de.vectra.ai Open in urlscan Pro
2606:4700:4400::6812:2866 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://de.vectra.ai/threat-actors/blacksuit#mitre-mapping
Effective URL:
https://de.vectra.ai/threat-actors/blacksuit
Submission: On August 12 via manual (August 12th 2024, 10:10:18 am UTC) from DE — Scanned from DE

Summary HTTP 101 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 51 IPs in 6 countries across 40 domains to perform 101 HTTP transactions. The main IP is 2606:4700:4400::6812:2866, located in United States and belongs to CLOUDFLARENET, US. The main domain is de.vectra.ai.
TLS certificate: Issued by E5 on June 16th 2024. Valid for: 3 months.

This is the only time de.vectra.ai was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:440... 2606:4700:4400::6812:2866	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	2606:4700::68... 2606:4700::6812:1ccb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.185.171.14 146.185.171.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	52.222.232.47 52.222.232.47	16509 (AMAZON-02) (AMAZON-02)
3	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
10	2606:4700::68... 2606:4700::6812:620	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
2	2600:9000:223... 2600:9000:223e:ae00:1d:7a82:2900:93a1	16509 (AMAZON-02) (AMAZON-02)
1	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2600:9000:235... 2600:9000:235a:5800:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:15::213:7e63	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:8ad1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	18.66.102.51 18.66.102.51	16509 (AMAZON-02) (AMAZON-02)
1 2	54.186.117.241 54.186.117.241	16509 (AMAZON-02) (AMAZON-02)
1	18.239.36.63 18.239.36.63	16509 (AMAZON-02) (AMAZON-02)
1	52.0.218.89 52.0.218.89	14618 (AMAZON-AES) (AMAZON-AES)
2 3	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:206... 2600:9000:206f:e400:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	54.237.133.81 54.237.133.81	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.33.187.109 13.33.187.109	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:a0a8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:df98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:17b7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:1ec:51::12 2620:1ec:51::12	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	52.215.135.129 52.215.135.129	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:f16c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:50cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.18.37.212 104.18.37.212	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	95.85.9.7 95.85.9.7	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700::68... 2606:4700::6810:762b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:752b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:211... 2600:9000:211e:200:4:8491:f2c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.172.103.101 18.172.103.101	16509 (AMAZON-02) (AMAZON-02)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
4 5	34.198.174.254 34.198.174.254	14618 (AMAZON-AES) (AMAZON-AES)
3 3	34.36.216.150 34.36.216.150	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	34.206.125.101 34.206.125.101	14618 (AMAZON-AES) (AMAZON-AES)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
101	51

1 2606:4700:4400::6812:2866 (United States)

ASN13335 (CLOUDFLARENET, US)

de.vectra.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6812:1ccb (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.prod.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.185.171.14 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

cdn.cookie-script.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.232.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-232-47.fra56.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6812:620 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223e:ae00:1d:7a82:2900:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.jetboost.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:235a:5800:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:15::213:7e63 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8ad1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-51.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.186.117.241 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-186-117-241.us-west-2.compute.amazonaws.com

www.storygize.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.36.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-36-63.ams58.r.cloudfront.net

assets.storygize.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.0.218.89 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-218-89.compute-1.amazonaws.com

px.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.180 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:e400:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.237.133.81 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-133-81.compute-1.amazonaws.com

api.jetboost.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

pixel-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.187.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-109.fra60.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a0a8 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:df98 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:17b7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:51::12 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.215.135.129 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-135-129.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:f16c (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:50cc (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.37.212 (None, )

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.85.9.7 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

consent.cookie-script.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:762b (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:752b (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:200:4:8491:f2c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.172.103.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-103-101.fra60.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.198.174.254 (Ashburn, United States) 4 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-198-174-254.compute-1.amazonaws.com

aorta.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.36.216.150 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 150.216.36.34.bc.googleusercontent.com

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.125.101 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-125-101.compute-1.amazonaws.com

hemsync.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	website-files.com cdn.prod.website-files.com — Cisco Umbrella Rank: 11800 assets.website-files.com — Cisco Umbrella Rank: 22240	920 KB
10	weglot.com cdn.weglot.com — Cisco Umbrella Rank: 20729 api.weglot.com — Cisco Umbrella Rank: 55127	104 KB
7	clickagy.com 4 redirects tags.clickagy.com — Cisco Umbrella Rank: 59903 aorta.clickagy.com — Cisco Umbrella Rank: 3393 hemsync.clickagy.com — Cisco Umbrella Rank: 52988	30 KB
5	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 34577 ws.zoominfo.com — Cisco Umbrella Rank: 10891	30 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	479 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 669 px4.ads.linkedin.com — Cisco Umbrella Rank: 7330	3 KB
3	sitescout.com 3 redirects pixel-sync.sitescout.com — Cisco Umbrella Rank: 1117	701 B
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 15834	4 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 8139 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 8074 track.hubspot.com — Cisco Umbrella Rank: 5359	26 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3773 google.com — Cisco Umbrella Rank: 1	17 B
3	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 764	3 KB
3	storygize.net 1 redirects www.storygize.net — Cisco Umbrella Rank: 10018 assets.storygize.net — Cisco Umbrella Rank: 86815	28 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 17231	26 KB
3	jetboost.io cdn.jetboost.io — Cisco Umbrella Rank: 98800 api.jetboost.io — Cisco Umbrella Rank: 260332	50 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	18 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 2631 insight.adsrvr.org — Cisco Umbrella Rank: 1486	5 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	73 KB
2	reddit.com pixel-config.reddit.com — Cisco Umbrella Rank: 3241 alb.reddit.com — Cisco Umbrella Rank: 1969	761 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 252 cm.g.doubleclick.net — Cisco Umbrella Rank: 363	651 B
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 1335 script.hotjar.com — Cisco Umbrella Rank: 2017	60 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1561	13 KB
2	cookie-script.com cdn.cookie-script.com — Cisco Umbrella Rank: 33944 consent.cookie-script.com — Cisco Umbrella Rank: 60386	60 KB
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 864	295 B
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 8524	1 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 7580	1 KB
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 8904	171 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 26454	204 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5067	26 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 7189	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5135	25 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6716	63 B
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 48041	279 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 42102	278 B
1	adentifi.com px.adentifi.com — Cisco Umbrella Rank: 16060	35 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5414	1 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1884	14 KB
1	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 4988	1 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	31 KB
1	vectra.ai de.vectra.ai	39 KB
101	40

	Domain	Requested by
17	cdn.prod.website-files.com	de.vectra.ai cdn.prod.website-files.com
9	cdn.weglot.com	de.vectra.ai cdn.weglot.com
5	aorta.clickagy.com	4 redirects cdn.bizible.com
5	www.googletagmanager.com	de.vectra.ai www.googletagmanager.com js.hsadspixel.net
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
4	assets.website-files.com	cdn.prod.website-files.com
3	pixel-sync.sitescout.com	3 redirects
3	js.zi-scripts.com	de.vectra.ai js.zi-scripts.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com cdn.bizible.com
3	secure.adnxs.com	2 redirects de.vectra.ai
3	cdn.bizible.com	www.googletagmanager.com de.vectra.ai cdn.bizible.com
3	cdn.jsdelivr.net	de.vectra.ai
2	www.facebook.com
2	connect.facebook.net	js.hsadspixel.net connect.facebook.net
2	google.com	www.googletagmanager.com
2	www.storygize.net	1 redirects www.storygize.net
2	www.redditstatic.com	www.googletagmanager.com www.redditstatic.com
2	cdn.jetboost.io	de.vectra.ai cdn.jetboost.io
1	us-u.openx.net
1	hemsync.clickagy.com	cdn.bizible.com
1	cm.g.doubleclick.net
1	insight.adsrvr.org	js.adsrvr.org
1	js.adsrvr.org	de.vectra.ai
1	tags.clickagy.com	de.vectra.ai
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	consent.cookie-script.com	cdn.bizible.com
1	track.hubspot.com
1	perf-na1.hsforms.com	de.vectra.ai
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	api.hubapi.com	cdn.bizible.com
1	content.hotjar.io	cdn.bizible.com
1	px4.ads.linkedin.com	de.vectra.ai
1	cdn.bizibly.com	de.vectra.ai
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	script.hotjar.com	static.hotjar.com
1	alb.reddit.com	de.vectra.ai
1	pixel-config.reddit.com	www.redditstatic.com
1	api.jetboost.io	cdn.jetboost.io
1	api.weglot.com	cdn.weglot.com
1	www.google.de	de.vectra.ai
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	attr.ml-api.io	de.vectra.ai
1	s.ml-attr.com	1 redirects
1	px.adentifi.com	de.vectra.ai
1	assets.storygize.net	de.vectra.ai
1	static.hotjar.com	de.vectra.ai
1	js.hs-scripts.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	dev.visualwebsiteoptimizer.com	de.vectra.ai
1	d3e54v103j8qbb.cloudfront.net	de.vectra.ai
1	cdn.cookie-script.com	de.vectra.ai
1	de.vectra.ai
101	56

This site contains links to these domains. Also see Links.

Domain
www.vectra.ai
support.vectra.ai
partners.vectra.ai
www.orangecyberdefense.com
socradar.io
ransomware.live
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
www.instagram.com
www.reddit.com
github.com
trust.vectra.ai
fr.vectra.ai
ja.vectra.ai
es.vectra.ai
it.vectra.ai
tr.vectra.ai

Subject Issuer	Validity	Valid
de.vectra.ai E5	`2024-06-16` - `2024-09-14`	3 months	crt.sh
prod.website-files.com WE1	`2024-06-25` - `2024-09-23`	3 months	crt.sh
*.cookie-script.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-17` - `2025-08-17`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
cdn.weglot.com WE1	`2024-07-01` - `2024-09-29`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
cdn.jetboost.io Amazon RSA 2048 M02	`2024-03-20` - `2025-04-18`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.website-files.com Amazon RSA 2048 M02	`2024-08-10` - `2025-09-07`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-23` - `2024-11-18`	6 months	crt.sh
hs-scripts.com WE1	`2024-07-29` - `2024-10-27`	3 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-07` - `2025-07-08`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
adentifi.com Amazon RSA 2048 M02	`2024-06-05` - `2025-07-03`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.google.de WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
api.weglot.com WE1	`2024-07-01` - `2024-09-29`	3 months	crt.sh
api.jetboost.io R11	`2024-07-22` - `2024-10-20`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-05-30` - `2024-11-26`	6 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-07-01` - `2025-01-01`	6 months	crt.sh
hs-analytics.net WE1	`2024-08-09` - `2024-11-07`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hsadspixel.net WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh
hs-banner.com WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
*.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
hubapi.com E6	`2024-07-02` - `2024-09-30`	3 months	crt.sh
*.storygize.net Amazon RSA 2048 M02	`2024-02-05` - `2025-03-04`	a year	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
zi-scripts.com WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-05-21` - `2024-08-19`	3 months	crt.sh
zoominfo.com E5	`2024-07-18` - `2024-10-16`	3 months	crt.sh
*.clickagy.com Amazon ECDSA 256 M02	`2023-09-22` - `2024-10-20`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://de.vectra.ai/threat-actors/blacksuit
Frame ID: 2DABC09736D8DEDAE4427605E2207452
Requests: 103 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=yphb7o4&ref=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&upid=mommfm8&upv=1.1.0
Frame ID: 82E86F3D2BE594A93419FCB6544E3C42
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Weglot (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

cdn\.weglot\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

101
Requests

93 %
HTTPS

54 %
IPv6

40
Domains

56
Subdomains

51
IPs

6
Countries

2075 kB
Transfer

5787 kB
Size

21
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://www.vectra.ai/meet/maad-af
Title: Decken Sie Lücken in Ihrer Microsoft Identity Security auf. Buchen Sie noch heute eine Analyse der Identitätslücke.

