www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

14 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Page URL
2. https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1694053639072%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fmedia-center%252Fpress-releases%252Fw3ll-phishing-report%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIg5tqSsVIw7QAAAYptdyXwESlOKAi6smbwaJPcRaxrDu-VYLZYMf8DK7IHvWbh9VwnfuZe6Od5vFL0nXHmxLa6wZl0

Request Chain 74

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10118.-fwEDadWk3mYEzhyKiaZMRR-umXwRbnO3ZJDl4E7EBNAARy1QOUiUoV2uAwuwcyI.V4gZMifqQKuzBg8r92QlqUtiumc%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10118.cdgWSsbWymwfN0LSBNXFoDyjyTM15TrFspI5_oiNOoffkMB3e_A74psAReUEnV1S02GBiRNBW12iyofYj0Ub_P8h1-KoQ7plYjMJZ29Za88%2C.pN19KA92LGQUMTRMy6kl07R2IgY%2C

Request Chain 96

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A437%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1110%3Acn%3A1%3Adp%3A0%3Als%3A1011290687882%3Ahid%3A517130043%3Az%3A120%3Ai%3A20230907042719%3Aet%3A1694053639%3Ac%3A1%3Arn%3A794102679%3Arqn%3A1%3Au%3A169405363975638661%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C46%2C24%2C0%2C0%2C%2C371%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1694053638319%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694053639%3At%3AW3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A437%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1110%3Acn%3A1%3Adp%3A0%3Als%3A1011290687882%3Ahid%3A517130043%3Az%3A120%3Ai%3A20230907042719%3Aet%3A1694053639%3Ac%3A1%3Arn%3A794102679%3Arqn%3A1%3Au%3A169405363975638661%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C46%2C24%2C0%2C0%2C%2C371%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1694053638319%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694053639%3At%3AW3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Request Chain 98

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10118.U2tVB6Uvlrzyc05pnR7J3oV2X_cbFSNp1fA9-s7rwtyqAN4c1EtmbyLzsWIWPaez.nDZ67lWJ75bMBKHwIFLpQYIEduw%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10118.dN34c6bui-UfaKyxjeDbc76egKuOcMYKKPWz359aXnuqo_tEhZaYn0oEnBFX2bVEWK4vNGzhxs2rojuXqHg3eN3_O-Tz-tIE1b1bwQalK5Q%2C.UHcC6ihFeD0RJWowArVLxeLMzag%2C

112 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/media-center/press-releases/w3ll-phishing-report/	7 KB 7 KB	139ms 25ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash fd0dcd19369c28fe5a9827a64958e9adb4d2d480f93b409ced6588bdc2b35de5 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Thu, 07 Sep 2023 02:27:16 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	340 KB 134 KB	117ms 50ms	Script text/javascript	136.243.22.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.22.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.212.22.243.136.clients.your-server.de Software nginx / Resource Hash bed6172d7a1cece0b29459f93c656cab1806d47e5958fcf229fec426554a6587 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:16 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	485 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 989b206883e266270e50edb68f4d4bb7ce5c9780be311946329f4ac8395dd47c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c50a7db7da128ae4b1be93baea6cb1268c24fbb6f42a973f5aeadf6a8b5f78ea Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 683 B	33ms 33ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 194c509b07863022fa9c7a3c8771a3c8f7f63a772f1262207fa5903feada146f Request headers Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 x-cfids - Response headers date Thu, 07 Sep 2023 02:27:17 GMT content-encoding gzip server nginx etag W/"MHJBI2N1ig6jFpj2OrXoWj2le9WO7zv1UV4UQkRcxfr+Oct6U+yxXZpZFOmc97egmd6iznqBxmPANDLneDBq5MkOcgPM3NlWnXdDLDSgxlGoaFMT+7Ve2ucjXYy5+yt7lfXlSTjrgRqgF//YLW4eMXLi" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
POST H2	200	fl Show response www.group-ib.com/api/	665 B 986 B	65ms 65ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=bab4f760-4cce-11ee-b244-c0ae87c36e36&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=MHJBI2N1ig6jFpj2OrXoWj2le9WO7zv1UV4UQkRcxfr%2BOct6U%2ByxXZpZFOmc97egmd6iznqBxmPANDLneDBq5MkOcgPM3NlWnXdDLDSgxlGoaFMT%2B7Ve2ucjXYy5%2Byt7lfXlSTjrgRqgF%2F%2FYLW4eMXLi Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ffc4ed2e235444ba3fcfe2dd868e9f18d124d7e0a16b4dcc7a614706f764e3fc Request headers Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	fl www.group-ib.com/api/	665 B 690 B	34ms 33ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=bab4f760-4cce-11ee-b244-c0ae87c36e36&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=kcQTCRIBeLGImij4gDF8Q7J3JBpJolCBT4ygI%2BQrJfbL9oy5SILVcN%2F5OuHD6Ym%2BjPvgmtmgDbmSsuEhwDOE6IKAYoOjzXbGPl2OnvFugZwRp4UHb1EPhrMu2kp36h0XobdJ6QgKnGKyK%2FoLyvE7YakeIKH2Rx5O6GBC Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/media-center/press-releases/w3ll-phishing-report/	76 KB 17 KB	46ms 45ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 81c43ed574787f2049d083e7239ce969beb82897f3c1aea740dcabcf9924041c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 16932 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Thu, 07 Sep 2023 02:27:18 GMT etag "417d-604b0c0cca245" last-modified Wed, 06 Sep 2023 13:30:55 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	340 KB 134 KB	55ms 55ms	Script text/javascript	136.243.22.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 136.243.22.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.212.22.243.136.clients.your-server.de Software nginx / Resource Hash bed6172d7a1cece0b29459f93c656cab1806d47e5958fcf229fec426554a6587 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:18 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	47ms 45ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 29 Jun 2023 07:01:06 GMT server nginx etag "1883-5ff3f43abc651-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	251ms 154ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id _l-Qd9OxbZOfNg84Kr5FqVLn6stiXc4phuir3C-y4zbHeaRKEXmXUg== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1008 B	168ms 71ms	Stylesheet text/css	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id JquLrSzkJQC-edgLZ7fu17BwN7g-Lkpy58Sgdv7CS3jhWU5bJoHLiA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	222ms 125ms	Stylesheet text/css	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id l_rcqnJFQUrrTeC7hQydu4TF9_o-AtBXUcWy1RYGEBVYlMSfTRb22g== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 310 B	46ms 45ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	239ms 143ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lyk6UeP3tH-QKXz0L1-ohP5pZTKyq2QlCYDeVDGAWn4lISuKnlZTAQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	single-press-release.