FmoP6uKmH2WrFbWnzJmt43yIewJnYtF%2B2eeHU5eGsLaIxq%2F9eNlR9hZTEygsKkC2EGQUlC0myg7eXKtaRFPDvoqJVqOEjZop0DcqcS"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-q9j5k
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 871f38792a9ebb9e-FRA
x-robots-tag: none

GET
H2 200 favicon-32x32.png
www.deepinstinct.com/favicon/ 1 KB
1 KB 9ms
9ms Other
image/png 2a05:d014:275:cb01::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/favicon/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb01::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV2WH1X73XRM1B4PJGJG9GA9
date: Wed, 10 Apr 2024 02:13:57 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 38400
cache-status: "Netlify Edge"; hit
etag: "6c3361589f0d0f46f3458658f29255f6-ssl"
content-type: image/png
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1056

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 218ms
178ms XHR
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=2183098&utk=99e396ba8d65b2ab523669eb91963867&__hstc=160033954.99e396ba8d65b2ab523669eb91963867.1712715237273.1712715237273.1712715237273.1&__hssc=160033954.1.1712715237273&currentUrl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc12cebef16af2c60e6c11cc466d9d9870881e36d9bd9032eac325d27779824a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e657f9dd-e256-455f-8335-90ff9e207295
content-encoding: br
x-envoy-upstream-service-time: 47
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e657f9dd-e256-455f-8335-90ff9e207295
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-lhqjs
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VvMDdYMXgXqaf39xg4T7Iq%2FGfw3i43tff24jZ%2F8uxPHhv%2B8xkhYjuv%2B0svSuvG7jSjybzh%2BbX25Zo1XqvR7Dph24ATuEzOyV6haqV56SBbof%2Bue9WPn74D5RyTnXd%2B81us37ivC8gnxG3zGq6KJS"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 871f3879df1c6ace-FRA

GET
H3 200 enterprise.js Show response
www.google.com/recaptcha/ 1 KB
888 B 46ms
46ms Script
text/javascript 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=explicit

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

GSE /

Resource Hash

1109065bd46b1735c772ed9dde2e8e5153311eef14c8200e67fca8cebce8e184

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 10 Apr 2024 02:13:57 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
443 B 121ms
121ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=edf3154a-9058-41f2-8bd8-5f0fc6bddce4&lfi=2584648&ft=1&sd=800x600&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2604799944&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1712715237593&vi=99e396ba8d65b2ab523669eb91963867&nc=true&u=160033954.99e396ba8d65b2ab523669eb91963867.1712715237273.1712715237273.1712715237273.1&b=160033954.1.1712715237273&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e19e4cb9-10f0-43dd-96b4-bbd35001aec8
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 4
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e19e4cb9-10f0-43dd-96b4-bbd35001aec8
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILzTgma49HZVCMeLMNkDyQnUlSp9mmpCQXONxWeP7BKjMaQk%2FiRoeVwHjWFZZ3rAw2%2B6DPg%2BfAhMI1Br7WdUXmBypXXT%2FT51KpEuRtBKTLJudYKGOJo3bw8N1bXVwxGE5NUJQ6ezU%2FdDSsVEVXQ4"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-w7thh
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 871f387afb7cbb9e-FRA
x-robots-tag: none