Search URL Search Domain Scan URL

URL: https://support.vectra.ai/s/topic/0TO6S000000J74tWAC/cognito-support
Title: Wissenszentrum

Search URL Search Domain Scan URL

URL: https://support.vectra.ai/s/topic/0TO6S000000J745WAC/product-announcements
Title: Produktfreigaben

Search URL Search Domain Scan URL

URL: https://www.vectra.ai/webinars/maximizing-security-with-vectra-mxdr-vectra-ai-platform-and-edr-technology
Title: Jetzt anmelden

Search URL Search Domain Scan URL

URL: https://support.vectra.ai/s/login/
Title: Kunden-Login

Search URL Search Domain Scan URL

URL: https://www.vectra.ai/tours/demo-platform
Title: Machen Sie die interaktive Tour

Search URL Search Domain Scan URL

URL: https://partners.vectra.ai/Login
Title: Anmeldung zum Partnerportal

Search URL Search Domain Scan URL

URL: https://support.vectra.ai/
Title: Unterstützung

Search URL Search Domain Scan URL

URL: https://www.orangecyberdefense.com/
Title: OCD

Search URL Search Domain Scan URL

URL: https://socradar.io/dark-web-profile-blacksuit-ransomware/
Title: SOCradar

Search URL Search Domain Scan URL

URL: https://ransomware.live/
Title: ransomware.live

Search URL Search Domain Scan URL

URL: https://www.vectra.ai/resources/attack-exposure-gap-analysis-where-attackers-expose-beyond-edr-and-firewall-controls
Title: Bewerten Sie Ihr Angriffsrisiko

Search URL Search Domain Scan URL

URL: https://partners.vectra.ai/BecomeAPartner
Title: Partner werden

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/vectra_ai/

Search URL Search Domain Scan URL

URL: https://twitter.com/vectra_ai

Search URL Search Domain Scan URL

URL: https://www.facebook.com/VectraAI/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/VectraAI

Search URL Search Domain Scan URL

URL: https://www.instagram.com/vectra_ai/

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/VectraAI/

Search URL Search Domain Scan URL

URL: https://github.com/vectranetworks

Search URL Search Domain Scan URL

URL: https://trust.vectra.ai/
Title: Trust Center

Search URL Search Domain Scan URL

URL: https://www.vectra.ai/threat-actors/blacksuit
Title: English

Search URL Search Domain Scan URL

URL: https://fr.vectra.ai/threat-actors/blacksuit
Title: Français

Search URL Search Domain Scan URL

URL: https://ja.vectra.ai/threat-actors/blacksuit
Title: 日本語

Search URL Search Domain Scan URL

URL: https://es.vectra.ai/threat-actors/blacksuit
Title: Español

Search URL Search Domain Scan URL

URL: https://it.vectra.ai/threat-actors/blacksuit
Title: Italiano

Search URL Search Domain Scan URL

URL: https://tr.vectra.ai/threat-actors/blacksuit
Title: Türkçe

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

https://www.storygize.net/u/events.js HTTP 302
https://assets.storygize.net/engagement/28858/universal.min.js

Request Chain 38

https://secure.adnxs.com/seg?t=2&add=37642418 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D37642418

Request Chain 39

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.vectra.ai%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.vectra.ai%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=www.vectra.ai&pId=2564410184532697727

Request Chain 59

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2&e_ipv6=AQLwFraE7pugoQAAAZFGERtZTVPm01gST5ppiOaoxC1dLO7ERTk5ad3GVFgllnMvitZCyDYT_QPVhZqfl4oO4qwxUSXAKg

Request Chain 103

https://aorta.clickagy.com/pixel.gif?clkgypv=jstag&ws=1 HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?cookieQ=1&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=28af76ae-4a54-4b62-bf43-b8c29c2a443c-66b9df86-5553 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzowNjRmM2E5YmE3ZDAwOTFkZjhkMzE4ZDhhYmQ1OTU5YQ

Request Chain 105

https://aorta.clickagy.com/pixel.gif?cs=33:-1,37:1,43:-1,44:-1,47:-1,48:-1,52:1,38:1,53:1&fp=046a174cc483ee5bc2ccf4cce88ae634&u=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&ch=278 HTTP 302
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=28af76ae-4a54-4b62-bf43-b8c29c2a443c-66b9df86-5553 HTTP 302
https://us-u.openx.net/w/1.0/cm?id=af408286-42f3-4d1c-bb48-10bd86dbcd66&r=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fch%3D4%26cm%3D%7BOPENX_ID%7D%26redir%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537073026%2526val%253D%257Bvisitor_id%257D

101 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request blacksuit Show response
de.vectra.ai/threat-actors/ 238 KB
39 KB 943ms
818ms Document
text/html 2606:4700:4400::6812:2866
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2866 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bafed2167303a5db23f3c0f31e47919acd94d3edcc2ef276dafe753bd1c0bb60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

age: 226440
cf-cache-status: DYNAMIC
cf-ray: 8b1fac8c68aa3665-FRA
content-encoding: br
content-language: de
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Mon, 12 Aug 2024 10:10:10 GMT
link: <https://de.vectra.ai/threat-actors/blacksuit>; rel="canonical"
processed-by: Weglot
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,x-wf-forwarded-proto
weglot: id.8b1fac8c68aa3665, p.cf
weglot-translated: true
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-cluster-name: eu-west-1-prod-hosting-red
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-lambda-id: f80c02a2-884d-4a2e-ac6c-d735805c7c7b
x-served-by: cache-iad-kjyo7100155-IAD, cache-dub4339-DUB
x-timer: S1723457410.219291,VS0,VE1
x-xss-protection: 1; mode=block

GET
H3 200 vectra-project.5ef5f7a62.min.css
cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/ 401 KB
65 KB 186ms
116ms Stylesheet
text/css 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bd3981d2aa91f7e78a402853a2488b980c299481887025b86d25a469693266e

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:10 GMT
content-encoding: gzip
x-amz-version-id: .94ESeyNM.1cQr_PvIjXxpZB5OuvpJLN
cf-cache-status: HIT
x-amz-request-id: 7TWNKVFR7N22Q280
age: 234028
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 65859
x-amz-id-2: KfJ5qnwOHGwvewoZlRAmx2ZZieuz8CI9IHuByEjxwdImqnRWJ4IPCakl3q4hWpCt6lOBB9/PFQk=
last-modified: Fri, 09 Aug 2024 17:06:18 GMT
server: cloudflare
etag: "f086f313f6bf70d53adabf1b8ecf29a1"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
cf-ray: 8b1fac921fb56ae6-FRA

GET
H2 200 bc9a5854c8f924860cb36995bf5d6172.js Show response
cdn.cookie-script.com/s/ 347 KB
60 KB 185ms
54ms Script
application/javascript 146.185.171.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cookie-script.com/s/bc9a5854c8f924860cb36995bf5d6172.js
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 146.185.171.14 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 463eb7e3abda6a5dce995d42748ec6666ab8b0776e41ce4e5c29247f7068bcc4

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:10 GMT
content-encoding: gzip
last-modified: Thu, 27 Jun 2024 12:54:52 GMT
server: nginx/1.18.0 (Ubuntu)
etag: W/"fde64fe6379bf45bddb2946f2772762b"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *

GET
H3 200 6617cad44b02c569217e4305_Initial-access-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 30 KB
30 KB 143ms
73ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cad44b02c569217e4305_Initial-access-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b491cdb24890e79228ef659d0fb6bb612c93bab6d004cc823905f2763d42085

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:10 GMT
x-amz-version-id: HVdIk7oVCKkuhLYdyN6a4XjlXfJhyKhY
cf-cache-status: HIT
x-amz-request-id: 2E74XT6R5YADADRC
age: 61126
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 30460
x-amz-id-2: /LRDuc89ddJw8+CTf5i058ONWfq5l9UuHtGN+YMZjlVXFkKZLEhVeizm2RsDKJNOy9xJN5dL0MQ=
last-modified: Fri, 02 Aug 2024 12:43:56 GMT
server: cloudflare
etag: "f11c4a89a7db808160a1d68211e91ba8"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac921fb16ae6-FRA

GET
H3 200 6617cb07b733c36cb2afdcba_privilege-escalation-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 25 KB
26 KB 115ms
46ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cb07b733c36cb2afdcba_privilege-escalation-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2c7f7f28e200266b5b82328e54f4b22fa88829fb6990f0821058442737d2cb2

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:10 GMT
x-amz-version-id: G0Wmyf1H3loWsjybN056TK3iIxssc1b7
cf-cache-status: HIT
x-amz-request-id: 2E75JPZYX60C4XYP
age: 61126
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 25987
x-amz-id-2: Phjo7Ymr1g8mPJoSQ0GKIxR5aQJYVzS4+zI4HKKr8vvuZplLdhJrg5fSfsgS930c8VUaMuz5XGs=
last-modified: Fri, 02 Aug 2024 12:43:57 GMT
server: cloudflare
etag: "98657f1dc2b90cc728be808c99c57498"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac921fb46ae6-FRA

GET
H3 200 6617cb30268f32c642c5a646_defense-evasion-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 35 KB
35 KB 102ms
99ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cb30268f32c642c5a646_defense-evasion-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c331cb393bb1d60883780386b457f367e75652e50858f19f469501ff5c274294

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: 37QrsxWJNB8yAF9OPVvNKvJzkW61vOzS
cf-cache-status: HIT
x-amz-request-id: 2E72D7JT1W0D9CPJ
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 35727
x-amz-id-2: GAWUkyfZ1SaLHHZFtM+1Z9Y3er+f8BhFA6eekbayawihEIO6GyKypGT01ct2xu2N8aAu6mj4jWY=
last-modified: Fri, 02 Aug 2024 12:43:57 GMT
server: cloudflare
etag: "b40bd92a653c9fe8d8367937bc35ad2f"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac92f8cf6ae6-FRA

GET
H3 200 6617cb6687feb878fdb74d39_credential-access-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 31 KB
32 KB 78ms
75ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cb6687feb878fdb74d39_credential-access-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90394dd8d123b5fb3ba9bca60d862d64fcd964d12fae1e367789e9c824aa009d

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: ye4M11AcqaCFhFRTSoc_E_QaqltN7Mn.
cf-cache-status: HIT
x-amz-request-id: 2E72GJ5KV42GSVZM
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 32027
x-amz-id-2: Y624vrFRRYEPu/h9wVPe7js6cc6MlXkCYSDRqoPgTZem4D7jEJ/haVyu/MVrvusIpdWQMNo8CH8=
last-modified: Fri, 02 Aug 2024 12:43:57 GMT
server: cloudflare
etag: "6e1a67903976fafe8861481088c6b624"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac9319116ae6-FRA

GET
H3 200 6617cb9fe25d961749d81e21_discovery-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 46 KB
46 KB 51ms
48ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cb9fe25d961749d81e21_discovery-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e3e5b31023c7006e73fc1ba2be93fb1a072e38e60281d8a6523318434d67c21

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: 6wNOYIVP4bzphN7qlOlfMHZvMpjgpnRa
cf-cache-status: HIT
x-amz-request-id: 2E7A94TPD2QVJFHQ
age: 61127
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 46877
x-amz-id-2: yERuk/94BFw7Nz/cQOHqdcTJS6etLqeUXCQAMHbBP56omLyGAG2xdaOEwf2PEfQd6/2e3MyCjZA=
last-modified: Fri, 02 Aug 2024 12:43:57 GMT
server: cloudflare
etag: "407467a9d6f1246b50d2fbf8979fc8b3"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac93698f6ae6-FRA

GET
H3 200 6617cbc81626e53a24ee0461_lateral-movement-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 44 KB
44 KB 85ms
82ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cbc81626e53a24ee0461_lateral-movement-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6b6686c2925f60b319f2c96ac848d3fa8bc5772d6ec2d599e3b69e88aa26c73

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: aoyrJsbQSv6RLSUN74_jMVDniK.Flxcr
cf-cache-status: HIT
x-amz-request-id: V4NSK17ZSAFXETF0
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 45121
x-amz-id-2: x59YQ04OB3gO9dtDKqj9SgUaYFAk4CJoemlIkzgO9gcOVLPx/BUANVtn6d4ZDhGucmx3K7kUGJI=
last-modified: Fri, 02 Aug 2024 12:43:57 GMT
server: cloudflare
etag: "ee570375d2261242fb27d8f6d0dad232"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac9369956ae6-FRA

GET
H3 200 6617cbfc960ce659d4a91dc5_collection-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 37 KB
37 KB 52ms
49ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cbfc960ce659d4a91dc5_collection-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cbbe6676a19feecc315d701be98ffef0a470187d2c7f48e7f5b65ef78aa23c1

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: Dq0pUGLPlYctsOtr.KCBxoQAGvQg3Dft
cf-cache-status: HIT
x-amz-request-id: DNF2G3Z3MQEDPBVZ
age: 61127
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 37850
x-amz-id-2: qwKCnR9ZSHRfiCinnTeqSIJXC16SRM9sx0gdH/PMctCgp7VG5YGSSZBVKCV3A8GNnUuYzXS3SIVQduM8I5PgZakH+quN8J85Ohw/7iQmUcI=
last-modified: Fri, 02 Aug 2024 12:43:58 GMT
server: cloudflare
etag: "fc212f07ff2f41453a658d9070da4ce2"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac9369986ae6-FRA

GET
H3 200 6617cc2645d432b8e7918372_execution-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 27 KB
28 KB 88ms
86ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cc2645d432b8e7918372_execution-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cab4db5a77565548256c860f0c7e2c0ea06283c64d6c0873eddf042535b4d04