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	226 KB 34 KB	188ms 92ms	Stylesheet text/css	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 48e508d263c255de59b8089e81676573c972ed906069953a29ac7c7b9d937be3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 33565 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 07 Sep 2023 02:26:28 GMT server nginx etag "3865f-604bb96640fd3-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id oLD2lIHNej033JPc3x1pWwLENuYH4T69MeyQes34dr-1Ye_LH0pi1w== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	526 KB 165 KB	97ms 33ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69ff013760515696c54749156ae5dba9f130fa01e2e355fec69a26e6d87f1892 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-encoding br age 285 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3611/bundles/project-v2.js&cfRay=802b7c13f2be1e4c-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"c4734e241af5f9cffb4ae77e895d98aa" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3611/bundles/project-v2.js date Thu, 07 Sep 2023 02:27:18 GMT x-amz-version-id t9RM7Hi5NxkmmXBn8QlzNFQ1kBe.nFZ5 via 1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 50abee57-271c-4172-a916-0e07ab8e099f x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 50abee57-271c-4172-a916-0e07ab8e099f last-modified Thu, 24 Aug 2023 09:52:45 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FOV9CWHvTM8jPhWTcF9vM9vCqH%2Bew%2BFKvdkGBVPU5PHe%2B5vZ6f2Y%2FM%2BDPbR%2F3y9OfXVU70hmLytBdMJxzojKi7kR7NNdILlspo9%2FRNg6g2yCemmj5AZO3feUzVW7jqAFKTeIHw%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 802b830848001e59-FRA x-amz-cf-id L5a5qFW-mNmDJrBFh9SgXY0KSAGkkRax_2L519rCDG0t7IghOgu_5Q==
GET H2	200	jquery-ui.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/	517 KB 125 KB	65ms 65ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/jquery-ui/jquery-ui.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "812a6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id _xFc1EXU6F3awgCFvt44_ShP8Aw77QWM3G8X31KaAm8iiaQUhB9GsA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	194ms 117ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id jfvdaMkGNXstpLq4qV9SNZmAfsVLL-LuKTIplv5spQlz-1gHlanG6Q== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	211 KB 46 KB	78ms 78ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9e74da602eceae93875543dd9a235f2fbbbca8c254c125bcb733fa6a0486c9bd Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 45806 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Aug 2023 09:55:26 GMT server nginx etag "34b3c-60215e5662e3c-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HMHSSyztrWJJRiT31m-dnuGuaYCLAdCTZXcrOCK9_rAz2gS_3mwnxA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	111ms 49ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c2afbb21fe8fd254d1eb619e9a01ce5a7347e0a6f5b9e268a9ac8942dfff90d7 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 9bbcaebe-c8e9-4ea7-bb7a-c9508e9616a1 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9bbcaebe-c8e9-4ea7-bb7a-c9508e9616a1 last-modified Thu, 07 Sep 2023 01:05:23 GMT server cloudflare x-trace 2B1DD2FA7311AEE1951A165E94E94B36EECFCB9E6B000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-qq6d7 cf-ray 802b830a0c9b917a-FRA
GET DATA	200 OK	truncated /	486 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6d1f928b7e6415068995f5be9476a2d7c83f4a710a7d9b66ef701bd01d3ebc4 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 00074df4341987761ff6873d69e43d620e9011ea7cb49c7cf7a9b663e0da5564 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 619 B	34ms 34ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 33376371409b6857a0404e4f5e8cfcb5997f12af93588235bf890e222864efb9 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Kh3Ou+eXOi8jjZ5UwgJTjCNtVkgMcJ25ainXfNSVfIDOroFQC/9cVjvZZRckAULXc9hQm9MOtkqUgWvwlZFWKfTbAyjHA0NhyTtHxGt5l4rMEweK5FLiPvepABe9yL4FQPmWe+c+Z2iLMwa1xBj4uOg4ANgXNYqesL0KdyYCK/KJjcWUqz8vcc05JIvy11MOjI/BpXQD2q7krDg2FqwR/WUZMV+5QJ5yIKy+h7RWOlFfEhh2HKKJJO5IBCPA5g== Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 W0u83b67020641c86064dc7c110d86c3d671958d x-cfids kcQTCRIBeLGImij4gDF8Q7J3JBpJolCBT4ygI+QrJfbL9oy5SILVcN/5OuHD6Ym+jPvgmtmgDbmSsuEhwDOE6IKAYoOjzXbGPl2OnvFugZwRp4UHb1EPhrMu2kp36h0XobdJ6QgKnGKyK/oLyvE7YakeIKH2Rx5O6GBC Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding gzip server nginx etag W/"tX8mEkCPDS2xVAh060tBKCABX5FNBhu6ZqDxMhC23bXhH2FZcQRprOvuEIErH9vXopKWkPGt0YZhYnoLfMGj8BBGKFHRF/wpZuOzjGeeSogzp168AqJS3y5Lfu4Qg8jLeHio/7TMJW7Z/QIDFZW3CGNjYwqwkMfdA536" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	192ms 137ms	Font application/x-font-otf	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 47755cdb8b36419a04f12ee3c24f7fae.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 8G6-7JqsTKdXuKJ-M68vK4Ky1rDMZFbeViBMHEdp6l6PxwpUts-n9Q== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	141ms 87ms	Font application/x-font-otf	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 47755cdb8b36419a04f12ee3c24f7fae.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id qkjuH14OQjczsi6TNfgCr1zi249M6dO5gqX4l-qupDtZ7DM35DTCAw== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	132ms 69ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3271c27ab337f4b6c625a6204e87a76c94718880e7a68455eeb854d6fbcb9a69 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 07 Sep 2023 02:27:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 79e6395f-1f11-489e-ba0e-a4579c0fd85c Transfer-Encoding chunked x-envoy-upstream-service-time 16 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 79e6395f-1f11-489e-ba0e-a4579c0fd85c Server cloudflare X-Trace 2B97BB742DFBD4D04E1811BB6950FED33A9A75656B000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 802b830a3e7b2c71-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	51ms 51ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HdJjhtXjOCitE3KFk-0iOKdWgr4o5MNlHG9UGPNCJr72KiAH2U_8SA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	128ms 81ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f5f8f93766fbaa7ff7e161d2868706b4a86d0d50c1f6aa47075ca0a16c7c2f18 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 07 Sep 2023 02:27:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 5fe96217-1454-4112-ac99-8c3d7147ba05 Transfer-Encoding chunked x-envoy-upstream-service-time 32 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5fe96217-1454-4112-ac99-8c3d7147ba05 Server cloudflare X-Trace 2BE340C434B46A138D96F9773B7D3CC32F3B1F2DB9000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 802b830a3fbf39eb-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vwr8b
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9ea2257901c25628c4a3175d2c16bf0534457b0036f55867b5091ddabc5b3a08 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1a5d3d0cff482199a4a025d461c057629477526912de80804db25d812b24424 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f24d1ba206933c9276b7f0387876cb5b19c89a753e28227abf1d9475482fb164 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5e230e505637c21cdc5a9716d9ff1164906c3fbc5815a99762e8bdd02023b4c6 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 973 B	117ms 116ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id I2lGKW8DrEVKo-33dJ_ddd9OTXiAY2Di1seInkSVBTvqP35ZiHzMqQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	46ms 46ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id pta_i0pVeSnNCMCDxmqHM11gCmbW-MkWvT3nS7_FhwRTiCTbPrtsGA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	76ms 62ms	Font application/x-font-otf	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 47755cdb8b36419a04f12ee3c24f7fae.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id TBS8HLP87TAnRhGknLGGfdoIV7MCjtKVp-CB6YJ-Wt8BBD-rukgqXw== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	97ms 50ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8345005c7a6b2b17c59647bbf5c57e9b06d884ac6db4cfc4675e2e786fb259f0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 07 Sep 2023 02:27:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id ae9a9290-7540-46c8-9503-7851664b98ea Transfer-Encoding chunked x-envoy-upstream-service-time 8 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ae9a9290-7540-46c8-9503-7851664b98ea Server cloudflare X-Trace 2B337F849E7820B0C2F1949328F5CC40464D6C40C1000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 802b830a6fa65c1a-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb
GET H2	200	gtm.js Show response www.googletagmanager.com/	267 KB 87 KB	94ms 41ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 798eb8b11408d6640537d808a17ccc79cca9ad9e0a4758573e23f662a77531ea Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 88408 x-xss-protection 0 last-modified Thu, 07 Sep 2023 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 07 Sep 2023 02:27:18 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	124ms 123ms	Script application/x-javascript	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id LLDHjecPdAq5VW3h4TwwJtQ-kfPlgQxZffhUiglWuOIhg0lec6oNWA== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	100ms 55ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff684b2b4277e47d1e38888a9fdc023498e616b46fe5af5309403e13bc3069cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Thu, 07 Sep 2023 02:27:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id e104d9b2-ac9a-40d5-9944-c4dba2d44063 Transfer-Encoding chunked x-envoy-upstream-service-time 12 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e104d9b2-ac9a-40d5-9944-c4dba2d44063 Server cloudflare X-Trace 2B53801016B61BE108B20EE6CA5813ADDE2870BEAC000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 802b830a7c532c59-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	202 KB 70 KB	261ms 126ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 85cf71c92009a4aa7f0b7a85ebc9a791a45f40dfde34bc49deac07a5fe1e13fb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:18 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Wed, 06 Sep 2023 17:31:30 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f88d42-114b7" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 70839 expires Thu, 07 Sep 2023 03:27:18 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	60ms 58ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 6VkPkAURiGQ1n5D4AuTLa_gbX8OAGfFtqDqFWNpmJB5si5JRzEbotg== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	telegram-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	53ms 51ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f134669d195076302131981e5fbcff6cf42dc48f5642c1a8e392862f7b4ca412 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 792 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fb-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id XBJF-95fKSWshZ8FVr5jfZhTuYRKjyymnLNaLConAL6bPoW9eUK5mQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	73ms 71ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id yt6sINDbd4IxNWDY7WNrzAzR76sj_495r7oSCajibc0vZnZP0J0ZlQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	twitter-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	59ms 57ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 811a0ac7da35a5fd342022f6587eec2f5ad3aa69dfdb05a7cea5224030617507 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 556 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id e8jjzXgXnkv5s3sL7pxioUUZ4qjHYUbXTg3pJ75RwtKnysJ-8fdyhQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	54ms 53ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id NljlcGcNv1Li6sU8zXsasVyUIZbducwT0spFTHAtpZwdtg2v3TKhVQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	linkedin-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	68ms 67ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbc32b11b85805050a7fbd85361a52e9c84a34cff6fa03d7d764b190c75fefe3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -bKvr77djrrA1OcmM8I3sLCc79kKeeJ0IHv_n3jpU-FeIkCj_Buxlw== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	whatsapp-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	66ms 65ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 45d44c2f23a04d49dbbb3f216ba72782ad80278cf7c4c330b1f03b8263c544ee Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 1046 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7e8-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ece1xqvocwmhwiEhiIz70GnwcR500VYcmuzn7q5uYL1_Q49Z-nGHtQ== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	whatsapp-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	83ms 82ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/whatsapp-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d3689b014c0ffdfe6c70af7141a0d708166ba120d136838de16b50a7394947a9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 1047 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7e7-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 3Hll3XMORnVj2Z7L4cQhTdzGsEWI4Xvs4AdKry-Zny-FrIqPi8TDqw== expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	46ms 43ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:18 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Thu, 07 Sep 2023 02:57:18 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	53ms 50ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id YtQ1u2tlqn39BPvZ0BSrhkfxpKlvcINWlHENemB-bJBxArVEz3vDcw== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	54ms 52ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id AkFnbaDhi7PXyUi3VtTm7HG2clVszh7bk5uDIKaILbkEVEDY7-d8Kw== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	51ms 49ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id U8atP1LES2zi9FKrJBLW_WtkVw7IgyAdzkaaNnWc03-e-Sr_yQsXKg== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	64ms 62ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id dv19MG3VZf5NKXFF_EogsRGX1x6Do-GINbgHNpqaOQTcXpzHPR71Pg== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	137ms 135ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id l-HAn7lmWezFHBmUXXdKxVZfkqCZDMxiuZZYHCBWD1xJse1QL6hU-g== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	136ms 134ms	Image image/png	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id UNdmUna-0MFC1KL0wH3MouMGkEge5MoPyA2fnqU6S2FbUyNj8hqaDw== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H2	200	well-release.jpg website.cdn.group-ib.com/wp-content/uploads/	1 MB 1 MB	70ms 69ms	Image image/jpeg	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/well-release.jpg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8b5f5f6cc86dec6f21326d1fd99fcb6bbdf30d0b0d1c89fbd2ea31cbfb8de844 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Thu, 07 Sep 2023 02:27:18 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 1070334 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 05 Sep 2023 07:31:10 GMT server nginx etag "1054fe-604979c5c49d0" x-frame-options sameorigin content-type image/jpeg access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id WFVkhIUAUwUCvuQNn_dQ7_NbwCTJGKeYqzSInQmftPrunFwEbWQe0g== expires Thu, 07 Sep 2023 02:27:17 GMT