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/ 501 KB
201 KB 119ms
36ms Script
text/javascript 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 00:37:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205471
x-xss-protection: 0
last-modified: Fri, 29 Mar 2024 04:30:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 10 Apr 2025 00:37:13 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 43ms
43ms Image
text/html 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-P5MMKMDSNW&v=3&t=t&pid=708247189&cv=1&rv=4480&tc=16&es=1&e=gtm.load&eid=13&u=AgAAAAAIAAAAACA&h=Ag&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 10 Apr 2024 02:13:57 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deepinstinct.com/	1970-01-20 21:54:51	Name: _gcl_au Value: 1.1.1401216740.1712715235
.deepinstinct.com/	1970-01-20 19:46:41	Name: _uetsid Value: fb7f3310f6df11eebf8a21d220bd6454
.deepinstinct.com/	1970-01-21 05:06:51	Name: _uetvid Value: fb7f68d0f6df11eeaf012d9b64425272
.techtarget.com/	1970-01-20 19:45:17	Name: __cf_bm Value: 7HjSOvIDGP0SINk45IV9EeNh4RvQlzJH8b4.FQiYVkY-1712715235-1.0.1.1-1KN3RJecGZ1d1A0YYBPRzgIuBkkzCqHJj6qPPvS.YW8sRnUIFMrom4Jf8z6kDvgcD5MKh_zYlrhxs5WontFZrw
.deepinstinct.com/	1970-01-21 05:21:15	Name: _ga_P5MMKMDSNW Value: GS1.1.1712715235.1.0.1712715235.60.0.0
.deepinstinct.com/	1970-01-21 05:21:15	Name: _ga Value: GA1.2.139518710.1712715235
.deepinstinct.com/	1970-01-20 19:46:41	Name: _gid Value: GA1.2.1536705883.1712715235
.deepinstinct.com/	1970-01-20 19:45:15	Name: _gat_UA-69598329-1 Value: 1
.bing.com/	1970-01-21 05:06:51	Name: MUID Value: 3396289242096DBB200A3CCF43626C38
.deepinstinct.com/	1970-01-21 04:30:51	Name: _hjSessionUser_1665869 Value: eyJpZCI6IjVjYjg5ODdmLWNiMDctNTU1My1iNTdjLTI3MDNhY2FmNzQ0NyIsImNyZWF0ZWQiOjE3MTI3MTUyMzUzNzQsImV4aXN0aW5nIjp0cnVlfQ==
.deepinstinct.com/	1970-01-20 19:45:17	Name: _hjSession_1665869 Value: eyJpZCI6IjkwYmI4NjNkLTc5MjUtNDNiOC1iYWYxLTY4NWJjNzBlNWQ1MSIsImMiOjE3MTI3MTUyMzUzNzQsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.deepinstinct.com/	1970-01-21 04:30:51	Name: _biz_uid Value: e499e020ec9d4202d12d490fc24dba39
.deepinstinct.com/	1970-01-21 04:30:51	Name: _biz_nA Value: 1
.deepinstinct.com/	1970-01-20 21:54:51	Name: _fbp Value: fb.1.1712715235412.100179460
.bizible.com/	1970-01-21 04:30:51	Name: _BUID Value: e499e020ec9d4202d12d490fc24dba39
.deepinstinct.com/	1970-01-21 04:30:51	Name: _biz_pendingA Value: %5B%5D
.linkedin.com/	1970-01-20 21:54:51	Name: li_sugr Value: fb40fbf3-ef48-4b81-b6c2-6a627ce38409
.linkedin.com/	1970-01-21 04:30:51	Name: bcookie Value: "v=2&aa636945-6cf7-4adc-8412-e66e1e5165cd"