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: zNlS9.7.XtduRuYEUT6iCZO16ZGowjc.
cf-cache-status: HIT
x-amz-request-id: DNF2F4QCTPHD9BZP
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 27905
x-amz-id-2: kH6vmEM40qoDlggBrXJ1O38sOPB/viozQW7AG/Yt6vayFWVxtpM68XSWEULYo2nkFEbTVprB2bk=
last-modified: Fri, 02 Aug 2024 12:43:58 GMT
server: cloudflare
etag: "e517b1a7ae3175459c98495255a29751"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac93699b6ae6-FRA

GET
H3 200 6617cc50eae6a3450a18440b_exfiltration-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 29 KB
30 KB 90ms
88ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cc50eae6a3450a18440b_exfiltration-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83cf08660de339dfb5120203c5ef09db9d6ade4cce398bc54d99bc587f05afee

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: Y2reAoIBaGG31U6Zmc3kC8gV5EjbOTjO
cf-cache-status: HIT
x-amz-request-id: DNF5NVP7NXEYHM32
age: 15123
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 30056
x-amz-id-2: zNmalePZcOuAHQDp1iTowGVKWobSQaX5lVkcnDqhj1s3C1rsy3N1KYLYylPXM0q53tmYfwscdZApwyHwETnBqXC0Xa+PoXtp
last-modified: Fri, 02 Aug 2024 12:43:58 GMT
server: cloudflare
etag: "2ce2bfb4abd0936e599fc744e52faad7"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac93699e6ae6-FRA

GET
H3 200 6617cc7a89e7fc81005a42c4_impact-light.avif
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 23 KB
23 KB 91ms
90ms Image
image/avif 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6617cc7a89e7fc81005a42c4_impact-light.avif
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef39bd0a71c2b42b5f7ee0138610aa384b1af3417ca2b0335140caccc51857be

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: nFqWjugm8L_pRwlM7bEIv2K12tJzUKZr
cf-cache-status: HIT
x-amz-request-id: DNFEQE1WWXEFFVYS
age: 61127
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 23373
x-amz-id-2: 21VrcTLCdRX+sYLypW3LLwUIGRMyGoI2eu7HyesLQ2a09Et4U+vRcjwpD5gChv2g0/9s8aReHTU=
last-modified: Fri, 02 Aug 2024 12:43:58 GMT
server: cloudflare
etag: "7d5ec5ccb2a047245881b64ee75aa93e"
vary: Accept-Encoding
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac9369a16ae6-FRA

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
31 KB 188ms
25ms Script
application/javascript 52.222.232.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64e36a72d57403710ee5415d
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.232.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-232-47.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://de.vectra.ai/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 03:23:43 GMT
content-encoding: gzip
via: 1.1 82386e4e4f56a0c01411d1aea6f3fd46.cloudfront.net (CloudFront)
age: 24389
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: SKN5KrI4g5q5RoG02cvdh0QczyVeSYULrJnYbfs3R8NLN3_sKdDLfw==

GET
H3 200 vectra-project.23499ca4f.js Show response
cdn.prod.website-files.com/64e36a72d57403710ee5415d/js/ 863 KB
189 KB 41ms
38ms Script
text/javascript 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/js/vectra-project.23499ca4f.js
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fde6213c4a18069057c21817e8d7dc4f60f3593cb2bb82138c3535286558ad5

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
x-amz-version-id: BGSnZy1Hdj03JtqIfPlk1Ccm92zEqdui
cf-cache-status: HIT
x-amz-request-id: Z7HSHJR86991T3Z8
age: 247163
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 193161
x-amz-id-2: AYwgjcah/Tqc4UzBy5lT8YQ4sVdY3MvKBWV0ZKiwNtX+6lDOZ3vcDLDffB8AyTMWUzMOZuV+UcJTpbEb8MjLrA==
last-modified: Fri, 09 Aug 2024 13:28:40 GMT
server: cloudflare
etag: "55ce95b05ca8d5a81fd14891c75ed5c8"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
cf-ray: 8b1fac9369926ae6-FRA

GET
H2 200 splide.min.js Show response
cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/ 29 KB
13 KB 133ms
44ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/splide.min.js

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

159b16ec7d95e57f531a29d28e3c18278d7d5e46b6ec8f173c3996af21a55adc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Aug 2024 10:10:11 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1042061
x-jsd-version: 4.1.4
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 13512
x-served-by: cache-fra-etou8220058-FRA
x-jsd-version-type: version
etag: W/"746b-2972YX1vt/FBmWw6HVrvIC6t+Gc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 splide-extension-auto-scroll.min.js Show response
cdn.jsdelivr.net/npm/@splidejs/splide-extension-auto-scroll@0.5.3/dist/js/ 5 KB
3 KB 132ms
44ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@splidejs/splide-extension-auto-scroll@0.5.3/dist/js/splide-extension-auto-scroll.min.js

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

03eda8a72aa1bdb055f2d6ddf6620cf30f73bef3181ce6b0634dc1411b6aecac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Aug 2024 10:10:11 GMT
x-content-type-options: nosniff
content-encoding: br
age: 380093
x-jsd-version: 0.5.3
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2595
x-served-by: cache-fra-etou8220058-FRA
x-jsd-version-type: version
etag: W/"15d3-zI4qfACOkW7eXUrpiCll5O5jpLk"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 splide.min.css
cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/css/ 5 KB
1 KB 132ms
44ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/css/splide.min.css

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e6e2a25c4c1b69087d720776ff9569e9698c9ec52bdd5659c346bcaca9ce28d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Aug 2024 10:10:11 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1579217
x-jsd-version: 4.1.4
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1383
x-served-by: cache-fra-etou8220058-FRA
x-jsd-version-type: version
etag: W/"138a-nCVqx5aWVkM0NV+MS4SFkGd/1YM"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 weglot.min.js Show response
cdn.weglot.com/ 132 KB
46 KB 118ms
48ms Script
application/javascript 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.weglot.com/weglot.min.js

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e7d7ee23e93df530d8d5815c6c7690458f580471ac49a5913e82c3daa8a9da2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 0c371064bf157d89e4b3520c0b29474c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 250
x-cache: RefreshHit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 31 Jul 2024 10:08:51 GMT
server: cloudflare
etag: W/"c8c9d4d6a27b3f59ee0a8860b48a5614"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
cf-ray: 8b1fac93cf126993-FRA
x-amz-cf-id: K0fhUEDdzIYF_h__mbNk1Ho5xjTsr_QVZI8Ov2JLsmngE3GJgZK2nQ==
expires: Mon, 12 Aug 2024 10:40:11 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 332 KB
108 KB 143ms
56ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e614e41cc0790ea8e7b93d6796ba9ff6e171dc575e84a01f3fe68fabb2d8e128

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109763
x-xss-protection: 0
last-modified: Mon, 12 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Aug 2024 10:10:11 GMT

GET
H2 200 jetboost.js Show response
cdn.jetboost.io/ 12 KB
4 KB 392ms
23ms Script
text/javascript 2600:9000:223e:ae00:1d:7a82:2900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jetboost.io/jetboost.js
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:ae00:1d:7a82:2900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a3cb8e70dfe503b8cd036761a7490fff86becc902600b63fc13bfd1aa8100e8

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 07:01:11 GMT
content-encoding: gzip
via: 1.1 c9499008aa7e1acd11e9fbc171281d82.cloudfront.net (CloudFront)
last-modified: Tue, 25 Jun 2024 21:15:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 13064
x-amz-server-side-encryption: AES256
etag: W/"90f20e8472ce5be54d6aec168f3aa8cd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=86400
x-amz-cf-id: vel7XnKxiLh79ndBW8kwHbgVrFHTTczJv0EnCaKZg9Hst7tsugitBg==

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 2 KB
1 KB 170ms
23ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=813272&u=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&vn=2
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 87bb5f9c9c8673b1e3df5e078a1bc2e1e4c663741772754f1f1d159a13b5666d

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 google
server: gfra1
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 64f27355b7904cbd143e9619_bottom-right-desktop.svg
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 2 KB
1 KB 90ms
89ms Image
image/svg+xml 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/64f27355b7904cbd143e9619_bottom-right-desktop.svg
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aea73c341c4a179fca2fa31b1c08909155ee353d85d0f225abb60e14b4e562b2

Request headers

Referer: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: vvUUfJ1fjtLhKgU0YFQZbqsZvzFZPIs6
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 1PAG5KXX561CEYKD
age: 6371886
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Z3NXafc5NihHMA1o7YKMlPhI9XE0Z3tpOBHBLZpdJQGa58GXZo+9kkvBOInF8ajwBnu9f+Z73qVRVyBwdDB2jg==
last-modified: Fri, 01 Sep 2023 23:27:19 GMT
server: cloudflare
etag: W/"3b894306b15655fe9be46c02942fe8f9"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
cf-ray: 8b1fac9369a96ae6-FRA

GET
H2 200 66b404cb8f4a9d5c36440c56_roboto-flex-medium.woff2
assets.website-files.com/64e36a72d57403710ee5415d/ 86 KB
87 KB 138ms
24ms Font
application/octet-stream 2600:9000:235a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64e36a72d57403710ee5415d/66b404cb8f4a9d5c36440c56_roboto-flex-medium.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eccfeb64c6c1a964ac381914233e53a340c8f2c5804a59ab996a97ca5d302834

Request headers

Referer: https://cdn.prod.website-files.com/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 08 Aug 2024 12:47:45 GMT
x-amz-version-id: of62vx5kIgkTnuPfVPnQ_F4uWyz8WeMb
via: 1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
age: 336147
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 88240
last-modified: Wed, 07 Aug 2024 23:35:41 GMT
server: AmazonS3
etag: "bf1ae519a8647715ff7333b46ece67f1"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: pAzk98ltwqJkZ0WUVLyV1JgFbGs54QCaaTmYR6AXf60YSyAVM8x3ag==

GET
H3 200 64f8dcf1dafb24036836ad01_desktop-top.svg
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 2 KB
1 KB 87ms
87ms Image
image/svg+xml 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/64f8dcf1dafb24036836ad01_desktop-top.svg
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d8d814ef6c16faa45496c01b52141e7e76743e22d33c4727979ddee73b96483

Request headers

Referer: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: Zh1LcL93_t5pCo4I.LeOw95aqAnVT0Uu
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 17VJMQ5E2PGYM0D0
age: 814136
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1/XDrFNzB0aRz2U3OLCltMK0orxrPNknnAHcMjVLPXzFGj7sqqR0OKGiMYUmezqEDcgcEH8k4QyBZBpjVD6Ygc/nBox9Ophs
last-modified: Wed, 06 Sep 2023 20:11:30 GMT
server: cloudflare
etag: W/"0f6992e1c133e3af1277a3f9bf2cfa20"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
cf-ray: 8b1fac9369b06ae6-FRA

GET
H2 200 64e5103ac6b21ea1983d0da8_Haffer-Regular.woff2
assets.website-files.com/64e36a72d57403710ee5415d/ 47 KB
47 KB 182ms
68ms Font
application/octet-stream 2600:9000:235a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64e36a72d57403710ee5415d/64e5103ac6b21ea1983d0da8_Haffer-Regular.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b46101f572695e1a9b16ce4bdd8f095c50fc10e515435e67c336f31b0b8720f5

Request headers

Referer: https://cdn.prod.website-files.com/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 03 Jun 2024 06:24:37 GMT
x-amz-version-id: 4WMMMxfBzRu.RI4V6ulbbfW8IJ4R4ORr
via: 1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
age: 6061534
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 47664
last-modified: Tue, 22 Aug 2023 19:45:00 GMT
server: AmazonS3
etag: "93268e5431a22fc3b9f8f6b76e0b8583"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: H4CiS8RKHctMAw1pNWyBgyNc_fk8afS-DCD9-J5SNYVEv9xOoN5dig==

GET
H2 200 64e3dcfdc911e3c23b67a4dd_Haffer-SemiBold.woff2
assets.website-files.com/64e36a72d57403710ee5415d/ 47 KB
47 KB 139ms
25ms Font
application/octet-stream 2600:9000:235a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64e36a72d57403710ee5415d/64e3dcfdc911e3c23b67a4dd_Haffer-SemiBold.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dd91547b4fc051d3db0de271fb5b80961a3b0401f9263b0dededd389886e1657

Request headers

Referer: https://cdn.prod.website-files.com/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 31 May 2024 06:49:58 GMT
x-amz-version-id: w3_JSDru_JCkG9SkeKxmZAc5nIKIgm75
via: 1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
age: 6319214
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 47716
last-modified: Mon, 21 Aug 2023 21:54:06 GMT
server: AmazonS3
etag: "770b6b9bd51713d49588db61bbb7022b"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 9tQaB5kOcnGIJIzbNyope9uvyGYc6DUANn9x8sCr_ASF0F5xSmXasg==