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1016 B	182ms 132ms	Image image/gif	2606:4700::6811:eff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:eff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:19 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id aca3e62a-2234-457a-9479-3a0ddf02a9db x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id aca3e62a-2234-457a-9479-3a0ddf02a9db Server cloudflare X-Trace 2B4507D7FC8472C530F713D1244933477EA1927175000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-7f89ffc67f-fz7bv Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 802b830b6848360b-FRA
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 3 KB	117ms 31ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13a212c6b892024aae8c2db3d8cf9a5ec7d7f0f86948669384001e375a55edb5 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-amz-version-id ejB.A_S_mq2WBFqiJyHsLYTQXyGD1Wjj via 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 324 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.406/bundles/pixels-release.js&cfRay=802b7b253ac52ba9-FRA x-cache Hit from cloudfront x-hubspot-correlation-id 9b9e9410-2b5c-4055-a1c7-1073b6ca38a0 cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9b9e9410-2b5c-4055-a1c7-1073b6ca38a0 last-modified Mon, 28 Aug 2023 04:02:35 UTC server cloudflare etag W/"0d4f9e1a24521caddccf596277344ec4" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 802b830bef9c2bbc-FRA x-amz-cf-id AWMckF770M6KFyzz0k--sEJtw2vggR9fgLYwpp7RnS39FJpMZwkqAw== x-hs-target-asset adsscriptloaderstatic/static-1.406/bundles/pixels-release.js
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1694053500000/	66 KB 21 KB	122ms 62ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1694053500000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92a2a1ad72d4811d1c79b6fb44e50c193f2d514b2fe36e946577d80c6254ce4f Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br cf-cache-status MISS x-amz-request-id RQQV52HG67QKSDQ9 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 210f2dff-f9e4-46ad-81c8-00fe5088e81c x-envoy-upstream-service-time 20 x-amz-id-2 NG6D0bels8jU1zpRUxhcoUsk7NOwc/Vl+QJK780zJf46fKVYRQ5EsaJDrrnw873hS5ibEZMH1Gg= x-evy-trace-listener listener_https x-request-id 210f2dff-f9e4-46ad-81c8-00fe5088e81c x-evy-trace-route-configuration listener_https/all last-modified Wed, 16 Aug 2023 15:02:57 GMT server cloudflare etag W/"eaed25f45513b2c42381986283dfda58" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-mmx2s cache-control max-age=300,public access-control-allow-credentials false cf-ray 802b830bc93a2bb6-FRA expires Thu, 07 Sep 2023 02:32:19 GMT
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	155ms 68ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76cad6003ccfa9b83430a57d5c8365dec62d0799619adcf257e4d762fe499c0a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-amz-version-id Gr5hDFYfL2RydCQo7DZDtOTuBy6zWKNp content-encoding br cf-cache-status REVALIDATED x-amz-request-id Z0MED6NW81JYNF8R x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 14bf2421-625c-4bde-ba0d-1988b606803c x-envoy-upstream-service-time 43 x-amz-id-2 ggIQWhQsQi8JoOSJCspvo4k9eqnTFI6iIeY5xpqpM2D/WUO8+GWNMmNYHQf+/dobkfGd6JIorsY= x-evy-trace-listener listener_https x-request-id 14bf2421-625c-4bde-ba0d-1988b606803c x-evy-trace-route-configuration listener_https/all last-modified Tue, 05 Sep 2023 17:16:06 GMT server cloudflare etag W/"521e41ed5a9a8b6bea16ac212e4e6633" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-k9w6j vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 802b830bec4e35e2-FRA expires Thu, 07 Sep 2023 02:32:19 GMT
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	119ms 35ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 026c249acda71b64fe2510542d88ae26073694f89b595b1fd0e9f3ad501bf6b4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-amz-version-id EcjZkyUfgxNGQ.xnv1Vqq9Oda2f1T.dE via 1.1 1f0db25765b79d244ad1fa2184395c12.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED x-amz-cf-pop FRA56-P2 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 95d23fb3-24da-4845-a39c-7ed62f78c715 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.394/bundles/project.js&cfRay=802b830beb80085c-FRA x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 1 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 95d23fb3-24da-4845-a39c-7ed62f78c715 last-modified Wed, 09 Aug 2023 09:05:38 UTC server cloudflare etag W/"6fb5b8aa66d730f2a49b41a9c712ffa7" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all x-hs-cache-status HIT cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 802b830beb80085c-FRA x-amz-cf-id 2RbQ9_yJuZNj6odQQf6BqM7TXG4s99Om-QgPyCs_zaEZB6D7tn1WBw== x-hs-target-asset collected-forms-embed-js/static-1.394/bundles/project.js
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	97ms 50ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:19 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id a2251a98-639d-4a04-9943-d1e6164aefb1 x-envoy-upstream-service-time 2 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a2251a98-639d-4a04-9943-d1e6164aefb1 Server cloudflare X-Trace 2B4CDC1082934000D7EBC999C49B499BDB39784F8F000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 802b830c2e4a3764-FRA
GET H2	200	collect px.ads.linkedin.com/	0 450 B	252ms 204ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1694053639023&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 97E99BDC3087407BB1EE22368693ADD7 Ref B: FRAEDGE2011 Ref C: 2023-09-07T02:27:19Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYEu5lkpTA+wGEMaRisng==
GET H2	200	6si.min.js Show response j.6sc.co/	51 KB 15 KB	191ms 43ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 24 Aug 2023 22:29:49 GMT server nginx/1.14.0 (Ubuntu) etag "64e7d9dd-cc38" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14993 expires Thu, 07 Sep 2023 02:27:19 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	89ms 35ms	Script text/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1694053639066&cv=11&fst=1694053639066&bg=ffffff&guid=ON&async=1&gtm=45He3960h2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&hn=www.googleadservices.com&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&auid=1687980549.1694053639&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 310eeb29e4104db557a554debe655f38223881c7305176aca76b77fe62d92990 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1411 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	125ms 30ms	Script application/javascript	18.66.192.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.192.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-192-94.muc50.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Wed, 06 Sep 2023 21:13:30 GMT content-encoding gzip via 1.1 6ef87569c26a159f552948d3c30a2be0.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop MUC50-P1 age 18845 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id 9pE3tIW2bMBauy9_7FbEdsrdxEX3NnpT-RtZ6J5trw4HiNBTIiffFA==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	248ms 188ms	Script text/javascript	2606:4700::6810:890f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:890f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 7e80c78c40fccd6cdc92e3483a6cdba2577bed41d77626a656c2883d880be5c4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 802b830cad501e56-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	193 KB 52 KB	82ms 22ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 07 Sep 2023 02:27:19 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 52127 x-xss-protection 0 pragma public x-fb-debug 4xHqNJX3iSYgP4NJy7diM0Ykbx4Rp5FDseLVHHBAXDC/IyIkyW/t0OPMMFe/mwoMCwl/RnTX+DzkEkrOMRd5xg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	282 KB 92 KB	41ms 39ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 136c651511f28435b7e64ff7e02e0b01c0f564a056e0a0f36aaef0a7274b99ed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 93855 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 07 Sep 2023 02:27:19 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1694053639072%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fm... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true&... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true...	0 264 B	285ms 211ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIg5tqSsVIw7QAAAYptdyXwESlOKAi6smbwaJPcRaxrDu-VYLZYMf8DK7IHvWbh9VwnfuZe6Od5vFL0nXHmxLa6wZl0 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 371F92D2D8794294A2A0D3AF2E49FD0F Ref B: FRAEDGE1419 Ref C: 2023-09-07T02:27:19Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYEu5lwcxVHYHPeepf5cA== Redirect headers date Thu, 07 Sep 2023 02:27:19 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: CD26D6468CD947F194BD499A557328D1 Ref B: FRAEDGE2011 Ref C: 2023-09-07T02:27:19Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1694053639072&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIg5tqSsVIw7QAAAYptdyXwESlOKAi6smbwaJPcRaxrDu-VYLZYMf8DK7IHvWbh9VwnfuZe6Od5vFL0nXHmxLa6wZl0 x-li-proto http/2 content-length 0 x-li-uuid AAYEu5lsEb42KNUI1xKieQ==
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 402 B	68ms 54ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id cd6fddd3-f757-4b2a-ba23-9e453efd08a9 x-envoy-upstream-service-time 8 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cd6fddd3-f757-4b2a-ba23-9e453efd08a9 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 802b830cabe1085c-FRA
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	98ms 42ms	XHR application/json	2a06:98c1:3200::90:3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 5bc1f2d6-47d3-4eb3-a61a-fe20c20d4c88 content-encoding br x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5bc1f2d6-47d3-4eb3-a61a-fe20c20d4c88 server cloudflare x-trace 2B29613DC0A32B1F8A645776481AC9B3A1C640ECEB000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-qtbfk report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZeUpRI%2BtIC70%2Bxz1%2FgqgTkHtcq9hgatFJcx3J85W41epT8E9NKGc%2BYt899ijY2eEla9DWFkg2ufzld4bfEo2k8mAS9IdRELGvXpFdsvYr8CCApKPNlBPRnRpO15nCXzK0oo2LDhfVYCfjq6EMf8inQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 802b830cea665bf9-FRA access-control-allow-headers *
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10118.-fwEDadWk3mYEzhyKiaZMRR-umXwRbnO3ZJDl4E7EBNAARy1QOUiUoV2uAwuwcyI.V4gZMifqQKuzBg8r92QlqUtiumc%2C https://mc.yandex.com/sync_cookie_image_decide?token=10118.cdgWSsbWymwfN0LSBNXFoDyjyTM15TrFspI5_oiNOoffkMB3e_A74psAReUEnV1S02GBiRNBW12iyofYj0Ub_P8h1-KoQ7plYjMJZ29Za88%2C.pN19KA92LGQUMTRMy6kl07R2IgY%2C	43 B 67 B	71ms 71ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10118.cdgWSsbWymwfN0LSBNXFoDyjyTM15TrFspI5_oiNOoffkMB3e_A74psAReUEnV1S02GBiRNBW12iyofYj0Ub_P8h1-KoQ7plYjMJZ29Za88%2C.pN19KA92LGQUMTRMy6kl07R2IgY%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10118.cdgWSsbWymwfN0LSBNXFoDyjyTM15TrFspI5_oiNOoffkMB3e_A74psAReUEnV1S02GBiRNBW12iyofYj0Ub_P8h1-KoQ7plYjMJZ29Za88%2C.pN19KA92LGQUMTRMy6kl07R2IgY%2C date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 162 B	63ms 63ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 last-modified Wed, 06 Sep 2023 17:31:30 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f88d42-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Thu, 07 Sep 2023 03:27:19 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	85ms 29ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je38u0h1&_p=809136020&_gaz=1&cid=907303838.1694053639&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&sid=1694053639&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&dt=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	90ms 30ms	Ping text/plain	2a00:1450:400c:c09::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=907303838.1694053639&gtm=45je38u0h1&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	89ms 33ms	Image image/gif	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=907303838.1694053639&gtm=45je38u0h1&aip=1&z=1049927537 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	348ms 48ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=4 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:19 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 5422bf75-a1b6-4350-8ca7-8fbccea748fd x-envoy-upstream-service-time 8 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5422bf75-a1b6-4350-8ca7-8fbccea748fd Server cloudflare X-Trace 2B3597FC95F323ED9716887B280D80833287D14719000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 802b830efff23764-FRA
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	87ms 33ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1694053639066&cv=11&fst=1694052000000&bg=ffffff&guid=ON&async=1&gtm=45He3960h2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&fmt=3&is_vtc=1&random=1999693037&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 154 B	77ms 35ms	Image image/gif	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1694053639066&cv=11&fst=1694052000000&bg=ffffff&guid=ON&async=1&gtm=45He3960h2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&fmt=3&is_vtc=1&random=1999693037&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	151 KB 39 KB	91ms 90ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.125&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8cdc079c1148107cf3193fa939980fed648856a57aa0aa94998dfa4f5492775a Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 07 Sep 2023 02:27:19 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug TbjYfzQ/O4edZipVo2iQRefT0OGb6rMMFlMSrRTthqCGpdC4uELeupWw2g3ZdvRBf0Bw/nS+8KArJQp1IhMUMA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	220 KB 76 KB	35ms 35ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b89370729c5b86e750b71044633f4485d5dc72f69523b1b770d7cfcdd18abf34 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78269 x-xss-protection 0 last-modified Thu, 07 Sep 2023 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 07 Sep 2023 02:27:19 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	220 KB 77 KB	43ms 43ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 18907477d59cefb48660c077286fd2e329860054fdffc8a0fc9978bf567a4143 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78316 x-xss-protection 0 last-modified Thu, 07 Sep 2023 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 07 Sep 2023 02:27:19 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	460ms 148ms	Script application/javascript	44.207.137.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_142263 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.207.137.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-207-137-188.compute-1.amazonaws.com Software nginx / Resource Hash 194952f8e321de7a45487e490b1b017f890d9d5160a1e87209a93b02eeeb1be2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 283 B	415ms 137ms	Script application/javascript	44.207.137.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_409819 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.207.137.