.linkedin.com/	1970-01-20 19:46:41	Name: lidc Value: "b=TGST05:s=T:r=T:a=T:p=T:g=2990:u=1:x=1:i=1712715235:t=1712801635:v=2:sig=AQGjnYlo8r93T2hKafbqvWNliBbvSEBR"
.twitter.com/	1970-01-21 05:21:15	Name: personalization_id Value: "v1_UxoVP6CLjVC4PW9kjBenMQ=="
.bizibly.com/	1970-01-21 04:30:51	Name: _BUID Value: e04b286d8765ceaecd90c56a27344850
.t.co/	1970-01-21 05:21:15	Name: muc_ads Value: f87b2a8b-0924-402f-9f99-c4a18d083db8
.deepinstinct.com/	1970-01-21 04:30:51	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.linkedin.com/	1970-01-20 20:28:27	Name: UserMatchHistory Value: AQIrJ9OAvvgY9gAAAY7FyIDDI7nv9cmxxOqX1F9NkWOZX3Tajli3D5qhZ8uognnJxo1MKR7F0AVZww
.linkedin.com/	1970-01-20 20:28:27	Name: AnalyticsSyncHistory Value: AQLUBReDwBfV-AAAAY7FyIDDMIou6iBZTkE3avRHTmpdni5OwlHmJ8POk7Pe2iRY8yjLry1AjU7Tf3wBlR5Oow
.www.linkedin.com/	1970-01-21 04:30:51	Name: bscookie Value: "v=1&20240410021355e6912543-bddb-4606-82f9-7bba46d2f968AQEyY1-rl8gmVA2i2__YDK5zkn_-VqCx"
.linkedin.com/	1970-01-21 00:04:27	Name: li_gc Value: MTswOzE3MTI3MTUyMzU7MjswMjHLjEnx2fS9nwEYZjXporN8mx8JQ41lFmUHsyoneSQlOA==
.company-target.com/	1970-01-21 05:21:15	Name: tuuid Value: e96a44a6-f5ee-4b88-9b94-a022e11dbb5b
.company-target.com/	1970-01-21 05:21:15	Name: tuuid_lu Value: 1712715235\|ix:0\|mctv:0\|rp:0
.casalemedia.com/	1970-01-21 04:30:51	Name: CMID Value: ZhX147mqPDwAAFlKAbte3QAA
.casalemedia.com/	1970-01-20 21:54:51	Name: CMPS Value: 1129
.casalemedia.com/	1970-01-20 21:54:51	Name: CMPRO Value: 1129
.deepinstinct.com/	1970-01-21 05:21:15	Name: __q_state_DxHYmKWTScn3buDp Value: eyJ1dWlkIjoiZTA1NDg3MzctZjc2NC00YmZmLTgwMjMtYWY3MzM1NGM4YjhmIiwiY29va2llRG9tYWluIjoiZGVlcGluc3RpbmN0LmNvbSJ9
.tremorhub.com/	1970-01-21 04:31:12	Name: tvid Value: 2f862400951f428b834bb226e5540a38
.tremorhub.com/	1970-01-21 05:21:15	Name: tv_UIDM Value: e96a44a6-f5ee-4b88-9b94-a022e11dbb5b
.deepinstinct.com/	1970-01-21 00:04:27	Name: __hstc Value: 160033954.99e396ba8d65b2ab523669eb91963867.1712715237273.1712715237273.1712715237273.1
.deepinstinct.com/	1970-01-21 00:04:27	Name: hubspotutk Value: 99e396ba8d65b2ab523669eb91963867
.deepinstinct.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.deepinstinct.com/	1970-01-20 19:45:17	Name: __hssc Value: 160033954.1.1712715237273
.hubspot.com/	1970-01-20 19:45:17	Name: __cf_bm Value: mPutJwgsomojtUHnRoTssyGkPatP.POcqscpppOY09w-1712715237-1.0.1.1-w_Ic6W8qyys77hBiMZD8tUvYZm6yCNH_d8a19J6msjWzM1Yc_8Lv9Ebm_QURONuHDbYiQZxQxeDx6kYBlJm9.g
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: zf_cX9ah344wG4ee0sobHLNzMXYonsvJGGQaO2.DQVc-1712715237426-0.0.1.1-604800000