GET
H2 200 64e3dd10db208a3b7c65078f_Haffer-Medium.woff2
assets.website-files.com/64e36a72d57403710ee5415d/ 47 KB
47 KB 183ms
70ms Font
application/octet-stream 2600:9000:235a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/64e36a72d57403710ee5415d/64e3dd10db208a3b7c65078f_Haffer-Medium.woff2
Requested by: Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/css/vectra-project.5ef5f7a62.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7a5f93a9d8ce39ff9f1fb6a17ced9affc62912ed3a002623b4766b7591bc5b15

Request headers

Referer: https://cdn.prod.website-files.com/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 03 Jun 2024 06:24:37 GMT
x-amz-version-id: C0Ona1K9ZhXmmC6yGkz2Oz7sS7o2V8Ih
via: 1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
age: 6061534
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 47788
last-modified: Mon, 21 Aug 2023 21:54:25 GMT
server: AmazonS3
etag: "27da2c2bda45719bd4336f9380b94681"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 5xA-WVw6Sy_y-GCt0U9phBWP4qu1GohGqiUoss7Hm5pYRn1vqlhbww==

GET
H3 200 6682966bd502e4526f6fff9d_Blacksuit-logo.webp
cdn.prod.website-files.com/64e50cbe2b6f932c04238c14/ 4 KB
4 KB 81ms
80ms Image
image/webp 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e50cbe2b6f932c04238c14/6682966bd502e4526f6fff9d_Blacksuit-logo.webp
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 543936b06fb460b727e4b6f6af8e3ce5ac94c12cf332ff7863bcb64c96e81ddf

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: mgozPo8jWbq2Uom2GvvykbJgLm91ryCf
cf-cache-status: HIT
x-amz-request-id: 4EWS5WCVMGXAE63P
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 3922
x-amz-id-2: TvJr+KY7oknBVHJIx2nMQGHVCyzhSy0wxMXlngmO0LsTYA6W4n3qvZqeNBJKw660iYdWXzWoqP8AYV/WczDzMngl6rqe0xbk
last-modified: Mon, 01 Jul 2024 11:43:40 GMT
server: cloudflare
etag: "c8060f4a9567edc770af8bfff748d044"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac93ba0f6ae6-FRA

GET
H3 200 66827cdd79a9e0646cc4e62f_akira-history-p-1600.jpg
cdn.prod.website-files.com/64e50cbe2b6f932c04238c14/ 98 KB
98 KB 47ms
46ms Image
image/jpg 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/64e50cbe2b6f932c04238c14/66827cdd79a9e0646cc4e62f_akira-history-p-1600.jpg
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2587eec3a21b89587f6d195cd3144e8f993d7bebb0d487fb2a2b011b172180fd

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: 8mFVPAY0xiiw6LHKz3bkvVlTfzVvN6vR
cf-cache-status: HIT
x-amz-request-id: 246W1W328PEDAH9Z
age: 61127
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 100162
x-amz-id-2: XJwE+Jwr/FuazNe7tsjjoPVpxsXm+x8N5fyY8AW+9Uki8RsFjhttBPT5Nx0ZsdBr9C4NB28I5yw=
cf-bgj: h2pri
last-modified: Mon, 01 Jul 2024 09:54:39 GMT
server: cloudflare
etag: "f2269e2861780c7757c76e41cff5fd6a"
vary: Accept-Encoding
content-type: image/jpg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac93ba126ae6-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 358 KB
111 KB 49ms
44ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0F9PRG4D5J&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

71b3378ed1ac36e4c9a1200a956dd17f28ef920a0b092bfe571f3d31c978ac4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 113211
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 12 Aug 2024 10:10:11 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 150ms
27ms Script
application/javascript 2a02:26f0:480:15::213:7e63
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2024 05:33:09 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=77390
accept-ranges: bytes
content-length: 14597

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
13 KB 147ms
25ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 6755508f95a14ac65d6d5123ce9db08f5b0fc2921dd713a6ae8d6369a0020da9

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 20 Jun 2024 19:23:03 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "71b328aff914ada8b774bfa8fff542c4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 12116

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 273 KB
93 KB 43ms
42ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-303409326&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

946f13782a43b0d1acb47534bee4c24dd90374c9e9e148cb578542929feb11c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95371
x-xss-protection: 0
last-modified: Mon, 12 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Aug 2024 10:10:11 GMT

GET
H2 200 21836454.js Show response
js.hs-scripts.com/ 2 KB
1 KB 266ms
157ms Script
application/javascript 2606:4700::6810:8ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/21836454.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0493a327e32fefb2364d63d96f2abf1b9cb8a1f8684a20c1f35c5dcca2875d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 948a44ab-a826-4bdb-8d10-5f0ba3296d12
x-envoy-upstream-service-time: 5
content-length: 644
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 948a44ab-a826-4bdb-8d10-5f0ba3296d12
last-modified: Mon, 12 Aug 2024 10:10:11 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://de.vectra.ai
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-p4jvk
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 8b1fac95acbe918f-FRA
expires: Mon, 12 Aug 2024 10:11:41 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 143ms
28ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

1475fb54c3fb536fa21290c893f1822fd7f3215f71c00d35cd1f4674327a6407

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Thu, 08 Aug 2024 20:19:09 GMT
server: ECS (frb/67D4)
age: 46485
etag: "e348f639d0e9da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25392

GET
H2 200 hotjar-2252937.js Show response
static.hotjar.com/c/ 11 KB
5 KB 119ms
21ms Script
application/javascript 18.66.102.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2252937.js?sv=6

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.51 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-51.fra56.r.cloudfront.net

Software

Resource Hash

7d32b7333c868e53be80c77ddb26dfede4968587caf27110ab98681cce43b8b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Mon, 12 Aug 2024 10:09:52 GMT
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 19
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/f30ba04638611c6fd41926b66ca11e41
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: NZOFeV3wOt2KRg1KPZNJrpPXdK5rrQA1RNQmD3NdvZYV_oa2KH2taw==

GET
H2

200

universal.min.js Show response
assets.storygize.net/engagement/28858/
Redirect Chain

https://www.storygize.net/u/events.js
https://assets.storygize.net/engagement/28858/universal.min.js

119 KB
28 KB

121ms
31ms

Script
text/plain

18.239.36.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.storygize.net/engagement/28858/universal.min.js
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Server: 18.239.36.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-36-63.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d257d5bdfd1942c7b7962f25053cad1f62e461422edd77b532c5979ceb38ce4b

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 04:45:22 GMT
content-encoding: gzip
via: 1.1 f7534ef0cb2fd28f5c17e7cc694ad68a.cloudfront.net (CloudFront)
last-modified: Tue, 09 Jul 2024 20:47:10 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P2
age: 19491
x-amz-server-side-encryption: AES256
etag: W/"2b17780738dfdbb3d6756a4dd22dbb83"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/plain
x-amz-cf-id: 3pR5wQT9TTqqaCmZbjTwJinZJ0cBnH7pr1065NnrypAcahgqe8OEgQ==

Redirect headers

location: https://assets.storygize.net/engagement/28858/universal.min.js
pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
cache-control: no-cache, no-store, must-revalidate
p3p: CP ALL ADM DEV PSAi COM OUR OTRo STP IND ONL
content-length: 0
expires: 0

GET
H2 204 Pixels
px.adentifi.com/ 0
35 B 424ms
148ms Image
text/plain 52.0.218.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.adentifi.com/Pixels?a_id=17999;p_url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping;uq=2419244408766.339
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.218.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-218-89.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?t=2&add=37642418
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D37642418

43 B
1 KB

62ms
62ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D37642418

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
an-x-request-uuid: e6a717d7-8381-4515-95a5-c172e8aca772
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 84.19.175.183; 84.19.175.183; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
an-x-request-uuid: 2e05c5c2-99c7-4566-a5c9-ba7846acdf2e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D37642418
x-proxy-origin: 84.19.175.183; 84.19.175.183; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.vectra.ai%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.vectra.ai%26pId%3d%24UID
https://attr.ml-api.io/?domain=www.vectra.ai&pId=2564410184532697727

4 B
279 B

317ms
225ms

Image
application/json

2600:9000:206f:e400:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.vectra.ai&pId=2564410184532697727
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Server: 2600:9000:206f:e400:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-type: application/json
alt-svc: h3=":443"; ma=86400
content-length: 4
apigw-requestid: cY_cqin-oAMEPeA=
x-amz-cf-id: bqrI3M5cleZ7IGE0-yxef-7D7HVHYYfN5tPfDnV-9vHKn_k8M8o7yw==

Redirect headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
an-x-request-uuid: 6f95f374-e1ea-40a9-b2a3-1fe799a8f1c6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://attr.ml-api.io/?domain=www.vectra.ai&pId=2564410184532697727
x-proxy-origin: 84.19.175.183; 84.19.175.183; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 weglot.min.css
cdn.weglot.com/ 28 KB
5 KB 49ms
48ms Stylesheet
text/css 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.weglot.com/weglot.min.css?v=6

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35638404c448909f695c198049e27b151876151b68f65e4f8d183ede75150e14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 2757840
x-cache: RefreshHit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Jul 2024 13:58:55 GMT
server: cloudflare
etag: W/"dca11c08c28cf77d8aa88274c8e81c5f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8b1fac96ca986993-FRA
x-amz-cf-id: AFEIzOMjIaGd4qcZd6eGONYUav1uJ4n2sNokbb1P_8fvkUId9CpyhA==
expires: Tue, 12 Aug 2025 10:10:11 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 90ms
41ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-0F9PRG4D5J&gtm=45je4880v872698941z871783682za200zb71783682&_p=1723457411085&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=1694998451.1723457412&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1723457411&sct=1&seg=0&dl=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit&dt=Ist%20Ihr%20Unternehmen%20vor%20Blacksuit%20Ransomware%20Angriffen%20sicher%3F&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1835
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0F9PRG4D5J&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://de.vectra.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
242 B 130ms
31ms Ping
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-0F9PRG4D5J&cid=1694998451.1723457412&gtm=45je4880v872698941z871783682za200zb71783682&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0F9PRG4D5J&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://de.vectra.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 98ms
60ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-0F9PRG4D5J&cid=1694998451.1723457412&gtm=45je4880v872698941z871783682za200zb71783682&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=718989601

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bubble.1f7f6b254b6b32ace75ba109d09557b0b976a732.min.js Show response
cdn.weglot.com/switchers/ 92 KB
33 KB 70ms
70ms Script
application/javascript 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.weglot.com/switchers/bubble.1f7f6b254b6b32ace75ba109d09557b0b976a732.min.js

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b13a4376eea9414e59374483f195612658d8018552c6b2bdfe5d22af8a7972a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 19dbc4cbbe0be3dca8e57283a83b57c6.cloudfront.net (CloudFront)
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 2419897
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 19 Jun 2024 09:09:08 GMT
server: cloudflare
etag: W/"cf80160193c385c088b5dfb012322c8c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8b1fac973b5a6993-FRA
x-amz-cf-id: o4IG83SBJMYZcanuzI6jgijiotNgGSGvQUgzRkNxShOuw-kC_cLtRQ==
expires: Tue, 12 Aug 2025 10:10:11 GMT

POST
H3 200 pageviews
api.weglot.com/ 0
0 168ms
98ms Ping
application/json 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.weglot.com/pageviews?api_key=wg_4ee8d93119cf98e624af53693260d0858
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H/1.1 200
OK clnymofrk005d0qx575j7e4sl Show response
api.jetboost.io/sites/ 11 KB
12 KB 450ms
137ms Fetch
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.jetboost.io/sites/clnymofrk005d0qx575j7e4sl

Requested by

Host: cdn.jetboost.io
URL: https://cdn.jetboost.io/jetboost.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy / Express

Resource Hash

53bcfb23ecfd8ddecf82127563dcc1ae6ded7bc20145b7eadf9389ba22042f31

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Mon, 12 Aug 2024 10:10:12 GMT
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: Cowboy
X-Powered-By: Express
Etag: W/"2afb-MOrgw5u2tR6zSwg7LZeXVT0+rNI"
X-Frame-Options: SAMEORIGIN
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1723457412&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=hwDGCvuNfbvOiM2AS17zCwwFkM9e0rS5mUjXWZeNyQM%3D"}]}
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 11003
Jetboost-Cache: hit
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1723457412&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=hwDGCvuNfbvOiM2AS17zCwwFkM9e0rS5mUjXWZeNyQM%3D

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_w8old155/ 3 B
124 B 160ms
71ms XHR
application/json 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_w8old155/config
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 varnish
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
content-length: 27