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-207-137-188.compute-1.amazonaws.com Software nginx / Resource Hash c66edb75b05f6237c31f4717a6e61e22c24fb8bfc5369348de96b6631f503050 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	412ms 146ms	Script application/javascript	44.207.137.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_773736 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.207.137.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-207-137-188.compute-1.amazonaws.com Software nginx / Resource Hash 7337f7c3b9d38774ed2d918adb5904ad408103f210a8dc294dc014a1aeef3120 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 281 B	402ms 139ms	Script application/javascript	44.207.137.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_17034 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.207.137.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-207-137-188.compute-1.amazonaws.com Software nginx / Resource Hash 0837b96298e4aa919ece8eaa5f04b058d81097e6b83f5f74d3dd0adc7db4c00f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	64ms 43ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	35 B 334 B	108ms 23ms	XHR text/html	2a02:26f0:ab00::214:8e41 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 99be3a7689bdb2534f29c3ea2c0edc2a6467c051d26c243b241200a2596fb5be Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:1010:2:1012:4a7:34d9:3431 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1694053639346_34901565_357074_28_774_21_46_219";dur=1 content-length 35 expires Thu, 07 Sep 2023 02:27:19 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	238ms 231ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=59420521-9800-456c-869f-8dd28bca2c47&session=f5ee4cb2-c68e-4f4a-8c29-f1b7899ff71c&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2007%20Sep%202023%2002%3A27%3A19%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2007%20Sep%202023%2002%3A27%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2007%20Sep%202023%2002%3A27%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2007%20Sep%202023%2002%3A27%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20today%20published%20a%20new%20threat%20report%20%E2%80%9CW3LL%20DONE%3A%20HIDDEN%20PHISHING%20ECOSYSTEM%20DRIVING%20BEC%20ATTACKS%E2%80%9D.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pageViewId=41ad8f5a-e11e-4993-80c4-14c6ad6c322a&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	37ms 36ms	Script text/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1694053639330&cv=11&fst=1694053639330&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&hn=www.googleadservices.com&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1687980549.1694053639&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f06ed89ac956ca9afc924d7d867d46a630ae8a6ba7cb153c1b81f32d4d3ca1ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1423 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	70ms 23ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&if=false&ts=1694053639355&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1694053639353.2007654785&cs_est=true&it=1694053639229&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 07 Sep 2023 02:27:19 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	35ms 35ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1694053639330&cv=11&fst=1694052000000&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2595419386&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	36ms 35ms	Image image/gif	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1694053639330&cv=11&fst=1694052000000&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&frm=0&tiba=W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2595419386&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%2... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C...	435 B 769 B	64ms 64ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A437%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1110%3Acn%3A1%3Adp%3A0%3Als%3A1011290687882%3Ahid%3A517130043%3Az%3A120%3Ai%3A20230907042719%3Aet%3A1694053639%3Ac%3A1%3Arn%3A794102679%3Arqn%3A1%3Au%3A169405363975638661%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C46%2C24%2C0%2C0%2C%2C371%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1694053638319%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694053639%3At%3AW3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash c34591328f89c497bee30b17d31928e9c77460eff170f50a86e34cdd6608fb45 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Thu, 07-Sep-2023 02:27:19 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Thu, 07-Sep-2023 02:27:19 GMT Redirect headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 last-modified Thu, 07-Sep-2023 02:27:19 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A437%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1110%3Acn%3A1%3Adp%3A0%3Als%3A1011290687882%3Ahid%3A517130043%3Az%3A120%3Ai%3A20230907042719%3Aet%3A1694053639%3Ac%3A1%3Arn%3A794102679%3Arqn%3A1%3Au%3A169405363975638661%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C46%2C24%2C0%2C0%2C%2C371%2C1%2C%2C%2C%2C489%3Aco%3A0%3Acpf%3A1%3Ans%3A1694053638319%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694053639%3At%3AW3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Thu, 07-Sep-2023 02:27:19 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	241ms 241ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=59420521-9800-456c-869f-8dd28bca2c47&session=f5ee4cb2-c68e-4f4a-8c29-f1b7899ff71c&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A1010%3A2%3A1012%3A4a7%3A34d9%3A3431%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20today%20published%20a%20new%20threat%20report%20%E2%80%9CW3LL%20DONE%3A%20HIDDEN%20PHISHING%20ECOSYSTEM%20DRIVING%20BEC%20ATTACKS%E2%80%9D.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pageViewId=41ad8f5a-e11e-4993-80c4-14c6ad6c322a&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10118.U2tVB6Uvlrzyc05pnR7J3oV2X_cbFSNp1fA9-s7rwtyqAN4c1EtmbyLzsWIWPaez.nDZ67lWJ75bMBKHwIFLpQYIEduw%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10118.dN34c6bui-UfaKyxjeDbc76egKuOcMYKKPWz359aXnuqo_tEhZaYn0oEnBFX2bVEWK4vNGzhxs2rojuXqHg3eN3_O-Tz-tIE1b1bwQalK5Q%2C.UHcC6ihFeD0RJWowA...	43 B 79 B	63ms 63ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10118.dN34c6bui-UfaKyxjeDbc76egKuOcMYKKPWz359aXnuqo_tEhZaYn0oEnBFX2bVEWK4vNGzhxs2rojuXqHg3eN3_O-Tz-tIE1b1bwQalK5Q%2C.UHcC6ihFeD0RJWowArVLxeLMzag%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10118.dN34c6bui-UfaKyxjeDbc76egKuOcMYKKPWz359aXnuqo_tEhZaYn0oEnBFX2bVEWK4vNGzhxs2rojuXqHg3eN3_O-Tz-tIE1b1bwQalK5Q%2C.UHcC6ihFeD0RJWowArVLxeLMzag%2C date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