62 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/468591697375107?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
api.company-target.com
api.hubapi.com
app.qualified.com
bat.bing.com
cc.swiftype.com
cdn.bizible.com
cdn.bizibly.com
connect.facebook.net
content.hotjar.io
forms.hubspot.com
ibc-flow.techtarget.com
id.rlcdn.com
images.contentstack.io
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsleadflows.net
js.qualified.com
p.typekit.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.company-target.com
s.swiftypecdn.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
use.typekit.net
www.deepinstinct.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleoptimize.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
104.244.42.5
104.244.42.67
13.107.42.14
142.250.185.110
142.250.186.35
146.75.120.157
151.101.129.167
151.101.2.137
152.195.15.58
157.240.252.13
169.63.31.200
172.217.18.4
18.173.154.87
18.173.187.83
18.66.102.53
2001:4860:4802:32::36
216.58.206.72
2600:9000:237d:8600:1d:8d6d:3b40:93a1
2606:4700:4400::6812:24c4
2606:4700:4400::ac40:991b
2606:4700::6810:4dba
2606:4700::6810:7574
2606:4700::6810:89d1
2606:4700::6811:e7a3
2606:4700::6812:1005
2606:4700::6812:8b11
2606:4700::6812:f26c
2620:1ec:21::14
2620:1ec:c11::237
2a00:1450:4001:803::200e
2a00:1450:4001:81d::2003
2a00:1450:4001:828::2008
2a00:1450:4001:828::200e
2a00:1450:400c:c00::9a
2a02:26f0:3500:16::215:148d
2a02:26f0:3500:16::215:1495
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a05:d014:275:cb01::c8
34.111.208.231
34.246.205.163
34.96.71.22
35.171.141.234
35.244.174.68
99.84.88.115
0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8
05e0bd8cf7d2075f2758c6a75758d56c0528b119bd8560f9a72d40756575faa7
09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6
1109065bd46b1735c772ed9dde2e8e5153311eef14c8200e67fca8cebce8e184
140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1
16e0a1ac3dea27133d477a9ef9bc0105b3b6452ff6c1fd5aae0dff8daca31583
1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260
1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501
2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241
2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724
338bb102cb02ea5d873ff1df529cab30c5b8c52992cd089c20134d2d692bda69
3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df
3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429
3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e
3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd
3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018
3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee
3de1321dac18d5ef788ccc3b485fc44a253733c89f69d92df7c6b2b6b2fb65bb
4339aa2a30dddab3c704be71663ec8ed8c9bfbeb79748cf5b507f625632c0f13
488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a
4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96
4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04
4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc
50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360
529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14
5334886e325d68dc18a3e8c9f406b6acbac0c6014366586345dcb3f1bc1c40ef
547e38cee489f1d5390acfb819cf153b04c87d0d5a19bec0a5924d5d0120ae63
5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc
5ba9029b7eec68c9a93e1004eab9167875741873f1e2d801164e6ab9e3ef3461
5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b
5f9fac8d51134fcba0174a1c8d00d921b09bcfa2159cab80c016d9c0c0e8453c
6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6
6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8
64e61d41f7b5951150d282f71796a52f304e2280002f466df61fc89e44e85e3c
66e9a17c05981ae02d122a6845f9f904f13edeae0973af6fdbc44bb77ee5bbf0
67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356
6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
723118031279b31991091fc6ee32db023b9961b923b4f0a3ea4cbcb6766279e7
7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89973ccfb4b15890115d7c461e836f841a377e057d011416fd797b8602ae8eb7
8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469
8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5
8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d
8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6
8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7
8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a
94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc
9868c23a7f08f3b18037fb675b583d8ffcd971ff2247fb9004abe43b8aa4eb90
9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296
9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746
9fa0395c7d91df251b50d8dec4347ac7b0e8860316764832c1342fe249001fc6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acfb6774d0de7956f44fd713fcd31ef4b13d1fa6cd14f5451f66f3295dd6a309
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
ba987ce07e5a8c926d739f6d02705a26c9fdaf25deaf8e1cb0ffff667986b609
bda2cf571d7ea45f68afcdc87f968090dbf4bbdec2c7d6d19ce591b3980c296f
c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc
c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f
c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464
c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e
c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc12cebef16af2c60e6c11cc466d9d9870881e36d9bd9032eac325d27779824a
dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4c3f2f93bb46fbbe1393eee90b5e6fda04011704c567a03eb20e07f249ba295
e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20
ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d
efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a
f2a52b7603b7a0e0b383000bbda36c681a9ff2b54495c4f290fb89fb7b9487f7
f3e455aab43c84d676775111c19d7998853e5ace9a6271e41462c8c8a15c018a
f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991
f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447
fa8cabe3021c19ba54e07d28a7722cd4bfdef39dea07207518113f7e161166bb
fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7
fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

www.deepinstinct.com Open in urlscan Pro 2a05:d014:275:cb01::c8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

124 Requests

98 %HTTPS

51 %IPv6

36 Domains

46 Subdomains

46 IPs

4 Countries

2504 kBTransfer

6892 kBSize

41 Cookies

40 Outgoing links

Redirected requests

124 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.deepinstinct.com Open in urlscan Pro
2a05:d014:275:cb01::c8 Public Scan

Screenshot
Live screenshot

Full Image

124
Requests

98 %
HTTPS

51 %
IPv6

36
Domains

46
Subdomains

46
IPs

4
Countries

2504 kB
Transfer

6892 kB
Size

41
Cookies

124 HTTP transactions
0 data transactions