GET
H2 200 t2_w8old155_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
699 B 101ms
33ms XHR
application/json 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_w8old155_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 45da241a91c843b268ada7481cdece1aa679f2720931effea28d83e1398d66a9

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 97

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 153ms
34ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1723457411713&id=t2_w8old155&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=3147d74b-9379-4e0a-ba5c-16d2020497da&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_e9773deb&dpm=&dpcc=&dprc=
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
694 B 249ms
169ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 82A9DC76E2E94090AC6A993BC55522B9 Ref B: FRAEDGE1506 Ref C: 2024-08-12T10:10:11Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://de.vectra.ai
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYfebLR/lV1RctzQiN5fA==

GET
H2 200 modules.8da33a8f469c3b5ffcec.js Show response
script.hotjar.com/ 223 KB
56 KB 85ms
21ms Script
application/javascript 13.33.187.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.8da33a8f469c3b5ffcec.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2252937.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-109.fra60.r.cloudfront.net

Software

Resource Hash

76f448ec45359e863fb3a6432a2a3cf22c0cc0a52aead6318b57ab38db6f1d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 14:23:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 32c1b1f3aed1f2411468b70713ad6556.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
age: 1108025
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56385
last-modified: Tue, 30 Jul 2024 14:22:40 GMT
etag: "0728625a147ca79276a1790b9cf3175d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: N6uEZUxu9NN1bAf0W2JA8ipLZ5CXnOpNfwkrWrXN8tpZ-BRgJ1imKg==

GET
H2 200 21836454.js Show response
js.hs-analytics.net/analytics/1723457400000/ 69 KB
25 KB 286ms
220ms Script
text/javascript 2606:4700::6810:a0a8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1723457400000/21836454.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21836454.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b845a5bc27e7ba338ec36dba73bc2de4cd2c30a59bb0f0680b9c684e538fc043

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: MZACJ6EK6TR785QH
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 98084374-090d-4eaa-930a-b8e656030ec9
x-envoy-upstream-service-time: 72
x-amz-id-2: qDQTmEHro01wdl/UCSKtjr6ljmAunQkQmhXE/pMk1Wj1Lkp3FECL5kFKSsppe8rIwDNBGGBqPo0=
x-evy-trace-listener: listener_https
x-request-id: 98084374-090d-4eaa-930a-b8e656030ec9
x-evy-trace-route-configuration: listener_https/all
last-modified: Sat, 03 Aug 2024 00:46:43 GMT
server: cloudflare
etag: W/"b50c606f4d03bd1cf8ee60ea69ec8163"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-wxrdh
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8b1fac982f616add-FRA
expires: Mon, 12 Aug 2024 10:15:12 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 128ms
41ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21836454.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
Origin: https://de.vectra.ai
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
age: 582
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1294/bundles/project.js&cfRay=8b1f9e5e7d31be6d-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"ca106ef78092107b8d4a40131d641c01"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1294/bundles/project.js
date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 736ad67f05a9a5a8fd5ed8cba30196f4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-version-id: GMZ9HyPHjtzB9hq9Kp4nuMbTlOz7NvmB
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 9a503705-47f4-4a6b-b2e9-3cd4aaeb7f93
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 9a503705-47f4-4a6b-b2e9-3cd4aaeb7f93
last-modified: Mon, 29 Jul 2024 11:16:10 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GHqbGOTNSqEYHogq36jhhYz9upsp%2FmNO2S2BueHZdXzQkiksViG1SCqsXP7gqaLoJDzEHm4x10YAGnGwEWnFUH5U59%2BjR0Li2ymDf4OFcJ7onJ1g3RvFlshtGKyml6PZS2Z1cHf3Om3PqwpY"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-2hxmr
cf-ray: 8b1fac984907362c-FRA
x-amz-cf-id: t4DlxQgSiw48XYQFBt1-lTu6zVKjrS60_Ack-3w7YIqb4LbrRn1Gjw==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 109ms
30ms Script
application/javascript 2606:4700::6811:df98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21836454.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:df98 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
x-amz-version-id: UIOsIr3qFS9r3wFn4ECf3yNr1.R8N2aA
cf-cache-status: HIT
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P3
age: 171
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.572/bundles/pixels-release.js&cfRay=8b1fa86699f69bb8-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: da36c4c1-1081-45c3-b569-b8082f68ca0e
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: da36c4c1-1081-45c3-b569-b8082f68ca0e
last-modified: Tue, 06 Aug 2024 19:11:03 UTC
server: cloudflare
etag: W/"45a803cc17701ff8c7710294960c14c7"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-tmvlw
cf-ray: 8b1fac9839b99bf2-FRA
x-amz-cf-id: Q0VJzCnU_4nMo6cTBJQ2zJ19JJ3c1atxO_MpI0ynM4_Vl_f95BSZmA==
x-hs-target-asset: adsscriptloaderstatic/static-1.572/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/21836454/ 71 KB
26 KB 103ms
40ms Script
text/javascript 2606:4700::6812:17b7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/21836454/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21836454.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cd6de8f5e39ba2754fbddd470637c8a9bdb1f57e88efde4eb06bb1baedc96e

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: g12W6cgrk2iW_5X.mjxuMlL64Fo5P2MY
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: KX3N0K8V3TRN2X1G
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: a9072036-0456-4e43-aa6e-bb5e6ccaf39b
age: 19
x-envoy-upstream-service-time: 82
x-amz-id-2: LQD7iIgS/A+wVJgzkNII2Da480cD/WUSFL9rfTTPr0it34/bWk9pE6LNO8wdgQDu99aOnGDoZE4=
x-evy-trace-listener: listener_https
x-request-id: a9072036-0456-4e43-aa6e-bb5e6ccaf39b
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 15 Apr 2024 16:21:17 GMT
server: cloudflare
etag: W/"dbc4ddb14bd0d6cb9da1157876e34bf3"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://de.vectra.ai
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-vhl7w
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8b1fac982db8361d-FRA
expires: Mon, 12 Aug 2024 10:14:52 GMT

GET
H2 200 ipv
cdn.bizible.com/ 43 B
305 B 44ms
28ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=c62d9e8cb9b44cc8ea2cfb8863b24763&_biz_l=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&_biz_t=1723457411813&_biz_i=Ist%20Ihr%20Unternehmen%20vor%20Blacksuit%20Ransomware%20Angriffen%20sicher%3F&_biz_n=0&rnd=692387&cdn_o=a&_biz_z=1723457411815

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 09 Aug 2024 21:15:25 GMT
server: ECS (frb/67BA)
age: 219286
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
204 B 66ms
27ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=c62d9e8cb9b44cc8ea2cfb8863b24763&_biz_l=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&_biz_t=1723457411816&_biz_i=Ist%20Ihr%20Unternehmen%20vor%20Blacksuit%20Ransomware%20Angriffen%20sicher%3F&rnd=203781&cdn_o=a&_biz_z=1723457411816

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 09 Aug 2024 21:15:27 GMT
server: ECS (frb/6752)
age: 219284
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
1 KB 224ms
169ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cache: CONFIG_NOCACHE
x-li-uuid: AAYfebLTkOHZ86/PWXJbyw==
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 9B531586B9DC458F831BA471408B50D7 Ref B: FRAEDGE1522 Ref C: 2024-08-12T10:10:11Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-ltx1
access-control-allow-origin: *
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-fs-uuid: 00061f79b2d390e1d9f3afcf59725bcb

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2&e_ipv6=AQLwFraE7pugoQAAAZFGERtZTVP...

0
264 B

327ms
179ms

Image
application/javascript

2620:1ec:51::12
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2&e_ipv6=AQLwFraE7pugoQAAAZFGERtZTVPm01gST5ppiOaoxC1dLO7ERTk5ad3GVFgllnMvitZCyDYT_QPVhZqfl4oO4qwxUSXAKg
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H2
Server: 2620:1ec:51::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 556A8A79B410422D95902D9CA4002492 Ref B: VIEEDGE2407 Ref C: 2024-08-12T10:10:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfebLXoGxP9aCmkVBzkA==

Redirect headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 6D307266FB52490F97697B317E813441 Ref B: FRAEDGE1506 Ref C: 2024-08-12T10:10:11Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1132849&time=1723457411847&url=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&tm=gtmv2&e_ipv6=AQLwFraE7pugoQAAAZFGERtZTVPm01gST5ppiOaoxC1dLO7ERTk5ad3GVFgllnMvitZCyDYT_QPVhZqfl4oO4qwxUSXAKg
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYfebLSvETVzXq1MNTZPg==

POST
H3 200 303409326
google.com/pagead/form-data/ 0
0 80ms
27ms Ping
text/html 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/pagead/form-data/303409326?gtm=45be4880v9119783934z871783682za201zb71783682&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&frm=0&pscdl=noapi&auid=1775614103.1723457411&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1~em.PltM5LSVJ1JX_v4iDzABylH2Rl7vh1Ao7hCizxQiTqU
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-303409326&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

POST
H3 204 303409326
google.com/ccm/form-data/ 0
17 B 91ms
40ms Ping
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google.com/ccm/form-data/303409326?gtm=45be4880v9119783934z871783682za201zb71783682&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&frm=0&pscdl=noapi&auid=1775614103.1723457411&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1~em.PltM5LSVJ1JX_v4iDzABylH2Rl7vh1Ao7hCizxQiTqU&ecsid=45513088.1723457412
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-303409326&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://de.vectra.ai
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gb.svg
cdn.weglot.com/flags/rectangle_mat/ 607 B
824 B 44ms
41ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/gb.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

720d4a3364adb0f6dab95c8339fc8538a4388e302b8a8173d401e8471998ebf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
x-amz-version-id: null
via: 1.1 04e9e9d9b90b8bb096dac156f847c1a6.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: DUS51-P3
age: 13099742
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:53 GMT
server: cloudflare
etag: W/"006007133f2f5769b083935b65c12e4e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8b1fac983c9c6993-FRA
x-amz-cf-id: c14-dPtGRJug5FHGcVw-396hti5MFM-NFaaKh5cycisuBIxUbYQRqg==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H3 200 fr.svg
cdn.weglot.com/flags/rectangle_mat/ 361 B
683 B 46ms
44ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/fr.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d64cc6ca0696fecc817f893a5ef9f6652ff3d613ab65192ef458ce3b542f192

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 13109179
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:52 GMT
server: cloudflare
etag: W/"bd4e571babcb06df9fc0c931f8d65683"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8b1fac983ca06993-FRA
x-amz-cf-id: GPbELLoYFMkS0PXvf8SoGGM8zydGQoRO8gSeLXAKS5evjZtgeU6L_w==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H3 200 jp.svg
cdn.weglot.com/flags/rectangle_mat/ 543 B
799 B 46ms
44ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/jp.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdfa6547db32dc7e47ae2f33143306c75ddac57854cdf0d29881dda144c9e38f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 307395f1eb3989f15e6f525475291c86.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 13109226
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:53 GMT
server: cloudflare
etag: W/"315e5876c5799a3a75c5ae1cd754d935"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8b1fac983ca26993-FRA
x-amz-cf-id: _JWCzdbml0AnzBZZEM-SnKXyXYhhYaL_vOvYefvWtfuPHSrF0adL7Q==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H3 200 es.svg
cdn.weglot.com/flags/rectangle_mat/ 89 KB
17 KB 49ms
47ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/es.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddc451027c83a11707ac910f223f84f7bc51f3881197223978e2a717efa64c57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
via: 1.1 28b2547a012b744c90796693b582d83c.cloudfront.net (CloudFront)
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: AMS58-P6
age: 13099742
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:52 GMT
server: cloudflare
etag: W/"96b4be850a4d40bcea53825f0a5464ee"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8b1fac983ca36993-FRA
x-amz-cf-id: poKDUEZtkjcslQZisLvc827jSeg-jyeDy-dFkcYZvD_d5KtVmZ8BSw==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H3 200 it.svg
cdn.weglot.com/flags/rectangle_mat/ 361 B
684 B 54ms
51ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/it.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

251214b83e86ba6b8ba5d810089b699d7cd43c9e4bbce2158655469a1af29852

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 760a29e891ec10bba1274911260e1fc8.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 13113426
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:53 GMT
server: cloudflare
etag: W/"70b02da9cb6cfbccdbd3497cfd2b36af"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8b1fac983ca46993-FRA
x-amz-cf-id: LAEpLw9qBCvXp9r9Vx4cLfdPsxqFcnU-oDoneSc3tMKqSEjX5rqW9Q==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H3 200 tr.svg
cdn.weglot.com/flags/rectangle_mat/ 623 B
807 B 49ms
46ms Image
image/svg+xml 2606:4700::6812:620
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.weglot.com/flags/rectangle_mat/tr.svg

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:620 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