POST H2	200	fl Show response www.group-ib.com/api/	665 B 1005 B	86ms 85ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=bab4f760-4cce-11ee-b244-c0ae87c36e36&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=tX8mEkCPDS2xVAh060tBKCABX5FNBhu6ZqDxMhC23bXhH2FZcQRprOvuEIErH9vXopKWkPGt0YZhYnoLfMGj8BBGKFHRF%2FwpZuOzjGeeSogzp168AqJS3y5Lfu4Qg8jLeHio%2F7TMJW7Z%2FQIDFZW3CGNjYwqwkMfdA536 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 18a168ccf4e97deb26202d7560a68192b29e950a238f81a4fec1e15d71691aef Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Kh3Ou+eXOi8jjZ5UwgJTjCNtVkgMcJ25ainXfNSVfIDOroFQC/9cVjvZZRckAULXc9hQm9MOtkqUgWvwlZFWKfTbAyjHA0NhyTtHxGt5l4rMEweK5FLiPvepABe9yL4FQPmWe+c+Z2iLMwa1xBj4uOg4ANgXNYqesL0KdyYCK/KJjcWUqz8vcc05JIvy11MOjI/BpXQD2q7krDg2FqwR/WUZMV+5QJ5yIKy+h7RWOlFfEhh2HKKJJO5IBCPA5g== Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 vDHK0516dd75e446231ba52bbf2664890a788337 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 07 Sep 2023 02:27:19 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 5 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	67ms 67ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&charset=utf-8&hittoken=1694053639_a3e37a6782f5387e3f2bbe2a1321d2ac27c83e3105287bfa68692300ff07959d&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1110%3Acn%3A1%3Adp%3A1%3Als%3A1011290687882%3Ahid%3A517130043%3Az%3A120%3Ai%3A20230907042719%3Aet%3A1694053640%3Ac%3A1%3Arn%3A724208993%3Arqn%3A2%3Au%3A169405363975638661%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1694053638319%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694053640&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)lt(12400)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Thu, 07 Sep 2023 02:27:19 GMT strict-transport-security max-age=31536000 last-modified Thu, 07-Sep-2023 02:27:19 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Thu, 07-Sep-2023 02:27:19 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	343ms 42ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:20 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 7c13ea91-3e50-4581-836d-4026196410d2 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7c13ea91-3e50-4581-836d-4026196410d2 Server cloudflare X-Trace 2BEF84FF0AE1FD66B0940B91C1F7A73EFB77EF545C000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vvgjb Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 802b831319fc3764-FRA
POST H2	200	/ Show response www.facebook.com/tr/ Frame E68B	0 50 B	23ms 22ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 07 Sep 2023 02:27:19 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	148 KB 38 KB	85ms 85ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.125&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 179b21209116a88d744e53998740ad6d4d69f8ad0389f910b1603dd69d2e1233 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 07 Sep 2023 02:27:20 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug YHkD5Q+kCZum6/8RpueqrBrG6jMniUpEmnKoByNshdEJ0nkaOJRzI6CbMxLKJv6ApI2wvTjUTIPA5YHsLD++UA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 596 B	126ms 66ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640236&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4c5e9873-9353-4339-84b3-5d0e783de2cd p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 1 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4c5e9873-9353-4339-84b3-5d0e783de2cd last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nN1t07aBUMyOjfdfKKnicgyiWR87wH08P1W%2Fm9hK4VP30LwjJZ68m4bEKE0omQNlgBFqKr6eIYiy%2F4xHHjHOfabluNti91CarZBtlZpgcXXm8%2BZcl44WfkG%2FE%2F0dzDoeIM6y1YI%2Bzg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-4x9zf x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd29bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	72ms 64ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=e5baa90f-707f-4266-a399-578af133f9b9&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640243&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6facba22-45af-4c35-95d5-b1a2e8bc2876 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6facba22-45af-4c35-95d5-b1a2e8bc2876 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2YQPRZclwxFPlxpbol7zDE%2BAIzSRk8q5R6ixnTTYpLQsSLSA9IymcQNJIiqFSz8WCtb%2BbubVtaZBCcNJ39CujjhR1MEFhNMixGkOpJH90eG8fQtTmTiCgUcNkpb799yxgCiR4Eq4Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-pldpr x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd59bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	76ms 69ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=e5baa90f-707f-4266-a399-578af133f9b9&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640249&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b9f25f0c-0986-40c3-83cd-042c6676bf9e p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b9f25f0c-0986-40c3-83cd-042c6676bf9e last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SoF7eWoK1gB%2Fl%2Fi3JrCmLxFwx9VHAxGKWkO8zHMjLUBpkW%2BbU6K%2BsYl7TuSa3O4da6MRszLm%2BqRIlT0aaUtrt8Icbntt8xzjWKhC1fOwZ6bFr9C%2FPbXF1o3cErylR5YFcoAJ9KZ2lA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-2ds5g x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd89bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 641 B	77ms 70ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=9f238de5-22c3-4352-bd02-97ea3998fafa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640253&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 44efcad1-9c53-499a-a907-28d58938c4b5 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 44efcad1-9c53-499a-a907-28d58938c4b5 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x6qOJO0HC%2FvsNZYvT%2Bcz%2F73O2Q39uD7uwrB6Jt5XJXiViyATtjjTV3PCYJjvy%2FM4%2F4XqQy3NNcZq8KoTPH3aTVEU2PvybLkPY5Axa1PdFDOxwq9%2FTh5dYSzTXFZ3%2BJ%2FEb6vskpc7oA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-bpkrq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd69bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	72ms 65ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=9f238de5-22c3-4352-bd02-97ea3998fafa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640258&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b679d6a8-9296-4f5c-b4fc-61e1235ea5f6 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 5 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b679d6a8-9296-4f5c-b4fc-61e1235ea5f6 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9eK2sOsKnQz5K76HodbFK7UI1vftHWCjlXLYBtO8HHWeBqPz9Ag5wNnmfu6Jz%2BihMTfEbv8JIgyxZXCAZL%2FJq9kIJaX9Mqwoh02jvE1rIKUZxd1dfVDtndsb02VSxXZLVgFi6j8GGA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-4x9zf x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd39bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	74ms 68ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=af8642c7-503c-40c8-9038-8312fa820c5e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640262&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 39a30436-df3f-4891-86e7-067b7572e737 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 39a30436-df3f-4891-86e7-067b7572e737 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tPIZi%2BdTVOKijslvKYCHntmfjFiEKitAGLDQyWC8m7W9x%2Be9oXI0rH%2BbUDt3SWjT9nrCxGXUEuvOcnYfDPmIA%2BuXa4Nt9L69XpYaUmQdBHr%2BtE2SwW0ZNfr5zABQfuLAkJAMraGYGA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-q78v7 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b83142fd49bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	51ms 51ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=af8642c7-503c-40c8-9038-8312fa820c5e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640265&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 42c1ef5f-3fa9-4f36-b26c-85a4f4408ea9 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 42c1ef5f-3fa9-4f36-b26c-85a4f4408ea9 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llqxHzoTl0Ym46icSrOQvGRvXngQ%2BfJe2BO8qIGK%2BB0akpwKHWmJm5rl5FGJHxXMuaFyEW6PsooMX6px673di%2Bg25g3oOH5Z42UwxNwHodTIroPazWmagNE0bbntU5ApcfsUgcogzQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-kwr7q