915fa75bf58286e38e8f7d94bb91e3df3dfd05ca948f481aab0c73304f734581

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
via: 1.1 f7aba4a0337c5f98c4703e2b10f1940a.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-version-id: null
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P4
age: 13113406
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 16:04:56 GMT
server: cloudflare
etag: W/"663f1af705a6f30b62150aad5ddc4011"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8b1fac983ca56993-FRA
x-amz-cf-id: 6lPbqm7FbRLFOXLbsAs0OSQO37JZ9CrvkjdZIxnQolyxOZQ7nGoHkw==
expires: Tue, 12 Aug 2025 10:10:11 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 111 B
320 B 136ms
134ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=c62d9e8cb9b44cc8ea2cfb8863b24763&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.08.08

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

f0c735b34e2a68c63208915f7c3ccd9244be8f1fd3d19f2e1578f9dbe0761464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (frb/6711)
etag: 50980621
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 214

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 320ms
124ms XHR
application/json 52.215.135.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=2252937&gzip=1
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.215.135.129 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-135-129.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a51fd08066d221ce36e2beb0f1f4d93bae824fe902af79ed77a85342e3ad0268

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 12 Aug 2024 10:10:12 GMT
content-length: 56
access-control-max-age: 86400
content-type: application/json

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 253 B
1 KB 203ms
150ms XHR
application/json 2606:4700::6812:f16c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=21836454

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f16c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b42af48c8090e6c40a840ddc2a765b9261ae71af56af118fc0dfa71dd15308c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8d623d31-e1dd-4f82-bec0-1c434bbc5c40
content-encoding: br
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8d623d31-e1dd-4f82-bec0-1c434bbc5c40
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://de.vectra.ai
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-85b74c4c74-j749l
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2q2uttU0UXcjObRhpclcXko2%2F%2BYv3LosDkNf2nRbKlEY5Z5MqnVYEzE5zEnf1kwHiQbrjJbBpXLKvYL%2BxiqUkrNDSYgBmAYSgocbUCKG%2B2cgevi17CQeUNUhnpiBxB5p3HTBKXTu41KkevM7"}],"group":"cf-nel","max_age":604800}
cf-ray: 8b1fac996ba79a2a-FRA
access-control-allow-headers: *

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 95 B
1 KB 165ms
156ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=21836454&currentUrl=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 74847524-7d8c-4529-aec4-2b9410dd56cf
content-encoding: br
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 74847524-7d8c-4529-aec4-2b9410dd56cf
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://de.vectra.ai
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qEyI%2BAXKnO5z1aBda2BsuxHxb%2BWZgV6fa1554AkK1WG%2FZVkB2QeQR0B7VK9i%2F6HVeVLKV4tvvuglGyQXEpKJzxmjLnfZDe8eNe0FEf4vGxHvwr%2BYo%2FYBg5HxFZx4StXsCyBZj5u8CejhgqejJ%2B7E4mB3hCJQEn7YcRU%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8b1fac992a8e362c-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-png4t

GET
H2 200 abdo.js Show response
www.storygize.net/a/8036fdee-4f34-4bc2-b0c9-79d97831fd61/ 0
153 B 199ms
195ms Script
text/javascript 54.186.117.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.storygize.net/a/8036fdee-4f34-4bc2-b0c9-79d97831fd61/abdo.js
Requested by: Host: www.storygize.net
URL: https://www.storygize.net/u/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.186.117.241 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-186-117-241.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-type: text/javascript
pragma: no-cache
date: Mon, 12 Aug 2024 10:10:12 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 0
p3p: CP ALL ADM DEV PSAi COM OUR OTRo STP IND ONL

GET
H2 200 jetboost-main.js Show response
cdn.jetboost.io/v1.30.6/ 115 KB
34 KB 24ms
24ms Script
text/javascript 2600:9000:223e:ae00:1d:7a82:2900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jetboost.io/v1.30.6/jetboost-main.js
Requested by: Host: cdn.jetboost.io
URL: https://cdn.jetboost.io/jetboost.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:ae00:1d:7a82:2900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a6684de05e4a50723b1203bebb56786a919e6265f6107a1a8c6e3d88a1fec284

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 06 Aug 2024 07:30:40 GMT
content-encoding: gzip
via: 1.1 c9499008aa7e1acd11e9fbc171281d82.cloudfront.net (CloudFront)
last-modified: Tue, 30 Apr 2024 16:36:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 528024
x-amz-server-side-encryption: AES256
etag: W/"efe4d2e8eb51c515579724a88138ded0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=2592000
x-amz-cf-id: r8PnBN_7mIbk-GUm6XsZ38jeSBL5euVvdt44JAIRsJmIB7gLeokGRQ==

GET
H/1.1 200
OK counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
1 KB 236ms
184ms Image
image/gif 2606:4700::6812:50cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:50cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Mon, 12 Aug 2024 10:10:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
CF-Cache-Status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 224c261c-0402-4f81-986f-005e61cb2ade
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 224c261c-0402-4f81-986f-005e61cb2ade
Last-Modified: Mon, 12 Aug 2024 10:10:12 GMT
Server: cloudflare
vary: origin, Accept-Encoding
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-jklz5
access-control-expose-headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
Accept-Ranges: bytes
x-robots-tag: none
CF-RAY: 8b1fac9a7b506937-FRA

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 234 KB
84 KB 39ms
39ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-940419578

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

17071d377ea43fbb1eddbbe1dc361c9b11cc5f3f216db2217ef3e71ba3a142c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85700
x-xss-protection: 0
last-modified: Mon, 12 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Aug 2024 10:10:12 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 234 KB
84 KB 41ms
41ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-940419578&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PV9RWZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

74ead537714075418990084153b333ae56192830d9aa78a0e26a08fd943b24c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85715
x-xss-protection: 0
last-modified: Mon, 12 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Aug 2024 10:10:12 GMT

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 165ms
58ms Script
application/javascript 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: de.vectra.ai
URL: https://de.vectra.ai/threat-actors/blacksuit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
content-encoding: gzip
cf-cache-status: DYNAMIC
via: 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 26695
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
server: cloudflare
etag: W/"b2877da906a3216c4f3fc4030b205e54"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 8b1fac9c8f701d88-FRA
x-amz-cf-id: HVKhHKXVp9cfBS4A4qhq8UHybNJ9B7Jmr0qW8K6O6A5EXKv-ODp_Pg==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
60 KB 132ms
28ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4d424af8e6254a3ee915b6efdec3f0ed3fcbdedc67c83025148c9758701cd2d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 12 Aug 2024 10:10:12 GMT
document-policy: force-load-at-top
x-fb-server-load: 30
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58865
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=12, mss=1328, tbw=2780, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: zH2v0yLnlPyADfa22wUAwhCcrDIwZGF2W4PABTI+YYpgUG9/XSuCFlbIbESLxW50ToVwZ9EBsIWrVtZVFI5LYQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 268ms
167ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=1240600147&v=1.1&a=21836454&rcu=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit&pu=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&t=Ist+Ihr+Unternehmen+vor+Blacksuit+Ransomware+Angriffen+sicher%3F&cts=1723457412441&vi=fc924c7550e6289eddde8fb0c7accbe8&nc=true&u=184502585.fc924c7550e6289eddde8fb0c7accbe8.1723457412440.1723457412440.1723457412440.1&b=184502585.1.1723457412440&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 75181135-07b2-4aed-b864-8f8b2bab4b12
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 11
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 75181135-07b2-4aed-b864-8f8b2bab4b12
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CrM26%2BTCLlMIz8RIZ9uPLJQWk9yR0QcaHlswHeEJBaeQ84Jl%2BhFFoxlspGMXLTGyCZ61p7UkaT6%2FkxlvEdRQuXk8lk1IFgM3b3lMK9ig8D4%2Fp%2BUVs%2FBf5egK7frVOrwpX8E84Ac5lwcymNKe%2BY09"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-s9rb6
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8b1fac9c8c3b9a39-FRA
x-robots-tag: none

GET
H3 200 6538dabcff731813e15fcabc_favIcon__drk_32x32.png
cdn.prod.website-files.com/64e36a72d57403710ee5415d/ 2 KB
2 KB 68ms
68ms Other
image/png 2606:4700::6812:1ccb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.website-files.com/64e36a72d57403710ee5415d/6538dabcff731813e15fcabc_favIcon__drk_32x32.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1ccb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a8a5ff8cbdac0267a81d0a807be7ab0ef15ac5744d0c362b5b9dcf33f2160be

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:12 GMT
x-amz-version-id: ut_vhalt5l.UKGHQ1zioWn4RDhM3DXLS
cf-cache-status: HIT
x-amz-request-id: 86YX0D77FVSCFFHV
age: 6372203
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
content-length: 1756
x-amz-id-2: csU4S8n3C+s7XMpYxsn/CfDyBIFiXH4KmV3CBtfk6FZlC0NvdP/A6OpWOrIaRU/mUu6B5Z7vlOg=
last-modified: Wed, 25 Oct 2023 09:07:09 GMT
server: cloudflare
etag: "8e945777df8cb03650e5302c00eb1a52"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
cf-ray: 8b1fac9bddf36ae6-FRA

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
578 B 189ms
188ms Fetch
application/json 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a666d86ce0204f81556e5c7afb6b8e0b59d6f0d0dda2b0da24330bb2ade41fa0

Request headers

Content-Type: application/json
Referer: https://de.vectra.ai/
Authorization: Bearer 88173ef1cb1679933532
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
visited_url: https://de.vectra.ai/threat-actors/blacksuit#mitre-mapping

Response headers

date: Mon, 12 Aug 2024 10:10:13 GMT
via: 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: FRA56-P4
x-powered-by: Express
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
apigw-requestid: cY_c0iOQvHcEPmQ=
server: cloudflare
etag: W/"cb-/RKPVMshVLiq24wmgOsRTRB5UnI"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.vectra.ai
cf-ray: 8b1fac9e6a9f4d9c-FRA
x-amz-cf-id: ROGRUE3tb0CLJRKfrre9O5woDLBmhqPppHw5vwbqXA6ryGJ8-LoJ2Q==

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 248ms
220ms Preflight 104.18.37.212
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://de.vectra.ai
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://de.vectra.ai
alt-svc: h3=":443"; ma=86400
apigw-requestid: cY_cyjeOPHcESBg=
cf-cache-status: DYNAMIC
cf-ray: 8b1fac9d08c34d9c-FRA
date: Mon, 12 Aug 2024 10:10:12 GMT
server: cloudflare
vary: Origin
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
x-amz-cf-id: 7FHhUSZfswxjaw-TGAaXPkMTExk_iGYOVTxS59evWhvxnM1e_LJdeg==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H2 200 504405910731415 Show response
connect.facebook.net/signals/config/ 64 KB
13 KB 149ms
149ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/504405910731415?v=2.9.164&r=stable&domain=de.vectra.ai&hme=61ff4e692c87a9a2ce7b19822df2b04638e3ca38b23c1be6c0f1945ccadb2ad5&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C167%2C170%2C182%2C178%2C179%2C181%2C29%2C98%2C52%2C75%2C180%2C162%2C165%2C175%2C176%2C183%2C127%2C40%2C34%2C139%2C15%2C49%2C189%2C188%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C163%2C166%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3406693efa2caa9e71876669c022dbb2f4cb646b5a23f0f75e6574dde48e2f7c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 12 Aug 2024 10:10:12 GMT
document-policy: force-load-at-top
x-fb-server-load: 18
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=25, rtx=0, c=64, mss=1328, tbw=64400, tp=-1, tpl=-1, uplat=129, ullat=0
pragma: public
x-fb-debug: hxwvnlEr3RkDnU5degS4TOC8GM0/Aj3jXoNaEYsJXnPIB/N8bgbwwatxPNXrIw9CvR9/7z72galrU+T9IeN33g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 87ms
19ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=504405910731415&ev=PageView&dl=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&rl=&if=false&ts=1723457412789&sw=1600&sh=1200&ud[external_id]=fc924c7550e6289eddde8fb0c7accbe8&v=2.9.164&r=stable&a=hubspot&ec=0&o=4126&fbp=fb.1.1723457412788.514162323686520343&ler=empty&cdl=API_unavailable&it=1723457412624&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=10, mss=1328, tbw=2807, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 12 Aug 2024 10:10:12 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 243ms
174ms Image
image/png 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=504405910731415&ev=PageView&dl=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&rl=&if=false&ts=1723457412789&sw=1600&sh=1200&ud[external_id]=fc924c7550e6289eddde8fb0c7accbe8&v=2.9.164&r=stable&a=hubspot&ec=0&o=4126&fbp=fb.1.1723457412788.514162323686520343&ler=empty&cdl=API_unavailable&it=1723457412624&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Mon, 12 Aug 2024 10:10:12 GMT
document-policy: force-load-at-top
x-fb-server-load: 38
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7402193221458578671", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=12, mss=1328, tbw=3125, tp=-1, tpl=-1, uplat=154, ullat=0
pragma: no-cache
x-fb-debug: jQ/uuxJMq5USvIQ3+ynP33w9LPz2P8Gkq5ucFPPvqyHlh496yZybDkGyRXVSecH68weFp4jw4zhcZl5Ilt0D2Q==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7402193221458578671"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
consent.cookie-script.com/ 47 B
450 B 422ms
282ms XHR
application/json 95.85.9.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.cookie-script.com/analytics?action=firstshown&time=1723457412950&script=bc9a5854c8f924860cb36995bf5d6172&category=
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.85.9.7 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: afc29b4f37b129a300be661004528c6829ae29a47c82ae325c56fb6d424f9373

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:13 GMT
via: 1.1 ad02191892ceb388ca997ca92099a6f4.cloudfront.net (CloudFront)
server: nginx/1.18.0 (Ubuntu)
x-amz-cf-pop: AMS58-P3
x-amzn-trace-id: Root=1-66b9df85-12c2a9092da6b637713083e3;Parent=234eb0e59e2058d6;Sampled=0;lineage=a8669a4e:0
x-amzn-requestid: a3cf7b24-4314-433b-ba92-d62cfe03b654
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: cY_c2HVyjoEEHcg=
content-length: 47
x-amz-cf-id: fVdCevdzlSXia33iyV3MXnoB9AM-T-j637XP1RwaWTEiQcRsKlrvRg==

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 712cba3fa8fa2aceeed253c363eb34d1c122a5159027d256815fc94b0941b3de

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30b8c08723b0af130800167aeee7da1d2c3419484e20b2c1d3db5833801bf294

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7f536fce1aaae1fb1642a19afca74b3c2bc6358760a34950560fba0b88747de5

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ccbcc3b899abfc282dadce5b52a66abd23a93fd86e7d4ae0a5251f806c4cb49

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 057c66a21640a78f04e51f348a8a7397ec35b99aa16685f8998d22e5433604be

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d42387631e2304003f2a38ee1a9272b97fbf8a113847408049fa3d56fff6323c

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 90 KB
27 KB 113ms
64ms Script
application/javascript 2606:4700::6810:762b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:762b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:13 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 2547
x-guploader-uploadid: AHxI1nP8SGii8BZD259gW59kfuDluPqIZzBTAhiZT5P-4wohYCpcS8YV6NTlSY5UaqEh4NgDTm8
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 16 May 2024 10:14:37 GMT
server: cloudflare
etag: W/"006455bd44ed289ddcc403d0ecd96ab0"
x-goog-hash: crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA==
x-goog-generation: 1715854477710382
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 91778
cf-ray: 8b1fac9feb2d2c2d-FRA
expires: Mon, 12 Aug 2024 10:27:46 GMT

GET
H3 200 / Show response
ws.zoominfo.com/pixel/6347031b9abfe055a2626d29/ 5 KB
2 KB 244ms
219ms Fetch
text/javascript 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/6347031b9abfe055a2626d29/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ed43217e4a8da9154a945aad8b90d9cac344cd167ac4f97143dcc164bd6ed1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

visited-url: https://de.vectra.ai/threat-actors/blacksuit#mitre-mapping
Referer: https://de.vectra.ai/threat-actors/blacksuit
_vtok: ODQuMTkuMTc1LjE4Mw==
_zitok: 9aa3b65dddd2bbe70f4f1723457412
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

date: Mon, 12 Aug 2024 10:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://de.vectra.ai
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 8b1faca1295f382c-FRA

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/6347031b9abfe055a2626d29/ Frame 0
0 225ms
177ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/6347031b9abfe055a2626d29/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://de.vectra.ai
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://de.vectra.ai
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b1fac9feb842bd5-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 12 Aug 2024 10:10:13 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 195ms
194ms Preflight
text/html 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://de.vectra.ai
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://de.vectra.ai
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b1faca07c302bd5-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 12 Aug 2024 10:10:13 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 2 B
341 B 175ms
174ms Fetch
application/json 2606:4700::6810:752b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:752b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://de.vectra.ai/
Authorization: bearer a1fec608a71bcf2bf8e7fc56376ffa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Aug 2024 10:10:13 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://de.vectra.ai
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
content-length: 2
cf-ray: 8b1faca1ba38382c-FRA
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK d4e0df2f-06da-4957-aeae-06a6a3a873e2 Show response
https://de.vectra.ai/ 5 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://de.vectra.ai/d4e0df2f-06da-4957-aeae-06a6a3a873e2
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed43217e4a8da9154a945aad8b90d9cac344cd167ac4f97143dcc164bd6ed1b4

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length: 4861
Content-Type: text/javascript

GET
H2 200 data.js Show response
tags.clickagy.com/ 79 KB
27 KB 156ms
23ms Script
text/javascript 2600:9000:211e:200:4:8491:f2c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.clickagy.com/data.js?rnd=62fe5c0e6ad95

Requested by

Host: de.vectra.ai
URL: blob:https://de.vectra.ai/d4e0df2f-06da-4957-aeae-06a6a3a873e2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:200:4:8491:f2c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6100a43a7f72a8dac04e5869184f6b8441118d1f5fb094431507158cc321c1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: cX36YfAVFn5xiqe3uq7t2YO1bfn0pYi5
content-encoding: gzip
via: 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
date: Sun, 11 Aug 2024 17:16:46 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: FRA56-C2
age: 60808
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 30 Jul 2024 17:03:18 GMT
server: AmazonS3
etag: W/"271de297b3d6d07537e3fe69cf19fd33"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: text/javascript
x-amz-cf-id: flHosLXrcIVa7lLUNsJVMfkMVvYI330Esh6JuOMM0hvM7BwftcdHkA==

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 12 KB
5 KB 146ms
20ms Script
application/x-javascript 18.172.103.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: de.vectra.ai
URL: blob:https://de.vectra.ai/d4e0df2f-06da-4957-aeae-06a6a3a873e2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.103.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-172-103-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f4d1e641d47b4af1b6cb7936c59626f4dbab3933473009b447406034c34facb5

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Mon, 12 Aug 2024 01:52:47 GMT
Content-Encoding: gzip
Via: 1.1 186bdaa7eeeac80deba6005ccbb75b56.cloudfront.net (CloudFront)
Last-Modified: Fri, 07 Jun 2024 09:20:53 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P8
Age: 29847
ETag: W/"a7eb6794e868fe870db350518165c868"
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: wkZA32pO0gHXIrfFrTPsz7h_ycm_SO3s8S6e-gQ5ULSA6jvv7TIEPA==

GET
H2 200 up
insight.adsrvr.org/track/ Frame 82E8 0
0 151ms
49ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=yphb7o4&ref=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mapping&upid=mommfm8&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://de.vectra.ai/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: text/html
date: Mon, 12 Aug 2024 10:10:13 GMT
server: Kestrel

POST
H2 200 data Show response
aorta.clickagy.com/ 57 B
503 B 525ms
124ms XHR
application/json 34.198.174.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://aorta.clickagy.com/data
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.174.254 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-174-254.compute-1.amazonaws.com
Software: Aorta/20240805.a964c367e /
Resource Hash: 11576a2975093c58774eb17f36a1b500211fb0bd4caf1dead1441a67ef81e278

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 12 Aug 2024 10:10:14 GMT
content-encoding: gzip
server: Aorta/20240805.a964c367e
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json
access-control-allow-origin: https://de.vectra.ai
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 89949a0a46e8
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 82

GET
H2

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://aorta.clickagy.com/pixel.gif?clkgypv=jstag&ws=1
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?cookieQ=1&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=28af76ae-4a54-4b62-bf43-b8c29c2a443c-66b9df86-5553
https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzowNjRmM2E5YmE3ZDAwOTFkZjhkMzE4ZDhhYmQ1OTU5YQ

170 B
409 B

271ms
46ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzowNjRmM2E5YmE3ZDAwOTFkZjhkMzE4ZDhhYmQ1OTU5YQ

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 12 Aug 2024 10:10:14 GMT
server: Aorta/20240805.a964c367e
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json
location: https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzowNjRmM2E5YmE3ZDAwOTFkZjhkMzE4ZDhhYmQ1OTU5YQ
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 89949a0a46e8
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H2 200 hasHashes Show response
hemsync.clickagy.com/external/ 2 B
323 B 427ms
123ms XHR
text/plain 34.206.125.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hemsync.clickagy.com/external/hasHashes?clkgypv=jstag&cb=null
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.206.125.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-125-101.compute-1.amazonaws.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 12 Aug 2024 10:10:14 GMT
content-encoding: gzip
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://de.vectra.ai
access-control-expose-headers: content-length, last-modified, expires, content-type
access-control-allow-credentials: true
content-length: 28

GET
H2

200

cm
us-u.openx.net/w/1.0/
Redirect Chain

https://aorta.clickagy.com/pixel.gif?cs=33:-1,37:1,43:-1,44:-1,47:-1,48:-1,52:1,38:1,53:1&fp=046a174cc483ee5bc2ccf4cce88ae634&u=https%3A%2F%2Fde.vectra.ai%2Fthreat-actors%2Fblacksuit%23mitre-mappin...
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=5&cm=28af76ae-4a54-4b62-bf43-b8c29c2a443c-66b9df86-5553
https://us-u.openx.net/w/1.0/cm?id=af408286-42f3-4d1c-bb48-10bd86dbcd66&r=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fch%3D4%26cm%3D%7BOPENX_ID%7D%26redir%3Dhttps%253A%252F%252Fus-u.openx.net%25...

43 B
295 B

79ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=af408286-42f3-4d1c-bb48-10bd86dbcd66&r=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fch%3D4%26cm%3D%7BOPENX_ID%7D%26redir%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537073026%2526val%253D%257Bvisitor_id%257D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://de.vectra.ai/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Aug 2024 10:10:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 12 Aug 2024 10:10:16 GMT
server: Aorta/20240805.a964c367e
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json
location: https://us-u.openx.net/w/1.0/cm?id=af408286-42f3-4d1c-bb48-10bd86dbcd66&r=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fch%3D4%26cm%3D%7BOPENX_ID%7D%26redir%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537073026%2526val%253D%257Bvisitor_id%257D
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 89949a0a46e8
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

Verdicts & Comments Add Verdict or Comment

95 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.adnxs.com/	1970-01-21 00:53:53	Name: XANDR_PANID Value: 6vSiA5jQYCl_VD4cOPsXaIi3LCBJ7JD8RBg7Yc2n5vvt1jO40y4FQPJ7zmsP7HOqrliZvvwJIcUSk-8VuPENZCTn-JLtNozAW9KC6V0JIrg.
.adnxs.com/	1970-01-21 08:20:17	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 00:53:53	Name: uuid2 Value: 2564410184532697727
.adnxs.com/	1970-01-21 00:53:53	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2Hc%s*da#!@wnf-Te9(>wL5L!!'jo$xsYq
.vectra.ai/	1970-01-21 08:20:17	Name: _ga_0F9PRG4D5J Value: GS1.1.1723457411.1.0.1723457411.60.0.0
.vectra.ai/	1970-01-21 08:20:17	Name: _ga Value: GA1.1.1694998451.1723457412
.bizible.com/	1970-01-21 07:29:53	Name: _BUID Value: c62d9e8cb9b44cc8ea2cfb8863b24763
.bizibly.com/	1970-01-21 07:29:53	Name: _BUID Value: 0cf0173126d5f47ca2d916fa4eb73106
.linkedin.com/	1970-01-20 22:45:43	Name: lidc Value: "b=TGST07:s=T:r=T:a=T:p=T:g=2907:u=1:x=1:i=1723457411:t=1723543811:v=2:sig=AQHTR2QZ40KWzxPn-GzcmaEH8_Vgdmbg"
.storygize.net/	1970-01-21 08:20:17	Name: U Value: b51d294b-0e79-45c5-b2ea-5e133629d11a
.linkedin.com/	1970-01-21 07:29:53	Name: bcookie Value: "v=2&0c333281-ff93-4a47-8559-6ee2ba44798b"
.linkedin.com/	1970-01-21 03:03:29	Name: li_gc Value: MTswOzE3MjM0NTc0MTE7MjswMjE3PHXC4+WvZa8DmBUsLULLnHcZbaGmFFArxRzJYNljGQ==
.hsforms.com/	1970-01-20 22:44:19	Name: __cf_bm Value: 03P2pfEP5XUlx1xUnyS_t_VJBTLgKmeeDxzYvhX9IDY-1723457412-1.0.1.1-R9uOZdmhPj7nA71dVqogX.imM9tFxZmWva9qDJwQKdrH7AFCGjYb0gF7Z7DH.40aSHvx9c_g.zFRFELvih5VEA
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: .2CQcIRlbBTko6VKaAg.eDYzkVRQSnbkzOK4Vgs3t2s-1723457412399-0.0.1.1-604800000
.hubspot.com/	1970-01-20 22:44:19	Name: __cf_bm Value: .SC.aT3ZW8MsnFRgGK9LW948Ff7zKlhOEVhsowh0vZg-1723457412-1.0.1.1-.mybQMlSbHMntjdQC4UNjUNk41SWZupfp8PHgt6cIVJRroOWuJD0lwWpedKpNsEo_Y1DUuwNUxXh1PzuYys4WA
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 3vqHYMqm7Ae3Y3b1msYZL6J7TV8PLFXJAmtieULENhg-1723457412700-0.0.1.1-604800000
.vectra.ai/	1970-01-21 03:03:29	Name: CookieScriptConsent Value: {"firstpage":"https://de.vectra.ai/threat-actors/blacksuit#mitre-mapping","bannershown":1}
.de.vectra.ai/	1970-01-21 07:29:53	Name: _zitok Value: 9aa3b65dddd2bbe70f4f1723457412
.zoominfo.com/	1970-01-20 22:44:19	Name: __cf_bm Value: 7In3p7VdXNbLAfhVl_RoemBZbPlMl_gkSa_4zQ1wolc-1723457413-1.0.1.1-CFmRPvCnMETasgFSzyqqlWDEHrzYFm6jSx9Pk3t_cH5AcJru_0RchYz32FCv7x5Qawo0gSbzLo1cQzKrvS_gHQ
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Atqb23Ztm5fw84OVBEA6aRu7WUBt.f4qqV1FscGYPUs-1723457413148-0.0.1.1-604800000
.sitescout.com/	1970-01-21 07:29:53	Name: ssi Value: 28af76ae-4a54-4b62-bf43-b8c29c2a443c#1723457414339

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alb.reddit.com
aorta.clickagy.com
api.hubapi.com
api.jetboost.io
api.weglot.com
assets.storygize.net
assets.website-files.com
attr.ml-api.io
cdn.bizible.com
cdn.bizibly.com
cdn.cookie-script.com
cdn.jetboost.io
cdn.jsdelivr.net
cdn.prod.website-files.com
cdn.weglot.com
cm.g.doubleclick.net
connect.facebook.net
consent.cookie-script.com
content.hotjar.io
cta-service-cms2.hubspot.com
d3e54v103j8qbb.cloudfront.net
de.vectra.ai
dev.visualwebsiteoptimizer.com
google.com
hemsync.clickagy.com
insight.adsrvr.org
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hubspot.com
js.zi-scripts.com
perf-na1.hsforms.com
pixel-config.reddit.com
pixel-sync.sitescout.com
px.adentifi.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.ml-attr.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
tags.clickagy.com
track.hubspot.com
us-u.openx.net
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google.de
www.googletagmanager.com
www.redditstatic.com
www.storygize.net
104.18.37.212
13.33.187.109
142.250.186.98
146.185.171.14
151.101.1.140
151.101.65.140
152.195.15.58
18.172.103.101
18.239.36.63
18.66.102.51
185.89.210.180
2001:4860:4802:34::36
2600:9000:206f:e400:5:7a81:86c0:93a1
2600:9000:211e:200:4:8491:f2c0:93a1
2600:9000:223e:ae00:1d:7a82:2900:93a1
2600:9000:235a:5800:11:3b84:d200:93a1
2606:4700:4400::6812:2866
2606:4700::6810:752b
2606:4700::6810:762b
2606:4700::6810:7674
2606:4700::6810:8ad1
2606:4700::6810:a0a8
2606:4700::6811:df98
2606:4700::6812:17b7
2606:4700::6812:1ccb
2606:4700::6812:50cc
2606:4700::6812:620
2606:4700::6812:f16c
2620:1ec:21::14
2620:1ec:51::12
2a00:1450:4001:800::200e
2a00:1450:4001:806::2008
2a00:1450:4001:80f::2003
2a00:1450:400c:c0c::9a
2a02:26f0:480:15::213:7e63
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42:400::396
2a04:4e42:600::485
34.198.174.254
34.206.125.101
34.36.216.150
34.96.102.137
35.244.159.8
52.0.218.89
52.215.135.129
52.222.232.47
52.223.40.198
54.186.117.241
54.237.133.81
68.67.153.60
95.85.9.7
03eda8a72aa1bdb055f2d6ddf6620cf30f73bef3181ce6b0634dc1411b6aecac
057c66a21640a78f04e51f348a8a7397ec35b99aa16685f8998d22e5433604be
0a3cb8e70dfe503b8cd036761a7490fff86becc902600b63fc13bfd1aa8100e8
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bd3981d2aa91f7e78a402853a2488b980c299481887025b86d25a469693266e
0cbbe6676a19feecc315d701be98ffef0a470187d2c7f48e7f5b65ef78aa23c1
11576a2975093c58774eb17f36a1b500211fb0bd4caf1dead1441a67ef81e278
1475fb54c3fb536fa21290c893f1822fd7f3215f71c00d35cd1f4674327a6407
159b16ec7d95e57f531a29d28e3c18278d7d5e46b6ec8f173c3996af21a55adc
17071d377ea43fbb1eddbbe1dc361c9b11cc5f3f216db2217ef3e71ba3a142c7
251214b83e86ba6b8ba5d810089b699d7cd43c9e4bbce2158655469a1af29852
2587eec3a21b89587f6d195cd3144e8f993d7bebb0d487fb2a2b011b172180fd
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4
2e7d7ee23e93df530d8d5815c6c7690458f580471ac49a5913e82c3daa8a9da2
30b8c08723b0af130800167aeee7da1d2c3419484e20b2c1d3db5833801bf294
3406693efa2caa9e71876669c022dbb2f4cb646b5a23f0f75e6574dde48e2f7c
35638404c448909f695c198049e27b151876151b68f65e4f8d183ede75150e14
3b13a4376eea9414e59374483f195612658d8018552c6b2bdfe5d22af8a7972a
3fde6213c4a18069057c21817e8d7dc4f60f3593cb2bb82138c3535286558ad5
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45da241a91c843b268ada7481cdece1aa679f2720931effea28d83e1398d66a9
463eb7e3abda6a5dce995d42748ec6666ab8b0776e41ce4e5c29247f7068bcc4
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ccbcc3b899abfc282dadce5b52a66abd23a93fd86e7d4ae0a5251f806c4cb49
4d424af8e6254a3ee915b6efdec3f0ed3fcbdedc67c83025148c9758701cd2d4
4d64cc6ca0696fecc817f893a5ef9f6652ff3d613ab65192ef458ce3b542f192
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
53bcfb23ecfd8ddecf82127563dcc1ae6ded7bc20145b7eadf9389ba22042f31
543936b06fb460b727e4b6f6af8e3ce5ac94c12cf332ff7863bcb64c96e81ddf
6100a43a7f72a8dac04e5869184f6b8441118d1f5fb094431507158cc321c1df
6755508f95a14ac65d6d5123ce9db08f5b0fc2921dd713a6ae8d6369a0020da9
6a8a5ff8cbdac0267a81d0a807be7ab0ef15ac5744d0c362b5b9dcf33f2160be
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
712cba3fa8fa2aceeed253c363eb34d1c122a5159027d256815fc94b0941b3de
71b3378ed1ac36e4c9a1200a956dd17f28ef920a0b092bfe571f3d31c978ac4b
720b43e5950b3ef9c934b9253a76353a916cc4399cc2d17bdc5a508ce2569d74
720d4a3364adb0f6dab95c8339fc8538a4388e302b8a8173d401e8471998ebf1
74ead537714075418990084153b333ae56192830d9aa78a0e26a08fd943b24c7
76f448ec45359e863fb3a6432a2a3cf22c0cc0a52aead6318b57ab38db6f1d14
7a5f93a9d8ce39ff9f1fb6a17ced9affc62912ed3a002623b4766b7591bc5b15
7d32b7333c868e53be80c77ddb26dfede4968587caf27110ab98681cce43b8b6
7f536fce1aaae1fb1642a19afca74b3c2bc6358760a34950560fba0b88747de5
83cf08660de339dfb5120203c5ef09db9d6ade4cce398bc54d99bc587f05afee
87bb5f9c9c8673b1e3df5e078a1bc2e1e4c663741772754f1f1d159a13b5666d
8b491cdb24890e79228ef659d0fb6bb612c93bab6d004cc823905f2763d42085
8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5
8e3e5b31023c7006e73fc1ba2be93fb1a072e38e60281d8a6523318434d67c21
90394dd8d123b5fb3ba9bca60d862d64fcd964d12fae1e367789e9c824aa009d
915fa75bf58286e38e8f7d94bb91e3df3dfd05ca948f481aab0c73304f734581
946f13782a43b0d1acb47534bee4c24dd90374c9e9e148cb578542929feb11c5
9cab4db5a77565548256c860f0c7e2c0ea06283c64d6c0873eddf042535b4d04
9d8d814ef6c16faa45496c01b52141e7e76743e22d33c4727979ddee73b96483
a51fd08066d221ce36e2beb0f1f4d93bae824fe902af79ed77a85342e3ad0268
a666d86ce0204f81556e5c7afb6b8e0b59d6f0d0dda2b0da24330bb2ade41fa0
a6684de05e4a50723b1203bebb56786a919e6265f6107a1a8c6e3d88a1fec284
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aea73c341c4a179fca2fa31b1c08909155ee353d85d0f225abb60e14b4e562b2
afc29b4f37b129a300be661004528c6829ae29a47c82ae325c56fb6d424f9373
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b42af48c8090e6c40a840ddc2a765b9261ae71af56af118fc0dfa71dd15308c3
b46101f572695e1a9b16ce4bdd8f095c50fc10e515435e67c336f31b0b8720f5
b6b6686c2925f60b319f2c96ac848d3fa8bc5772d6ec2d599e3b69e88aa26c73
b845a5bc27e7ba338ec36dba73bc2de4cd2c30a59bb0f0680b9c684e538fc043
bafed2167303a5db23f3c0f31e47919acd94d3edcc2ef276dafe753bd1c0bb60
c331cb393bb1d60883780386b457f367e75652e50858f19f469501ff5c274294
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d257d5bdfd1942c7b7962f25053cad1f62e461422edd77b532c5979ceb38ce4b
d42387631e2304003f2a38ee1a9272b97fbf8a113847408049fa3d56fff6323c
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd91547b4fc051d3db0de271fb5b80961a3b0401f9263b0dededd389886e1657
ddc451027c83a11707ac910f223f84f7bc51f3881197223978e2a717efa64c57
e0493a327e32fefb2364d63d96f2abf1b9cb8a1f8684a20c1f35c5dcca2875d4
e2c7f7f28e200266b5b82328e54f4b22fa88829fb6990f0821058442737d2cb2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e614e41cc0790ea8e7b93d6796ba9ff6e171dc575e84a01f3fe68fabb2d8e128
e6e2a25c4c1b69087d720776ff9569e9698c9ec52bdd5659c346bcaca9ce28d5
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
eccfeb64c6c1a964ac381914233e53a340c8f2c5804a59ab996a97ca5d302834
ed43217e4a8da9154a945aad8b90d9cac344cd167ac4f97143dcc164bd6ed1b4
edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef39bd0a71c2b42b5f7ee0138610aa384b1af3417ca2b0335140caccc51857be
f0c735b34e2a68c63208915f7c3ccd9244be8f1fd3d19f2e1578f9dbe0761464
f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225
f4d1e641d47b4af1b6cb7936c59626f4dbab3933473009b447406034c34facb5
f7cd6de8f5e39ba2754fbddd470637c8a9bdb1f57e88efde4eb06bb1baedc96e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fdfa6547db32dc7e47ae2f33143306c75ddac57854cdf0d29881dda144c9e38f

de.vectra.ai Open in urlscan Pro 2606:4700:4400::6812:2866 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

101 Requests

93 %HTTPS

54 %IPv6

40 Domains

56 Subdomains

51 IPs

6 Countries

2075 kBTransfer

5787 kBSize

21 Cookies

27 Outgoing links

Redirected requests

101 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

de.vectra.ai Open in urlscan Pro
2606:4700:4400::6812:2866 Public Scan

Screenshot
Live screenshot

Full Image

101
Requests

93 %
HTTPS

54 %
IPv6

40
Domains

56
Subdomains

51
IPs

6
Countries

2075 kB
Transfer

5787 kB
Size

21
Cookies

101 HTTP transactions
6 data transactions