x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b831468039bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 598 B	64ms 64ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=3f7c4910-c85d-4fac-873b-6b462efc34d8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640267&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 446747e7-b00b-4425-b607-6534d0be8d59 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 446747e7-b00b-4425-b607-6534d0be8d59 last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WOByt8c8%2Bs1TDxdX%2BBi6OSIpAXKlwyBP%2BOsuK8x2dgPCstFWdK4914WcuvOJzB2r294nRbWxkW96NJXGUNUD7%2BzhwdiGZ521xx9xBb6UiYknuQpofAj%2FqG20uo%2FvPd4Iq%2BJo%2FetXqg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-kwr7q x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b831468049bbf-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 592 B	67ms 66ms	Image image/gif	172.65.240.166 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=3f7c4910-c85d-4fac-873b-6b462efc34d8&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4254527045&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&t=W3LL+oiled+machine%3A+Group-IB+uncovers+covert+BEC+phishing+empire+targeting+Microsoft+365+%E2%80%93+report+%7C+Group-IB&cts=1694053640269&vi=e211147cd86978b766ad3fd9dc6de76f&nc=true&u=84897990.e211147cd86978b766ad3fd9dc6de76f.1694053640221.1694053640221.1694053640221.1&b=84897990.1.1694053640222&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 3be6cb99-e382-4b52-85c1-d5a9b64f54ea p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 3be6cb99-e382-4b52-85c1-d5a9b64f54ea last-modified Thu, 07 Sep 2023 02:27:20 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1ZYbAAVFuKlY1Qxf%2BXMslHn7kFBjThdlealyQU3vj%2FRSnvR1mN1N377lfaY33DcxeLo0UvFL8tLVLr0Ru%2FyXbnAJcSoLMY1duC5H6NgBXbFFuKIpkHfuJ%2BTNdUJYqM%2BuSroH5xmCUQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-bpkrq x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 802b831468059bbf-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	63ms 62ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:20 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id HtNxmePLxe3wxGQyqJTYypjC6IjtKionsTrfehP7cPxxHudxCD_veg== expires Thu, 07 Sep 2023 02:57:20 GMT
GET H2	200	facebook-blue.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	64ms 63ms	Image image/svg+xml	2600:9000:225b:7400:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-blue.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225b:7400:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 746b0aea019090232091568f0790cf4d479b06a4e1fd9987069881ad5d1590ca Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-press-release.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Thu, 07 Sep 2023 02:27:20 GMT via 1.1 aedc37d054398c84a361f8542a82efea.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop MUC50-P1 x-cache Miss from cloudfront content-length 377 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id JP4qWuun0SL58syCtsFK7fjz6htov4GgTbkRyHaiFrGUg-e1ElHyjw== expires Thu, 07 Sep 2023 02:57:20 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	223ms 223ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=59420521-9800-456c-869f-8dd28bca2c47&session=f5ee4cb2-c68e-4f4a-8c29-f1b7899ff71c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2007%20Sep%202023%2002%3A27%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2007%20Sep%202023%2002%3A27%3A19%20GMT%22%2C%22timeSpent%22%3A%221037%22%2C%22totalTimeSpent%22%3A%221037%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20today%20published%20a%20new%20threat%20report%20%E2%80%9CW3LL%20DONE%3A%20HIDDEN%20PHISHING%20ECOSYSTEM%20DRIVING%20BEC%20ATTACKS%E2%80%9D.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pageViewId=41ad8f5a-e11e-4993-80c4-14c6ad6c322a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:20 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	/ www.facebook.com/tr/	0 18 B	22ms 21ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&if=false&ts=1694053640384&sw=1600&sh=1200&ud[external_id]=e211147cd86978b766ad3fd9dc6de76f&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1694053639353.2007654785&cs_est=true&it=1694053639229&coo=false&rqm=GET Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 07 Sep 2023 02:27:20 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i
POST H2	200	fl Show response www.group-ib.com/api/	665 B 782 B	63ms 62ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=bab4f760-4cce-11ee-b244-c0ae87c36e36&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=C0OJdktu80fSvdaHaQRurKattEvKeBFp538WC2UgYYKFZBKHXAait11OlZYEwa3jsPUFPaYvTTX%2FJddKaLiVua%2BxRmRaJNw%2Fhfm0hge4psI0rULqdIIM07AHVTO7YFVTSikTnb%2BVOlAQfr%2FYzZ8Pce%2Fc5Wqp6JWo%2FnPL Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 5ad9ff3c548536786d4a672a0a478ecf1896337b0ed4c99786cf83955bdbb632 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 pA6cN0gpbdqFb3d1paOfg6ksg8AYYZSGlkmzUQ/euMauGJ5GkdLkLdmP2whVHNFumxZhcr9Yjrrno2jMEkyHmj8asg/fwAlH3Dv7Yy0hrVQHHiyqPTGKJmOoFYtKJVeT6gzRU4QU+UlFb/oIX7aJpR+o2TsbhF9VU7B7+wxzIs8cSPmS8Qma8Y77rW1pMRV1iN/mVuut3XfcKlc3jqakckZgLelS9PFDjGDtzrMeyQJxVmRbV8bqXmWa5LkCuA== Referer https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 p8lx9e5ccfa788ea659a8776906805dd16aafd8a Content-Type text/plain;charset=UTF-8 Response headers date Thu, 07 Sep 2023 02:27:20 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	344ms 44ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Requested by Host: js-eu1.hscollectedforms.net URL: https://js-eu1.hscollectedforms.net/collectedforms.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 02:27:21 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 3f4dc08b-1fc0-4549-9ec0-fd61c5e9ef3f x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 3f4dc08b-1fc0-4549-9ec0-fd61c5e9ef3f Server cloudflare X-Trace 2B74D419D1CB45B350EA61199E0FA18D897E18CFA4000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 802b83197dad3764-FRA
POST H3	200	/ Show response www.facebook.com/tr/ Frame 226A	0 15 B	21ms 21ms	Document text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 07 Sep 2023 02:27:21 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	231ms 230ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=59420521-9800-456c-869f-8dd28bca2c47&session=f5ee4cb2-c68e-4f4a-8c29-f1b7899ff71c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2007%20Sep%202023%2002%3A27%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2007%20Sep%202023%2002%3A27%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222038%22%7D&isIframe=false&m=%7B%22description%22%3A%22Group-IB%20has%20today%20published%20a%20new%20threat%20report%20%E2%80%9CW3LL%20DONE%3A%20HIDDEN%20PHISHING%20ECOSYSTEM%20DRIVING%20BEC%20ATTACKS%E2%80%9D.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22W3LL%20oiled%20machine%3A%20Group-IB%20uncovers%20covert%20BEC%20phishing%20empire%20targeting%20Microsoft%20365%20%E2%80%93%20report%20%7C%20Group-IB%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fmedia-center%2Fpress-releases%2Fw3ll-phishing-report%2F&pageViewId=41ad8f5a-e11e-4993-80c4-14c6ad6c322a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 02:27:21 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT