www.deepinstinct.com Open in urlscan Pro
2a05:d014:275:cb00::c8 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Submission: On April 12 via api (April 12th 2024, 2:50:18 pm UTC) from US — Scanned from DE

Summary HTTP 116 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 48 IPs in 4 countries across 36 domains to perform 116 HTTP transactions. The main IP is 2a05:d014:275:cb00::c8, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.deepinstinct.com.
TLS certificate: Issued by R3 on February 17th 2024. Valid for: 3 months.

This is the only time www.deepinstinct.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	2a05:d014:275... 2a05:d014:275:cb00::c8	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
4	2a02:26f0:480... 2a02:26f0:480:f::213:7ee1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:280... 2a02:26f0:280:6::213:7ac7	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	151.101.65.167 151.101.65.167	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1	18.66.102.53 18.66.102.53	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.89 18.245.46.89	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:8bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	2606:4700:440... 2606:4700:4400::ac40:973c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1005	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
2	142.250.185.67 142.250.185.67	15169 (GOOGLE) (GOOGLE)
1	13.32.27.107 13.32.27.107	16509 (AMAZON-02) (AMAZON-02)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	2606:4700::68... 2606:4700::6810:4dba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8d11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e3a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:22e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.185.228 142.250.185.228	15169 (GOOGLE) (GOOGLE)
1	18.66.102.75 18.66.102.75	16509 (AMAZON-02) (AMAZON-02)
1	52.209.193.176 52.209.193.176	16509 (AMAZON-02) (AMAZON-02)
1	157.240.251.9 157.240.251.9	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:215... 2600:9000:2156:d400:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	216.239.36.178 216.239.36.178	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6812:f06c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	169.48.219.66 169.48.219.66	36351 (SOFTLAYER) (SOFTLAYER)
2	142.250.181.232 142.250.181.232	15169 (GOOGLE) (GOOGLE)
1	54.166.116.207 54.166.116.207	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6810:7574	() ()
1	2606:4700::68... 2606:4700::6810:7674	() ()
1	2a00:1450:400... 2a00:1450:4001:80b::2003	() ()
116	48

43 2a05:d014:275:cb00::c8 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

www.deepinstinct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:480:f::213:7ee1 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

images.contentstack.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:280:6::213:7ac7 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.167 (United States)

ASN54113 (FASTLY, US)

s.swiftypecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-89.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:973c (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1005 (United States)

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-107.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4dba (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8d11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e3a3 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:22e5 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.228 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-75.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.193.176 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-193-176.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.251.9 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:d400:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.36.178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:f06c (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.48.219.66 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 42.db.30a9.ip4.static.sl-reverse.com

cc.swiftype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.166.116.207 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-166-116-207.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (None, )

ASN- ()

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7674 (None, )

ASN- ()

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (None, )

ASN- ()

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	deepinstinct.com www.deepinstinct.com	850 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 340 www.linkedin.com — Cisco Umbrella Rank: 609 px4.ads.linkedin.com — Cisco Umbrella Rank: 6380	3 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	451 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 462 p.typekit.net — Cisco Umbrella Rank: 566	78 KB
4	contentstack.io images.contentstack.io — Cisco Umbrella Rank: 12311	175 KB
3	hubspot.com track.hubspot.com forms.hubspot.com	4 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3076 www.google.com — Cisco Umbrella Rank: 2	1 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25941 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23383	2 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7698	26 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 335	14 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	73 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	21 KB
3	swiftypecdn.com s.swiftypecdn.com — Cisco Umbrella Rank: 11960	148 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	306 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 838	609 B
2	t.co t.co — Cisco Umbrella Rank: 678	578 B
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 1323 api.company-target.com — Cisco Umbrella Rank: 4077	939 B
2	google.de www.google.de — Cisco Umbrella Rank: 7551	126 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 87	408 B
2	qualified.com js.qualified.com — Cisco Umbrella Rank: 19110 app.qualified.com — Cisco Umbrella Rank: 20158	161 KB
2	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 4793 tag-logger.demandbase.com — Cisco Umbrella Rank: 4905	22 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 756 script.hotjar.com — Cisco Umbrella Rank: 1167	59 KB
1	gstatic.com www.gstatic.com	201 KB
1	swiftype.com cc.swiftype.com — Cisco Umbrella Rank: 12951	279 B
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3473	1 KB
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 6524	161 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 12915	205 B
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2232	17 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3170	4 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5219	88 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2238	22 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 791	98 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 788	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 822	17 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2510	1 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 2867	63 KB
116	36

	Domain	Requested by
43	www.deepinstinct.com	www.deepinstinct.com
5	www.googletagmanager.com	www.deepinstinct.com www.googletagmanager.com js.hsadspixel.net www.googleoptimize.com
4	px.ads.linkedin.com	3 redirects cdn.bizible.com
4	images.contentstack.io	www.deepinstinct.com
4	use.typekit.net	www.deepinstinct.com use.typekit.net
3	cdn.bizible.com	www.googletagmanager.com www.deepinstinct.com cdn.bizible.com
3	bat.bing.com	www.deepinstinct.com bat.bing.com
3	connect.facebook.net	www.deepinstinct.com connect.facebook.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.deepinstinct.com
3	s.swiftypecdn.com	www.deepinstinct.com s.swiftypecdn.com
2	track.hubspot.com
2	www.facebook.com	www.deepinstinct.com
2	www.google.com	www.deepinstinct.com js.hsleadflows.net
2	analytics.twitter.com	www.deepinstinct.com
2	t.co	www.deepinstinct.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	www.google.de	www.deepinstinct.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
1	www.gstatic.com	www.google.com
1	forms.hubspot.com	cdn.bizible.com
1	app.qualified.com	js.qualified.com
1	cc.swiftype.com	www.deepinstinct.com
1	api.hubapi.com	cdn.bizible.com
1	tag-logger.demandbase.com	cdn.bizible.com
1	content.hotjar.io	cdn.bizible.com
1	api.company-target.com	cdn.bizible.com
1	cdn.bizibly.com	www.deepinstinct.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	id.rlcdn.com	www.deepinstinct.com
1	s.company-target.com	tag.demandbase.com
1	px4.ads.linkedin.com	www.deepinstinct.com
1	www.linkedin.com	1 redirects
1	script.hotjar.com	static.hotjar.com
1	region1.analytics.google.com	www.googletagmanager.com
1	js.qualified.com	www.googletagmanager.com
1	trk.techtarget.com	www.deepinstinct.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	tag.demandbase.com	www.deepinstinct.com
1	static.hotjar.com	www.googletagmanager.com
1	p.typekit.net	use.typekit.net
1	www.googleoptimize.com	www.deepinstinct.com
116	46

This site contains links to these domains. Also see Links.

Domain
portal.deepinstinct.com
info.deepinstinct.com
services.google.com
www.gov.il
amitaico.substack.com
www.securityjoes.com
xelemental.medium.com
go.crowdstrike.com
www.microsoft.com
en.wikipedia.org
www.mandiant.com
research.checkpoint.com
blog.talosintelligence.com
www.group-ib.com
symantec-enterprise-blogs.security.com
villains.fandom.com
op-c.net
www.secureworks.com
www.sentinelone.com
www.proofpoint.com
twitter.com
labs.k7computing.com
0day.bio
www.google.com
github.com
www.mafateehgroup.com
docs.tacticalrmm.com
learn.microsoft.com
www.youtube.com
www.linkedin.com
www.facebook.com

Subject Issuer	Validity	Valid
deepinstinct.com R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.contentstack.io Gandi Standard SSL CA 2	`2023-04-05` - `2024-05-05`	a year	crt.sh
s.swiftypecdn.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
hs-scripts.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-20` - `2024-04-19`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-04-11` - `2024-06-27`	3 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
qualified.com E1	`2024-03-11` - `2024-06-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.company-target.com R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-03-10` - `2024-06-08`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
hsleadflows.net E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
hs-banner.com E1	`2024-04-01` - `2024-06-30`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-01-31` - `2025-03-01`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M01	`2023-07-11` - `2024-08-08`	a year	crt.sh
hubapi.com E1	`2024-03-06` - `2024-06-04`	3 months	crt.sh
*.swiftype.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-21` - `2024-07-14`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
app.qualified.com R3	`2024-03-21` - `2024-06-19`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Frame ID: B0580ACAC5BBA57FA03C8333A4A51560
Requests: 113 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: F8D60C1905D943166A3C8C605266026A
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=4ee651b3-399c-4251-aab0-7417dd5f075a
Frame ID: 8FD22E603E31CE7FC80E1EC5F6FFB2D7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DarkBeatC2: The Latest MuddyWater Attack Framework

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

116
Requests

98 %
HTTPS

53 %
IPv6

36
Domains

46
Subdomains

48
IPs

4
Countries

2518 kB
Transfer

6951 kB
Size

41
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.deepinstinct.com/
Title: Login

Search URL Search Domain Scan URL

URL: https://info.deepinstinct.com/request-a-demo
Title: Request Demo

Search URL Search Domain Scan URL

URL: https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf
Title: shared

Search URL Search Domain Scan URL

URL: https://www.gov.il/en/departments/about/newabout
Title: INCD

Search URL Search Domain Scan URL

URL: https://www.gov.il/he/departments/publications/reports/alert_1721
Title: shared

Search URL Search Domain Scan URL

URL: https://amitaico.substack.com/p/the-other-pyramids
Title: Pyramid of Pain

Search URL Search Domain Scan URL

URL: https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
Title: BiBi wiper

Search URL Search Domain Scan URL

URL: https://xelemental.medium.com/homeland-justice-albania-wiper-3c7e7edd43cc
Title: Homeland Justice

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
Title: BanishedKitten

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
Title: investigation

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Kill_chain#Cyber
Title: Cyber Kill Chain

Search URL Search Domain Scan URL

URL: https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against
Title: investigation

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/
Title: FoxShell

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/introducing-shrouded-snooper/
Title: ShroudedSnooper

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
Title: DEV-1084

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/muddywater-infrastructure/
Title: SimpleHarm

Search URL Search Domain Scan URL

URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms
Title: 2

Search URL Search Domain Scan URL

URL: https://villains.fandom.com/wiki/Lord_Nemesis
Title: Lord Nemesis

Search URL Search Domain Scan URL

URL: https://op-c.net/blog/lord-nemesis-strikes-supply-chain-attack-on-the-israeli-academic-sector/
Title: report

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Title: According

Search URL Search Domain Scan URL

URL: https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us
Title: Cobalt Mirage

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/
Title: TunnelVision

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Title: Mint Sandstorm

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign
Title: recent

Search URL Search Domain Scan URL

URL: https://twitter.com/k3yp0d/status/1770954280049975757
Title: another

Search URL Search Domain Scan URL

URL: https://twitter.com/xDarkBitx/with_replies
Title: made

Search URL Search Domain Scan URL

URL: https://labs.k7computing.com/index.php/muddywater-back-with-darkbit/

Search URL Search Domain Scan URL

URL: https://0day.bio/
Title: 0Day forums

Search URL Search Domain Scan URL

URL: https://www.google.com/search?q=%22stark-industries%22+%22malware%22
Title: known

Search URL Search Domain Scan URL

URL: https://github.com/yogeshojha/rengine
Title: reNgine

Search URL Search Domain Scan URL

URL: https://www.mafateehgroup.com/about/
Title: mafateehgroup.com

Search URL Search Domain Scan URL

URL: https://docs.tacticalrmm.com/
Title: Tactical RMM.

Search URL Search Domain Scan URL

URL: https://twitter.com/1ZRR4H/status/1772107339757232497
Title: reported

Search URL Search Domain Scan URL

URL: https://twitter.com/chux13786509/status/1768642677484949748
Title: observed

Search URL Search Domain Scan URL

URL: https://twitter.com/Intel_Ops_io/status/1772586606639132955
Title: Intel-Ops

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_script_blocks?view=powershell-7.4
Title: scriptblock

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCYerfisJf3hc9QOWmic1G9Q

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/deep-instinct

Search URL Search Domain Scan URL

URL: https://twitter.com/DeepInstinctSec

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DeepInstinctInc

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1712933412579%26li_adsId%3D4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7%26url%3Dhttps%253A%252F%252Fwww.deepinstinct.com%252Fblog%252Fdarkbeatc2-the-latest-muddywater-attack-framework%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQLQ3ZdrfOk-BgAAAY7SyaDsZZqtLG7RY76ld4xjoFCS5LiCP5ZrAL_kDjO5CxH-fo4PzdJQ0spN

116 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request darkbeatc2-the-latest-muddywater-attack-framework Show response
www.deepinstinct.com/blog/ 170 KB
27 KB 1340ms
21ms Document
text/html 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

9868c23a7f08f3b18037fb675b583d8ffcd971ff2247fb9004abe43b8aa4eb90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 3023
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit; fwd=stale
content-encoding: br
content-length: 26953
content-type: text/html; charset=utf-8
date: Fri, 12 Apr 2024 14:50:11 GMT
etag: "kzwqyb5uc43p6e-df"
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
strict-transport-security: max-age=31536000
surrogate-control: max-age=300, stale-while-revalidate=900, stale-if-error=900
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nextjs-date: Fri, 12 Apr 2024 14:03:28 GMT
x-nf-request-id: 01HV9CK6GRNZEZGDKW2Z1MGG8Z
x-xss-protection: 1

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 173 KB
63 KB 87ms
33ms Script
application/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

76edde0b40af332c205551b53d02c15a3640e5e9c44534ad139eee77c6c96909

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63835
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 12 Apr 2024 14:50:11 GMT

GET
H2 200 62c9f84af6283043.css
www.deepinstinct.com/_next/static/css/ 33 KB
7 KB 29ms
28ms Stylesheet
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/62c9f84af6283043.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6HKD7AWSSQWP83VR4A7
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "12e801962e10f6d1010c18a06f69df7b-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7192

GET
H2 200 b3c831d72c60daeb.css
www.deepinstinct.com/_next/static/css/ 15 KB
3 KB 21ms
20ms Stylesheet
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b3c831d72c60daeb.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6HKGNDKWKYVVNVBGR6T
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 4796
cache-status: "Netlify Edge"; hit
etag: "b612c4d93b4d750f521d7cf025d5fdd3-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3480

GET
H2 200 ddca67f80ea11511.css
www.deepinstinct.com/_next/static/css/ 889 B
1021 B 20ms
20ms Stylesheet
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/ddca67f80ea11511.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6HK5A336DXMXKJG3VQY
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 9235
cache-status: "Netlify Edge"; hit
etag: "bf94acaf8c7e8837fa3d2ad39b6a0f87-ssl"
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 889

GET
H2 200 5935-76bf011ee3d88f83.js Show response
www.deepinstinct.com/_next/static/chunks/ 30 KB
10 KB 28ms
22ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5935-76bf011ee3d88f83.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P1FM54SADT8PCYWX0V
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "711c7a0bda1d2a5419580350a0ac2def-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 10214

GET
H2 200 7029-3230841eb82dea3f.js Show response
www.deepinstinct.com/_next/static/chunks/ 123 KB
37 KB 51ms
46ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7029-3230841eb82dea3f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P149DXM0WD2TH64M91
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "163091f8d515307568ca14bd7c244cee-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 37416

GET
H2 200 6839.c8ee40f8e73e0e22.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 27ms
22ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/6839.c8ee40f8e73e0e22.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P1JNH3EAD20E71XQF3
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 4796
cache-status: "Netlify Edge"; hit
etag: "42b37c98d571c31326f0ce7f5b379979-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1059

GET
H2 200 webpack-29002f1662bf7c0b.js Show response
www.deepinstinct.com/_next/static/chunks/ 7 KB
4 KB 26ms
21ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P1BB2C7EY7BC4PEJKR
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "08ae6cd137e5a9f44ce8da97bbdf3bdf-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3449

GET
H2 200 framework-314c182fa7e2bf37.js Show response
www.deepinstinct.com/_next/static/chunks/ 138 KB
43 KB 28ms
23ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/framework-314c182fa7e2bf37.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P19VF1NZ7ZSYPDWX4A
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "842190aeeb138e17ecbd4e80395b04db-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 43603

GET
H2 200 main-c5b7e6d77b82bab5.js Show response
www.deepinstinct.com/_next/static/chunks/ 124 KB
35 KB 26ms
21ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P1H3QX5AQPQ4Z7KR09
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "f5b74e619e9eb5d06577186ed77b231a-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 35854

GET
H2 200 _app-88813e0d1ae2e973.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 450 B
564 B 25ms
20ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/_app-88813e0d1ae2e973.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P1JJAEQ0SCTNAG3QV4
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "50537b790c14aad9a5df48742d265dfa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 450

GET
H2 200 5675-5d8e1c18eb2a06a1.js Show response
www.deepinstinct.com/_next/static/chunks/ 9 KB
4 KB 97ms
93ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5675-5d8e1c18eb2a06a1.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PNV4VP3MFBKN4GFE93
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "ae4ef7f9e1361f41374b10337ad35c3b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3726

GET
H2 200 8882-efb8f68e8ac16c1e.js Show response
www.deepinstinct.com/_next/static/chunks/ 27 KB
10 KB 97ms
93ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/8882-efb8f68e8ac16c1e.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PMG3B2W3DDAPTT878R
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "e9c9a5087b21357b065e593c5a56f0d3-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 9855

GET
H2 200 1053-69c3e67c1a3e9c2f.js Show response
www.deepinstinct.com/_next/static/chunks/ 89 KB
31 KB 100ms
96ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1053-69c3e67c1a3e9c2f.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PNYWPN8D46WSGAG58D
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "78b7ac861927eedc433e1fd1aff23deb-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 31130

GET
H2 200 512-de9e9b45ad8341f5.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
6 KB 98ms
94ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/512-de9e9b45ad8341f5.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PMMB8D2HT16DBJR2TJ
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 4796
cache-status: "Netlify Edge"; hit
etag: "f23770c964cb4a5c463e6f0d11791c33-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 5572

GET
H2 200 %5Bpid%5D-7f7601d838d136ca.js Show response
www.deepinstinct.com/_next/static/chunks/pages/blog/ 547 B
638 B 102ms
98ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/blog/%5Bpid%5D-7f7601d838d136ca.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PNNE57KM61TDD7SGK5
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 4796
cache-status: "Netlify Edge"; hit
etag: "f101ba9e2d84013ead218fe806d71a13-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 547

GET
H2 200 _buildManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 8 KB
2 KB 95ms
92ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_buildManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PMN9TVAJCPWKQ6TH5T
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "8d7e44c890b374fe3291edb4d40e58a2-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1468

GET
H2 200 _ssgManifest.js Show response
www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/ 455 B
542 B 94ms
91ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/7-TyYd0Ikn4eVyBeP3eWe/_ssgManifest.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PMVMZM6GR5KT803DHV
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "c28c1e4abeeaf5ddbabf351bc59836fa-ssl"
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 455

GET
H2 200 zka3qml.css
use.typekit.net/ 3 KB
993 B 112ms
41ms Stylesheet
text/css 2a02:26f0:480:f::213:7ee1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zka3qml.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ee1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Fri, 12 Apr 2024 14:50:11 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 770

GET
H2 200 fig01-threat-actors-behind-the-attack.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/ 64 KB
65 KB 124ms
36ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt79ab55a6f21afecc/660dde571e8523d4db73a039/fig01-threat-actors-behind-the-attack.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300703
age: 748491
x-cache: HIT, HIT
fastly-io-info: ifsz=65512 idim=959x352 ifmt=png ofsz=65485 odim=959x352 ofmt=png
content-disposition: inline; filename=fig01-threat-actors-behind-the-attack.png
fastly-stats: io=1
content-length: 65485
x-request-id: bdc22ad351705a5892f096edccb75e2d
x-served-by: cache-sjc1000100-SJC, cache-cph2320041-CPH
x-runtime: 70ms
server: contentstack
x-timer: S1712933411.488309,VS0,VE0
x-contentstack-organization: bltdec97706489ab5de
etag: "VEnI2SRgCKF7O3N/g1JMMt8mHvFARxWKJS+kxe7JNsE"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 31, 5

GET
H2 200 fig02-faketivism.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/ 95 KB
95 KB 165ms
78ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdfb7ae1ffe166ed/660dde571d996f2393153c9e/fig02-faketivism.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300706
x-cache: HIT, HIT
fastly-io-info: ifsz=97816 idim=886x430 ifmt=png ofsz=97214 odim=886x430 ofmt=png
content-disposition: inline; filename=fig02-faketivism.png
fastly-stats: io=1
content-length: 97214
x-request-id: 78e5fd9f36532b4badb661294655a29a
x-served-by: cache-sjc10044-SJC, cache-cph2320041-CPH
x-runtime: 64ms
server: contentstack
x-timer: S1712933411.488317,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "dOM9Tlik+m9shWIGyZg+b6nO+tORUueAg4gj+nZYapU"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 73, 0

GET
H2 200 fig03-current-muddywater-campign.png
www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/ 63 KB
63 KB 27ms
21ms Image
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltc0997229863d1710/660dde6bf407dd847e3167b5/fig03-current-muddywater-campign.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P0RYEKXBQSXH42GH07
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 748471
fastly-io-served-by: vpop-haf2300711
x-cache: MISS, HIT
fastly-io-info: ifsz=74622 idim=1086x341 ifmt=png ofsz=64213 odim=1086x341 ofmt=png
content-disposition: inline; filename=fig03-current-muddywater-campign.png
fastly-stats: io=1
content-length: 64213
x-request-id: 8f80c28561388a4a21b0b01320e1ca26
x-served-by: cache-sjc10041-SJC, cache-iad-kjyo7100117-IAD
x-runtime: 97ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712915542.385439,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "v+vVzFipZI8vegdG4hRmEEU8Un0vcYa4X5FK2gUgmIc"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 fig04-uploader-information-at-kinneretacil.jfif
www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/ 22 KB
22 KB 27ms
21ms Image
image/jpeg 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt3476f102a9f89a62/660dde57dd5b9e45fca8a154/fig04-uploader-information-at-kinneretacil.jfif

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P02GHK1R91K5MBF03T
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 525397
fastly-io-served-by: vpop-haf2300701
x-cache: MISS, HIT
fastly-io-info: ifsz=22606 idim=1429x292 ifmt=jpeg ofsz=22606 odim=1429x292 ofmt=jpeg
content-disposition: inline; filename=fig04-uploader-information-at-kinneretacil.jfif
fastly-stats: io=1
content-length: 22606
fastly-io-warning: Failed to shrink image
x-request-id: ef003cee43b78d5c4189393012af90f7
x-served-by: cache-sjc1000142-SJC, cache-iad-kjyo7100081-IAD
x-runtime: 44ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712915542.370542,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "wKbkTH77ViUEbiMLak1GQ7udMH+1721nLL9a+kZWHuE"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 fig05-uploader_info-salary.png
www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/ 16 KB
16 KB 27ms
22ms Image
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt5a810cdcb9775a47/660dde57c3bc8b6742dd2d72/fig05-uploader_info-salary.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6P0V0MJCHS4AA0JM7G5
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 9235
fastly-io-served-by: vpop-haf2300714
x-cache: MISS, HIT
fastly-io-info: ifsz=16145 idim=1115x486 ifmt=png ofsz=16115 odim=1115x486 ofmt=png
content-disposition: inline; filename=fig05-uploader_info-salary.png
fastly-stats: io=1
content-length: 16115
fastly-io-warning: Failed to shrink image
x-request-id: 6fe01d74490c19f267c2ad23d4ef0af1
x-served-by: cache-sjc10042-SJC, cache-iad-kiad7000106-IAD
x-runtime: 60ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712924177.528401,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "PMiaPw5iDMnKjyE27Yu4yThV25UYkXcjvoPCbYdHF2w"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 fig06-darkbit_muddy.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/ 5 KB
5 KB 116ms
113ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cd3b042edd84394/660dde561e8523371d73a035/fig06-darkbit_muddy.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300708
x-cache: HIT, HIT
fastly-io-info: ifsz=6674 idim=486x114 ifmt=png ofsz=4766 odim=486x114 ofmt=png
content-disposition: inline; filename=fig06-darkbit_muddy.png
fastly-stats: io=1
content-length: 4766
x-request-id: f2e611d7b3d6d7710ab0a646615e8e74
x-served-by: cache-sjc1000093-SJC, cache-cph2320041-CPH
x-runtime: 94ms
server: contentstack
x-timer: S1712933412.526084,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "vmzGr3PB1WNT/Qy+VppMOcSoI5k7kl9iWEFGri9t0g4"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 10, 0

GET
H2 200 fig07-freeupload.png
images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/ 10 KB
10 KB 116ms
112ms Image
image/png 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb808cbb731a332a/660dde6b1e85231c2473a041/fig07-freeupload.png
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: contentstack /
Resource Hash: 6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-served-by: vpop-haf2300701
x-cache: HIT, HIT
fastly-io-info: ifsz=10140 idim=1127x56 ifmt=png ofsz=10110 odim=1127x56 ofmt=png
content-disposition: inline; filename=fig07-freeupload.png
fastly-stats: io=1
content-length: 10110
fastly-io-warning: Failed to shrink image
x-served-by: cache-sjc1000121-SJC, cache-cph2320041-CPH
x-runtime: 60ms
x-request-id: 4386bdb454ccd2d61f4a88961b166ff3
server: contentstack
x-timer: S1712933412.526206,VS0,VE1
x-contentstack-organization: bltdec97706489ab5de
etag: "CEzcrV5QqWebRUiDirfFaaWk+AJPzpKZW2GdNo1NG+Q"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 14, 0

GET
H2 200 fig08-setting_powershell.png
www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/ 16 KB
16 KB 97ms
94ms Image
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt10d68a9cdc3db0f4/660dde6b04d34c5c1dbdb650/fig08-setting_powershell.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PNB6AXEPM2FBYGVYGV
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 631931
fastly-io-served-by: vpop-haf2300704
x-cache: MISS, HIT
fastly-io-info: ifsz=31883 idim=975x393 ifmt=png ofsz=16384 odim=975x393 ofmt=png
content-disposition: inline; filename=fig08-setting_powershell.png
fastly-stats: io=1
content-length: 16384
x-request-id: 7d063db2060a9a2771322d5e35cc4f00
x-served-by: cache-sjc1000114-SJC, cache-iad-kiad7000086-IAD
x-runtime: 68ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712915542.383882,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "tMzTzAePC2mduhoWWL08QdmnCEzhK2qRsCO7q0ncweg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 fig09-8946172.png
www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/ 11 KB
12 KB 96ms
93ms Image
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/blt53a4d37b3f7a9782/660dde6bcac0bc1852c882a3/fig09-8946172.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PM7B4F19R4XYCEBYTQ
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 748471
fastly-io-served-by: vpop-haf2300705
x-cache: MISS, HIT
fastly-io-info: ifsz=19931 idim=997x173 ifmt=png ofsz=11526 odim=997x173 ofmt=png
content-disposition: inline; filename=fig09-8946172.png
fastly-stats: io=1
content-length: 11526
x-request-id: ec9fc83b992e027811e55099b9a0e4ae
x-served-by: cache-sjc1000143-SJC, cache-iad-kjyo7100036-IAD
x-runtime: 56ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712915542.378998,VS0,VE2
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "udEo+45YI5JQNwd9RtBJhX29jtb6aexXu+JLlOswPTs"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 1

GET
H2 200 fig10-7878123.png
www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/ 13 KB
13 KB 100ms
98ms Image
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/image/bltba953ef3b04cf0c5/660dde6ba16454602c462058/fig10-7878123.png

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6PMHF8TJZ3RGHYBMA5K
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 351355
fastly-io-served-by: vpop-haf2300709
x-cache: MISS, HIT
fastly-io-info: ifsz=23526 idim=977x364 ifmt=png ofsz=13011 odim=977x364 ofmt=png
content-disposition: inline; filename=fig10-7878123.png
fastly-stats: io=1
content-length: 13011
x-request-id: b98674c462cc83a8c2c22324382fa302
x-served-by: cache-sjc10047-SJC, cache-iad-kjyo7100115-IAD
x-runtime: 47ms
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
x-timer: S1712924177.758869,VS0,VE0
x-contentstack-organization: bltdec97706489ab5de
cache-status: "Netlify Edge"; hit
etag: "aNLsCZiogfaK+dI13wowFMHlRypXq+Kq01w25juCPkg"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 2

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 299 KB
102 KB 155ms
46ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ddc760e2140f51fc30ee68962155267a46deb974eb8277eadcb172e72db0209

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104332
x-xss-protection: 0
last-modified: Fri, 12 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Apr 2024 14:50:11 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 159ms
34ms Stylesheet
text/css 2a02:26f0:280:6::213:7ac7
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zka3qml&ht=tk&f=10954.13454.13466.28969&a=83637106&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ac7 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
last-modified: Sun, 14 Jan 2024 12:47:52 GMT
server: nginx
etag: "65a3d7f8-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 l
use.typekit.net/af/04ec74/00000000000000000001205b/27/ 29 KB
29 KB 79ms
20ms Font
application/font-woff2 2a02:26f0:480:f::213:7ee1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/04ec74/00000000000000000001205b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ee1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
server: nginx
etag: "1c4557ace28950fbc49487c3a85660222d5fe232"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29588

GET
H2 200 l
use.typekit.net/af/1709eb/000000000000000000010b60/27/ 24 KB
24 KB 81ms
23ms Font
application/font-woff2 2a02:26f0:480:f::213:7ee1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1709eb/000000000000000000010b60/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ee1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
server: nginx
etag: "9bd0488a91630a3c738a4d950e0b0b7930bcb98f"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24740

GET
H2 200 l
use.typekit.net/af/442215/000000000000000000010b5a/27/ 23 KB
23 KB 97ms
39ms Font
application/font-woff2 2a02:26f0:480:f::213:7ee1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/442215/000000000000000000010b5a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zka3qml.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ee1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/zka3qml.css
Origin: https://www.deepinstinct.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:11 GMT
server: nginx
etag: "9523c64514161c03124fab238b18113d17bad9eb"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23800

GET
H2 200 image
www.deepinstinct.com/_next/ 286 KB
286 KB 27ms
27ms Image
image/avif 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fwww.deepinstinct.com%2Fimage%2Fblt488afd138c53fee8%2F660dc3726c4a396121e472ec%2FDI_Threat_Research_Team_Blog_930x400.png&w=1680&q=100

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6WWKP0195P7VKC1BFQ6
content-security-policy
date: Fri, 12 Apr 2024 14:50:11 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 259823
cross-origin-resource-policy: cross-origin
content-length: 292898
last-modified: Tue, 09 Apr 2024 14:39:48 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; fwd=miss
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: max-age=31536000
x-imgix-origin-passthrough: Cache-Control=max-age%3D31536000&Content-Security-Policy=&X-Nf-Cache-Control=
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 23ms
23ms Image
image/avif 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fblt14ca71678553d70e%2F6305444727ca1b5cd53ebd62%2Fkenin-simon.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6WWRDCA5HMDBCC7GAKH
content-security-policy: script-src 'none'
date: Fri, 12 Apr 2024 14:50:11 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 260464
cross-origin-resource-policy: cross-origin
content-length: 4851
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image
www.deepinstinct.com/_next/ 5 KB
5 KB 67ms
66ms Image
image/avif 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.deepinstinct.com/_next/image?url=https%3A%2F%2Fimages.contentstack.io%2Fv3%2Fassets%2Fblt1ec077b6b53d6b3e%2Fbltfdfca743f7ac9662%2F630e2d5d8bdc107d4a01ba3f%2F800x800-blue-monogram.png&w=64&q=75

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6WWBVDY5NT2867D5W5G
content-security-policy: script-src 'none'
date: Fri, 12 Apr 2024 14:50:11 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
age: 260464
cross-origin-resource-policy: cross-origin
content-length: 5220
last-modified: Tue, 09 Apr 2024 14:29:06 GMT
netlify-vary: query=url|crop|fit|fm|h|height|position|q|quality|timestamp|w|width
server: Netlify
cache-status: "Netlify Edge"; hit
vary: Accept
content-type: image/avif
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 5518.abf70040ebe14552.js Show response
www.deepinstinct.com/_next/static/chunks/ 17 KB
7 KB 55ms
55ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/5518.abf70040ebe14552.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6X98VNV0GSS50ESP6QX
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7660
cache-status: "Netlify Edge"; hit
etag: "a1bb3610d16d40d3994a04e335eb2f7b-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 7404

GET
H2 200 4c213f3cb0a0d816.css
www.deepinstinct.com/_next/static/css/ 1 KB
496 B 54ms
54ms Stylesheet
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/4c213f3cb0a0d816.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6X9SYTCWG7YZCP8W1S9
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7660
cache-status: "Netlify Edge"; hit
etag: "6eccd5b5ee90f21ffe9daf5e31693980-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 298

GET
H2 200 1114.36c11ded4c40c351.js Show response
www.deepinstinct.com/_next/static/chunks/ 5 KB
2 KB 55ms
55ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/1114.36c11ded4c40c351.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6X9BMYAR026NJY3R6Z3
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7660
cache-status: "Netlify Edge"; hit
etag: "be2cb73604d20aae800d9673a2b8cb00-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1666

GET
H2 200 7743.1cc5d0e5cea43aba.js Show response
www.deepinstinct.com/_next/static/chunks/ 2 KB
1 KB 71ms
71ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/7743.1cc5d0e5cea43aba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/webpack-29002f1662bf7c0b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK6XB0JX966ZGX29XQJAA
date: Fri, 12 Apr 2024 14:50:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7660
cache-status: "Netlify Edge"; hit
etag: "b01362f8cfc3944820c788efd91353e8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1124

GET
H2 200 st.js Show response
s.swiftypecdn.com/install/v2/ 416 KB
110 KB 135ms
36ms Script
text/javascript 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/install/v2/st.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-cph2320055-CPH
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
via: 1.1 varnish
age: 151
x-timer: S1712933412.011819,VS0,VE1
etag: "644bc383-1b6c6"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=300, public, max-age=300, public
accept-ranges: bytes
content-length: 112326
x-cache-hits: 1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
95 KB 45ms
44ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fc34634f7877f5b977b7acb5ae7c8c384fa4a11ed5a6424f02a8508af60f6530

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97401
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 12 Apr 2024 14:50:12 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 148ms
28ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 12 Apr 2024 13:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3724
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 12 Apr 2024 15:48:08 GMT

GET
H2 200 hotjar-1665869.js Show response
static.hotjar.com/c/ 9 KB
4 KB 165ms
53ms Script
application/javascript 18.66.102.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-53.fra56.r.cloudfront.net

Software

Resource Hash

6b9ce88e5e05f5b1d5350257a9a784577f596362134a854037a0ad0462c71431

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/7c205c015c4a25232369876022081755
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: bHI7KDGzZ7x0jn7L0aupXgSVk0BzqUkWflABwq71_lks3HAXcfNVcQ==

GET
H2 200 8430ce879b38826d.min.js Show response
tag.demandbase.com/ 77 KB
22 KB 346ms
25ms Script
application/javascript 18.245.46.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/8430ce879b38826d.min.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-89.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

05e0bd8cf7d2075f2758c6a75758d56c0528b119bd8560f9a72d40756575faa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: XAxyGC7JC9kKfigFiDNRnEw79lEVPyiK
content-encoding: gzip
via: 1.1 c968eb4bd5f1a91dae1c71eba1ef9d56.cloudfront.net (CloudFront)
date: Fri, 12 Apr 2024 14:18:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P9
age: 2013
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 29 Mar 2024 23:37:42 GMT
server: AmazonS3
etag: W/"228e9ad763bd17ea00667061aa254171"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: EGOFjUtjErMU_9DacAyU2YUPnooaMR-KUHJEiQySPi88WEtGraxyug==

GET
H2 200 2183098.js Show response
js.hs-scripts.com/ 2 KB
1 KB 462ms
356ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/2183098.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a54686ef7289f24aa853789612d1da49e278af15120b1d8fc1401ff5c07729d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 0fbc18cd-ce84-4a41-9471-2b414106551c
x-envoy-upstream-service-time: 214
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0fbc18cd-ce84-4a41-9471-2b414106551c
last-modified: Fri, 12 Apr 2024 14:18:46 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-697677dfc-lhpbp
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 873407025ec430d6-FRA
expires: Fri, 12 Apr 2024 14:51:42 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 243 KB
85 KB 83ms
82ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02ff37010af332234d9f865976b150a67fd08ddb723b2a0e45903edf1dba4818

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86554
x-xss-protection: 0
last-modified: Fri, 12 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Apr 2024 14:50:12 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 313ms
19ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 07:42:51 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=34946
accept-ranges: bytes
content-length: 17238

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 360ms
30ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kiad7000168-IAD, cache-fra-etou8220042-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 133ms
36ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bda2cf571d7ea45f68afcdc87f968090dbf4bbdec2c7d6d19ce591b3980c296f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 12 Apr 2024 14:50:12 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57850
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=26, rtx=0, c=12, mss=1294, tbw=2763, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: g5NZjQJQ3e93gzrtijz88MiPv2EPjRSyQcvafkYbtV3g6xW7lw+DMRJp4uWigZ7v2KasQhs32mcYtx4VTkTyTg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 1657ms
1354ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Fri, 12 Apr 2024 14:50:13 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BF38A9D18E2842F5BB057B32B99E8F00 Ref B: FRA31EDGE0209 Ref C: 2024-04-12T14:50:12Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 422ms
35ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BA7) /

Resource Hash

5f9fac8d51134fcba0174a1c8d00d921b09bcfa2159cab80c016d9c0c0e8453c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Thu, 04 Apr 2024 16:22:12 GMT
server: ECS (amb/6BA7)
age: 63430
etag: "42f0b43fac86da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25391

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 354ms
47ms Script
text/javascript 2606:4700:4400::ac40:973c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 83796
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 87340703abfc8fe8-FRA
expires: Fri, 12 Apr 2024 15:10:12 GMT

GET
H2 200 qualified.js Show response
js.qualified.com/ 660 KB
161 KB 637ms
566ms Script
text/javascript 2606:4700::6812:1005
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52PC3MW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45e339c7ed435f9e312fc3c4ec81724528e3fcc6d404ede9ac9e6992997deae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
via: 1.1 spaces-router (7186aa94a765)
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 2c54b196-7933-983f-60a7-d2248498b23a
pragma: no-cache
x-runtime: 0.111793
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"45e339c7ed435f9e312fc3c4ec817245"
x-download-options: noopen
vary: Accept,Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 87340703290519ab-FRA
expires: Fri, 12 Apr 2024 18:50:12 GMT

GET
H2 200 prevention-for-storage.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 22 KB
7 KB 151ms
148ms Fetch
application/json 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/prevention-for-storage.json?pid=prevention-for-storage

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E55GGF8Y0HVGBBQP7S
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Fri, 12 Apr 2024 14:03:29 GMT
age: 2812
x-nextjs-matched-path: /en/[pid]
content-length: 6401
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "70xc33uog9hny-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js
www.deepinstinct.com/_next/static/chunks/pages/ 0
1 KB 54ms
51ms Other
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E58FYNAVSA98Y1CP04
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1246

GET
H2 200 partners.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 26 KB
7 KB 169ms
166ms Fetch
application/json 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/partners.json?pid=partners

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E5VP1RXHBEB69QCJFP
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Fri, 12 Apr 2024 14:03:29 GMT
age: 3219
x-nextjs-matched-path: /en/[pid]
content-length: 6662
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "iu627gl25hkq0-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 blog.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/ 111 KB
29 KB 157ms
154ms Fetch
application/json 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/blog.json?pid=blog

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E56KYGK6REP28RZ4ZP
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Fri, 12 Apr 2024 14:28:18 GMT
age: 1350
x-nextjs-matched-path: /en/[pid]
content-length: 29926
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit; fwd=stale
etag: "aphoups31t2fcw-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public,max-age=0,must-revalidate

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/ 252 KB
62 KB 632ms
629ms Fetch
application/json 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/simon-kenin/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E8VR47EGBY1TY537JD
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-nextjs-date: Fri, 12 Apr 2024 14:50:12 GMT
age: 3260
x-nextjs-matched-path: /en/author/[uid]/page/[pid]
content-length: 63559
netlify-vary: header=x-nextjs-data,cookie=__prerender_bypass|__next_preview_data
server: Netlify
cache-status: "Netlify Edge"; hit
etag: "lfd5y5u6h55hv0-df"
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 0
4 KB 53ms
50ms Other
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E8XFXY1J6K7GV92A8P
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 26354
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 1.json Show response
www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/ 251 KB
62 KB 417ms
413ms Fetch
application/json 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/data/7-TyYd0Ikn4eVyBeP3eWe/en/author/deep-instinct-research/page/1.json

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
purpose: prefetch
x-nextjs-data: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E84GK00Q0R27JNJBGJ
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
netlify-vary: header=x-nextjs-data|Accept-Encoding,cookie=__prerender_bypass|__next_preview_data
server: Netlify
age: 3745
cache-status: "Next.js"; hit; fwd=stale, "Netlify Edge"; fwd=miss
etag: "u0xpnp7rl5hhp-df"
vary: Accept-Encoding
content-type: application/json
x-nextjs-date: Fri, 12 Apr 2024 14:50:12 GMT
cache-control: no-cache
x-nextjs-matched-path: /en/author/[uid]/page/[pid]

GET
H2 200 NW3rMrxBqJx71BachJFa.json Show response
s.swiftypecdn.com/install/v2/config/ 19 KB
5 KB 780ms
709ms XHR
application/json 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://s.swiftypecdn.com/install/v2/config/NW3rMrxBqJx71BachJFa.json

Requested by

Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.167 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: */*
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish
x-permitted-cross-domain-policies: none
age: 0
x-cache: MISS
content-length: 4251
x-xss-protection: 1; mode=block
x-request-id: 4b0a07a1ba9af6c9bfac10a5312fa70c
x-served-by: cache-cph2320048-CPH
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 May 2023 16:51:29 GMT
x-timer: S1712933412.489809,VS0,VE675
etag: W/"0b4dc992c692095d33a1f63f87bd38a6"
x-download-options: noopen
x-frame-options: SAMEORIGIN
access-control-max-age: 7200
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
248 B 112ms
27ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-P5MMKMDSNW&gtm=45je44a0v868549395z878451102za200&_p=1712933411502&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=163201639.1712933412&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1712933412&sct=1&seg=0&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2427
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
257 B 110ms
26ms Ping
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-P5MMKMDSNW&cid=163201639.1712933412&gtm=45je44a0v868549395z878451102za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P5MMKMDSNW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 127ms
45ms Image
image/gif 142.250.185.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-P5MMKMDSNW&cid=163201639.1712933412&gtm=45je44a0v868549395z878451102za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=474005609

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.429236d560f51d186b8b.js Show response
script.hotjar.com/ 221 KB
55 KB 91ms
22ms Script
application/javascript 13.32.27.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.429236d560f51d186b8b.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1665869.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-107.fra56.r.cloudfront.net

Software

Resource Hash

fa8cabe3021c19ba54e07d28a7722cd4bfdef39dea07207518113f7e161166bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 10:18:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 621126
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55714
last-modified: Fri, 05 Apr 2024 10:17:11 GMT
etag: "f153d7cc62fba42a4a256996815cbb73"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: F992jpM_ctIBU6M4WWZxJ-PMj7UHdmJJZH0Mvi_XOUjH0IhlON_c2Q==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 28ms
27ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=689767736&t=pageview&_s=1&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=de-de&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=1840641286&gjid=307929006&cid=163201639.1712933412&tid=UA-69598329-1&_gid=1296817242.1712933412&_r=1&_slc=1&gtm=45He44a0n8152PC3MWv78451102za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=796863656

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 468591697375107 Show response
connect.facebook.net/signals/config/ 56 KB
12 KB 151ms
150ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/468591697375107?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f3e455aab43c84d676775111c19d7998853e5ace9a6271e41462c8c8a15c018a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 12 Apr 2024 14:50:12 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=24, rtx=1, c=32, mss=1294, tbw=63155, tp=-1, tpl=-1, uplat=131, ullat=1
pragma: public
x-fb-debug: RP6enLUsVjQBvZkkC34ZR5Sgq2r3VZS3VbOxj1EZ7u4uV2t7ghJe74IJeEne8orq41/zWFYyERkhXf6Yq4W+0g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 27ms
26ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69598329-1&cid=163201639.1712933412&jid=1840641286&gjid=307929006&_gid=1296817242.1712933412&npa=1&_u=YCDACEAABAAAACAAI~&z=1255562346

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 12 Apr 2024 14:50:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.deepinstinct.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D316505%26time%3D1712933412579%26li_adsId%3D4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mudd...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-mud...

0
265 B

233ms
144ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQLQ3ZdrfOk-BgAAAY7SyaDsZZqtLG7RY76ld4xjoFCS5LiCP5ZrAL_kDjO5CxH-fo4PzdJQ0spN
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 6CB65C9EADF94533A920AE01CFB5E856 Ref B: FRAEDGE1308 Ref C: 2024-04-12T14:50:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYV52Of9VMFsWGmyv9FRQ==

Redirect headers

date: Fri, 12 Apr 2024 14:50:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 282E03CE2A8D4C698B38F368E2F9B2E4 Ref B: FRAEDGE1514 Ref C: 2024-04-12T14:50:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=316505&time=1712933412579&li_adsId=4e7e9852-fcb4-4f4d-ac35-e1c69e473ba7&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&cookiesTest=true&liSync=true&e_ipv6=AQLQ3ZdrfOk-BgAAAY7SyaDsZZqtLG7RY76ld4xjoFCS5LiCP5ZrAL_kDjO5CxH-fo4PzdJQ0spN
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYV52OcdicFR8T11iOGng==

GET
H2 200 sync
s.company-target.com/s/ Frame F8D6 0
0 200ms
111ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.company-target.com/s/sync?exc=lr
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/8430ce879b38826d.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.71.96.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Fri, 12 Apr 2024 14:50:12 GMT
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 93ms
29ms Image
text/plain 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 129ms
128ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1712933412593&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16780454
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPpQVwhsw7kq8r2GvYkfq9bxXlfn8P7cYOX574wX9i67Fu51FKXz-u39f1iDkmNl-V7aIg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Fri, 12 Apr 2024 15:50:12 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 165ms
117ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16780454&r=1712933412593&ref=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.deepinstinct.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 12 Apr 2024 14:50:12 GMT
expires: Fri, 12 Apr 2024 14:50:12 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPoj9xSu6mk-BDQf-Ix6r37hJ3Oh482QKVuuXL9IZzGqIt1DeBh1AewJN-D8OKZsjppLtLzGZbCHAg

GET
H2 200 adsct
t.co/i/ 43 B
375 B 180ms
132ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=17ab0b36-1fb0-4aa4-8711-b90c2bbb09dd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=a8feb348-a48a-4038-8426-468dbfee81cb&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 112
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 1647a472291589d3
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 9e310933fb43a0d95f4ed94460e5cb3f251a72ce061f929dc7693182f0eba720
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 258ms
203ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=17ab0b36-1fb0-4aa4-8711-b90c2bbb09dd&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=a8feb348-a48a-4038-8426-468dbfee81cb&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o61n5&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 181
date: Fri, 12 Apr 2024 14:50:12 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 9647bcbfc092e8fa
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: e7b3b49a16af00bada52b5edfc45abd45b8237aba1ed9b56509a1d64f393d5a1
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
203 B 247ms
200ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=1ed8ea8f-3f9c-4cc6-a7d9-cda85f90edd0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=a8feb348-a48a-4038-8426-468dbfee81cb&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 180
date: Fri, 12 Apr 2024 14:50:11 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: d3e497f58882e999
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 9e310933fb43a0d95f4ed94460e5cb3f251a72ce061f929dc7693182f0eba720
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 179ms
124ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=1ed8ea8f-3f9c-4cc6-a7d9-cda85f90edd0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=a8feb348-a48a-4038-8426-468dbfee81cb&tw_document_href=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzc8r&type=javascript&version=2.3.30

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-response-time: 102
date: Fri, 12 Apr 2024 14:50:12 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: aa9d8b2c236d7a82
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: e7b3b49a16af00bada52b5edfc45abd45b8237aba1ed9b56509a1d64f393d5a1
content-length: 43

GET
H2 200 2183098.js Show response
js.hs-analytics.net/analytics/1712933400000/ 68 KB
22 KB 217ms
171ms Script
text/javascript 2606:4700::6810:4dba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1712933400000/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4dba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa0395c7d91df251b50d8dec4347ac7b0e8860316764832c1342fe249001fc6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: SR50AASCNTHQZQRV
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: face7828-d91c-49c3-9c0e-8048b0b2b58a
x-envoy-upstream-service-time: 40
x-amz-id-2: neXJw+4qMXKWtjM8o1rgeQRtWqYVdaFsippTkGuKf6P4fNpPTWqwVUzwFVmfRt4HV27fGHF43Gc=
x-evy-trace-listener: listener_https
x-request-id: face7828-d91c-49c3-9c0e-8048b0b2b58a
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 05 Apr 2024 18:50:29 GMT
server: cloudflare
etag: W/"26a6b54bc353c66041ac4568f3969e8d"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-vhl7w
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 873407051e605d96-FRA
expires: Fri, 12 Apr 2024 14:55:12 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
88 KB 304ms
250ms Script
application/javascript 2606:4700::6812:8d11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8d11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=8734070529079025-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"d252299cef5b9176cf0435e72e0baeeb"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js
date: Fri, 12 Apr 2024 14:50:12 GMT
x-amz-version-id: FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 5902a860-b1d5-4834-adf2-6a2b7d5c5182
x-cache: RefreshHit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 33
x-evy-trace-route-configuration: listener_https/all
x-request-id: 5902a860-b1d5-4834-adf2-6a2b7d5c5182
last-modified: Wed, 03 Apr 2024 09:27:53 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-72bsp
cf-ray: 8734070529079025-FRA
x-amz-cf-id: -iW4zQUacHNx8v0plnK90xvKlVrD6SpJaxGZp4iShaZjDlMRfHnaSw==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 91ms
37ms Script
application/javascript 2606:4700::6811:e3a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:e3a3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66e9a17c05981ae02d122a6845f9f904f13edeae0973af6fdbc44bb77ee5bbf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
x-amz-version-id: NPmBAW9YLDyQDhAGPmBdyF1DJfeS0dQT
via: 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 379
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.546/bundles/pixels-release.js&cfRay=8733fdc0abf19f10-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: eb2e2c1f-12e3-4905-b6e3-955dafef39fa
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: eb2e2c1f-12e3-4905-b6e3-955dafef39fa
last-modified: Thu, 04 Apr 2024 13:54:33 UTC
server: cloudflare
etag: W/"437693b047b4419d0e2549e3f640e3c1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-gxvrq
cf-ray: 87340705acfd196d-FRA
x-amz-cf-id: qL46N7bZNiWy74Hirh_DyZY-e5qhgHJ48LdU0Wds_KLQ-ONKeiH8Pw==
x-hs-target-asset: adsscriptloaderstatic/static-1.546/bundles/pixels-release.js

GET
H2 200 2183098.js Show response
js.hs-banner.com/ 64 KB
17 KB 376ms
324ms Script
text/javascript 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/2183098.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/2183098.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
x-amz-version-id: 3t5xtorRfw4OfG5JJC.Kjqhy62bL4qUy
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 4S5V8H3PFNPF8CGA
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 5d0d4573-21a5-423d-967d-b6cfda945687
x-envoy-upstream-service-time: 37
x-amz-id-2: ZUuTuZUG4+SexM1sBWSt+c4MtPdy3wLZyGzQkjYt7QomABNngEbzAhRU80GIQmSt4ymJk/sP3AClexPq+FW00M7MQ9B/0iaC
x-evy-trace-listener: listener_https
x-request-id: 5d0d4573-21a5-423d-967d-b6cfda945687
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 29 Mar 2024 16:21:55 GMT
server: cloudflare
etag: W/"4554e0b29ba73627bf46cee13e80176e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6dfb9475dd-k2c5l
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 873407063e676915-FRA
expires: Fri, 12 Apr 2024 14:55:13 GMT

GET
H2 200 ipv
cdn.bizible.com/ 43 B
305 B 34ms
33ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=c341e43053334914a7473d8a72c9dcb8&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1712933412605&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&_biz_n=0&rnd=214134&cdn_o=a&_biz_z=1712933412606

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B77) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Mon, 08 Apr 2024 02:02:26 GMT
server: ECS (amb/6B77)
age: 391666
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
205 B 41ms
33ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=c341e43053334914a7473d8a72c9dcb8&_biz_l=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&_biz_t=1712933412608&_biz_i=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&rnd=809542&cdn_o=a&_biz_z=1712933412608

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B7E) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Mon, 08 Apr 2024 09:34:34 GMT
server: ECS (amb/6B7E)
age: 364538
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 93ms
44ms Image
image/gif 142.250.185.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=163201639.1712933412&jid=1840641286&npa=1&_u=YCDACEAABAAAACAAI~&z=1242801189

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 45ms
44ms Image
image/gif 142.250.185.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69598329-1&cid=163201639.1712933412&jid=1840641286&npa=1&_u=YCDACEAABAAAACAAI~&z=1242801189

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 14:50:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 441 B
939 B 128ms
72ms XHR
application/json 18.66.102.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&page_title=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.102.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-102-75.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: d6e9e5229882bb6b58dee519e807407b62f90b3b5b0982394780c8fdd6cf40f4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
identification-source: CENTRAL
content-encoding: gzip
via: 1.1 018ffb575888f1c9ec960e3e977c042e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: e03f4a5e-c0dd-4f2f-998b-bc9d6dc187de
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
access-control-expose-headers: x-amz-cf-id
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GyPfRqdwzp0yaJ2DG9wP58VwNnJdiHoAEAEJkw2uAr5xTc7997Jgvw==
expires: Thu, 11 Apr 2024 14:50:12 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 267ms
131ms XHR
application/json 52.209.193.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=1665869&gzip=1
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.209.193.176 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-193-176.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bde90aad3f990f2b447c8e3469aa65b377b1a01af68d9c792e90ae3f3d82bda0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 12 Apr 2024 14:50:12 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 111 B
323 B 138ms
138ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=c341e43053334914a7473d8a72c9dcb8&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.04.04

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BBB) /

Resource Hash

c9038a1c01cc91cb142d1d867eb145499b73cdc4d6bad61558fa7e67fa39570c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (amb/6BBB)
etag: 8737B55C
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 215

GET
H3 200 332937911623471 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 80ms
80ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/332937911623471?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105%2C184%2C183%2C185%2C190%2C191%2C192%2C188%2C180%2C122%2C150%2C179%2C181%2C113%2C144%2C135%2C139%2C119%2C174%2C216%2C106%2C217%2C152%2C110%2C133%2C126%2C114

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

89973ccfb4b15890115d7c461e836f841a377e057d011416fd797b8602ae8eb7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 12 Apr 2024 14:50:12 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=23, mss=1232, tbw=4311, tp=9, tpl=0, uplat=58, ullat=0
pragma: public
x-fb-debug: OUsuYRrepk37gHbG4WVkZOHEGBTM7rVY1ulqVcBmpxIUv54BsC9ncxiIc7rzt6vySxarSDUuYXrhl0TApGnaAg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 %5Bpid%5D-ed9134132e10b8ba.js Show response
www.deepinstinct.com/_next/static/chunks/pages/ 5 KB
0 0ms
0ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/%5Bpid%5D-ed9134132e10b8ba.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Netlify /
Resource Hash: 488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E58FYNAVSA98Y1CP04
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
server: Netlify
age: 7661
cache-status: "Netlify Edge"; hit
etag: "15d332bb735e0dafb8bc25db3451253c-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1246

GET
H2 200 7e11275f8e6fc085.css Show response
www.deepinstinct.com/_next/static/css/ 14 KB
3 KB 32ms
30ms Fetch
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/7e11275f8e6fc085.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7VVGNF32EN14JPTFDAW
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 8322
cache-status: "Netlify Edge"; hit
etag: "a08d329af0ca27ab60ede65e07cd2abf-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3169

GET
H2 200 %5Bpid%5D-dae3acf70331eea3.js Show response
www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/ 10 KB
0 1ms
1ms Script
application/javascript 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.deepinstinct.com/_next/static/chunks/pages/author/%5Buid%5D/page/%5Bpid%5D-dae3acf70331eea3.js
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Netlify /
Resource Hash: ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7E8XFXY1J6K7GV92A8P
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
server: Netlify
age: 26354
cache-status: "Netlify Edge"; hit
etag: "cd19cee397474a5badc0b081afba1bd1-ssl-df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3807

GET
H2 200 b5a64cbe6880b7dc.css Show response
www.deepinstinct.com/_next/static/css/ 16 KB
4 KB 21ms
20ms Fetch
text/css 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/_next/static/css/b5a64cbe6880b7dc.css

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/_next/static/chunks/main-c5b7e6d77b82bab5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CK7VVGV8CWX8DRA0HR61D
date: Fri, 12 Apr 2024 14:50:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000
server: Netlify
age: 23984
cache-status: "Netlify Edge"; hit
etag: "a85bff580d8ffd9cf629505d2f37a034-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 3642

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 482ms
408ms XHR
text/html 2600:9000:2156:d400:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=GyPfRqdwzp0yaJ2DG9wP58VwNnJdiHoAEAEJkw2uAr5xTc7997Jgvw==&api-version=v2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:d400:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
date: Fri, 12 Apr 2024 02:32:21 GMT
via: 1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 44300
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-length: 0
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: mutHu_ebg3D-11qGdMkffxKYvPyJXZN6YDKsm8KPJ3zohpslMg479g==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
20ms Image
image/gif 216.239.36.178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=689767736&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&ul=de-de&de=UTF-8&dt=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDACEABBAAAACAAI~&jid=&gjid=&cid=163201639.1712933412&tid=UA-69598329-1&_gid=1296817242.1712933412&gtm=45He44a0n8152PC3MWv78451102za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=Residential&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=DE&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&npa=1&z=483986348

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

QUIC, , AES_128_GCM

Server

216.239.36.178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Fri, 12 Apr 2024 02:53:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 42992
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 67ms
19ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=468591697375107&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1712933412818&sw=1600&sh=1200&v=2.9.153&r=stable&ec=0&o=4126&fbp=fb.1.1712933412807.329248089&ler=empty&cdl=API_unavailable&it=1712933412542&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=10, mss=1294, tbw=2789, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 12 Apr 2024 14:50:12 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
32 B 66ms
20ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=332937911623471&ev=PageView&dl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&rl=&if=false&ts=1712933412821&sw=1600&sh=1200&v=2.9.153&r=stable&ec=0&o=4126&fbp=fb.1.1712933412807.329248089&ler=empty&cdl=API_unavailable&it=1712933412542&coo=false&rqm=GET

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=10, mss=1294, tbw=2789, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 12 Apr 2024 14:50:12 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
BLOB 200
OK 01dbc0e9-87a3-4496-b3ad-7c52ad08c2d9
https://www.deepinstinct.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.deepinstinct.com/01dbc0e9-87a3-4496-b3ad-7c52ad08c2d9
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 115 B
1 KB 194ms
143ms XHR
application/json 2606:4700::6812:f06c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=2183098

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f06c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

338bb102cb02ea5d873ff1df529cab30c5b8c52992cd089c20134d2d692bda69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6ac69977-03af-4b0c-99dd-ad2a9f10ae51
content-encoding: br
x-envoy-upstream-service-time: 13
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6ac69977-03af-4b0c-99dd-ad2a9f10ae51
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-697677dfc-4pxm6
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CdUdtRYv%2FqRmG4hy8TdJybRjsr3xkXYIwusZ3YjU3la8AZQnY4rwAb97IKkp9p50kfDgmzVKB9HjuC9ifB89ua6NAO5ATLRPGwNVdM8HXBbSbDsqrzZX413oYqr%2BFWhLR9d25vxWpJ7PR0yA"}],"group":"cf-nel","max_age":604800}
cf-ray: 87340708a8359b37-FRA
access-control-allow-headers: *

GET
H2 200 new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
s.swiftypecdn.com/assets/ 89 KB
33 KB 36ms
36ms Stylesheet
text/css 151.101.65.167
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.swiftypecdn.com/assets/new_embed-2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241.css
Requested by: Host: s.swiftypecdn.com
URL: https://s.swiftypecdn.com/install/v2/st.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.167 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 7
date: Fri, 12 Apr 2024 14:50:13 GMT
content-encoding: gzip
via: 1.1 varnish
age: 4134
x-cache: HIT
content-length: 33983
x-served-by: cache-cph2320055-CPH
x-timer: S1712933413.201652,VS0,VE0
etag: "62b9d075-84bf"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
expires: Sat, 12 Apr 2025 13:41:18 GMT

GET
H/1.1 200
OK cc.js
cc.swiftype.com/ 43 B
279 B 584ms
137ms Image
image/gif 169.48.219.66
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.swiftype.com/cc.js?engine_key=zPgdszsQivuSeQwTEHrm&url=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework
Requested by: Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.48.219.66 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 42.db.30a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Content-Type: image/gif
Date: Fri, 12 Apr 2024 14:50:13 GMT
Cache-Control: no-cache
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Expires: Fri, 12 Apr 2024 14:50:12 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
85 KB 35ms
35ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812608847

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ed68e9372692d4291e1c260947a7b57e89fa9724bc3040c9cfe3edacd7360cb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86510
x-xss-protection: 0
last-modified: Fri, 12 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Apr 2024 14:50:13 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
85 KB 37ms
37ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-812608847&l=dataLayer&cx=c

Requested by

Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-P298HTJ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

813515d6fdf6f5a68a30bf6299346dc3ce0d551b79b8c76fb071c5299c41c747

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86564
x-xss-protection: 0
last-modified: Fri, 12 Apr 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 12 Apr 2024 14:50:13 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
197 B 122ms
121ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://www.deepinstinct.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 8A5E3C54C8F044A8847BF11BA9726A3F Ref B: FRAEDGE1514 Ref C: 2024-04-12T14:50:13Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.deepinstinct.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYV52OiC68Im4fNY1Xwxg==

GET
H/1.1 200
OK messenger
app.qualified.com/w/1/DxHYmKWTScn3buDp/ Frame 8FD2 0
0 392ms
134ms Document
text/html 54.166.116.207
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/DxHYmKWTScn3buDp/messenger?uuid=4ee651b3-399c-4251-aab0-7417dd5f075a

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=DxHYmKWTScn3buDp

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.166.116.207 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-166-116-207.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.deepinstinct.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1671
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Fri, 12 Apr 2024 14:50:14 GMT
Etag: W/"5559cf82a7c4b7e8cd35332af9c22ccb"
Link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (7186aa94a765)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 39f6a82d-6399-7890-365b-db3da148859f
X-Runtime: 0.020097
X-Xss-Protection: 1; mode=block

GET
H2 204 17571311.js Show response
bat.bing.com/p/action/ 0
118 B 45ms
45ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17571311.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Fri, 12 Apr 2024 14:50:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 217D9C0F22BE4CB5BD8E49FD9B2E9944 Ref B: FRA31EDGE0209 Ref C: 2024-04-12T14:50:13Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
287 B 102ms
101ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17571311&Ver=2&mid=7081938d-88d0-48bf-a8b8-eccf680a6934&sid=f8065e90f8db11ee920b030abdacef04&vid=f8067510f8db11ee872fa19a5b9815fc&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=DarkBeatC2%3A%20The%20Latest%20MuddyWater%20Attack%20Framework&p=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&r=&lt=1671&evt=pageLoad&sv=1&rn=494342

Requested by

Host: www.deepinstinct.com
URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 12 Apr 2024 14:50:13 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E41516EFB00D4FD38BED97FC8563A254 Ref B: FRA31EDGE0209 Ref C: 2024-04-12T14:50:13Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 2910ms
164ms Image
image/gif 2606:4700::6810:7574

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=726726051&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1712933414511&vi=bda28c42e67f7b990074fb96e739f927&nc=true&u=160033954.bda28c42e67f7b990074fb96e739f927.1712933414508.1712933414508.1712933414508.1&b=160033954.1.1712933414508&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 69a676ee-ae9a-485d-a7db-67346b10ec76
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 20
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 69a676ee-ae9a-485d-a7db-67346b10ec76
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FqSafYFBTbLOOTQxXLTSPQK03bZuiMhkXditxQJKBUiOPDUrUFP2yW%2Fxpq1gfgT%2B6uXSqB%2FvJ4V8YRycun5YhLWwo%2BkdEUkrP2apwr%2BhunJ1N7Tasrb8sRf4NHHYQ1eaN0Q8dKPuBTOuVM5%2BABxk"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-qswgr
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 87340721ead42c59-FRA
x-robots-tag: none

GET
H2 200 favicon-32x32.png
www.deepinstinct.com/favicon/ 1 KB
1 KB 2715ms
2715ms Other
image/png 2a05:d014:275:cb00::c8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.deepinstinct.com/favicon/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:275:cb00::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-nf-request-id: 01HV9CKC81D493A9XHQTZ2FQS9
date: Fri, 12 Apr 2024 14:50:17 GMT
strict-transport-security: max-age=31536000
server: Netlify
age: 3193
cache-status: "Netlify Edge"; hit
etag: "6c3361589f0d0f46f3458658f29255f6-ssl"
content-type: image/png
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes
content-length: 1056

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 2888ms
176ms XHR
application/json 2606:4700::6810:7674

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=2183098&utk=bda28c42e67f7b990074fb96e739f927&__hstc=160033954.bda28c42e67f7b990074fb96e739f927.1712933414508.1712933414508.1712933414508.1&__hssc=160033954.1.1712933414508&currentUrl=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

f62718444edb75d73a7cd29202bbd3a0a438b295118da5029d05aabb5079028e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: c5826ddc-1ac0-4ab3-8e4f-19ab8c498565
content-encoding: br
x-envoy-upstream-service-time: 38
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c5826ddc-1ac0-4ab3-8e4f-19ab8c498565
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.deepinstinct.com
x-evy-trace-virtual-host: all
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-9fd6b4b-qpnsw
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B8FeNylp%2FSEO7jIqvlEh%2BQ%2Fhge0mcdSHk7vGzTAMdnKAo9gT3ZLNVIg3NSggdP6Xln9rN0anq06XzW8Q1CoHH6a269i1HGT6hIEVaIRNjETcDQeKzeYiKiMDjlvEEXgwaJJiH23pZG4cWyBPo7LV"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 87340721eb8c9c10-FRA

GET
H3 200 enterprise.js Show response
www.google.com/recaptcha/ 1 KB
888 B 32ms
32ms Script
text/javascript 142.250.185.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=explicit

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f4.1e100.net

Software

GSE /

Resource Hash

1109065bd46b1735c772ed9dde2e8e5153311eef14c8200e67fca8cebce8e184

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Fri, 12 Apr 2024 14:50:17 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
437 B 151ms
151ms Image
image/gif 2606:4700::6810:7574

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=edf3154a-9058-41f2-8bd8-5f0fc6bddce4&lfi=2584648&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=726726051&v=1.1&a=2183098&rcu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&pu=https%3A%2F%2Fwww.deepinstinct.com%2Fblog%2Fdarkbeatc2-the-latest-muddywater-attack-framework&t=DarkBeatC2%3A+The+Latest+MuddyWater+Attack+Framework&cts=1712933417440&vi=bda28c42e67f7b990074fb96e739f927&nc=true&u=160033954.bda28c42e67f7b990074fb96e739f927.1712933414508.1712933414508.1712933414508.1&b=160033954.1.1712933414508&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 14:50:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d90f256d-e35f-4632-bc84-f5e2092b4c11
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 14
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d90f256d-e35f-4632-bc84-f5e2092b4c11
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwpydgNqBsgtW6h3pLPHQp8EtExtCPtPntNnLSKlrhPnoJQOC8reI995t3Hkuxuz0a7kjLRtJQqgwl4yDYQm%2FFzSm36f4w51S9Z13lSfGWbHzA%2BjHor%2FOwGcnKcZr22qAoBc1qX9a58c4jVSCZPw"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-fb59n
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 873407230bf32c59-FRA
x-robots-tag: none

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/ 501 KB
201 KB 254ms
20ms Script
text/javascript 2a00:1450:4001:80b::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.deepinstinct.com/
Origin: https://www.deepinstinct.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 11:21:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12536
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205471
x-xss-protection: 0
last-modified: Fri, 29 Mar 2024 04:30:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Apr 2025 11:21:21 GMT

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.deepinstinct.com/	1970-01-20 21:58:29	Name: _gcl_au Value: 1.1.1342304099.1712933412
.deepinstinct.com/	1970-01-21 05:24:53	Name: _ga_P5MMKMDSNW Value: GS1.1.1712933412.1.0.1712933412.60.0.0
.techtarget.com/	1970-01-20 19:48:55	Name: __cf_bm Value: rpuLck0PEwriQu3jJR9J4xq9RkRWC6tdNf8jCMJosUg-1712933412-1.0.1.1-gx6pPv7MKxajANzf2GDNGEPdKK_1E_PYi9i93TBAn10e8Dh0UORQv_heUwuwCf0Uy0ui8f.PS03u6DxtooZZPQ
.deepinstinct.com/	1970-01-21 05:24:53	Name: _ga Value: GA1.2.163201639.1712933412
.deepinstinct.com/	1970-01-20 19:50:19	Name: _gid Value: GA1.2.1296817242.1712933412
.deepinstinct.com/	1970-01-20 19:48:53	Name: _gat_UA-69598329-1 Value: 1
.deepinstinct.com/	1970-01-21 04:34:29	Name: _biz_uid Value: c341e43053334914a7473d8a72c9dcb8
.deepinstinct.com/	1970-01-21 04:34:29	Name: _biz_nA Value: 1
.bizible.com/	1970-01-21 04:34:29	Name: _BUID Value: c341e43053334914a7473d8a72c9dcb8
.deepinstinct.com/	1970-01-21 04:34:29	Name: _hjSessionUser_1665869 Value: eyJpZCI6IjgwMDQwODU4LTMzZTQtNWY5Zi1iNTVjLTJiNzFjNDAxZGY2MSIsImNyZWF0ZWQiOjE3MTI5MzM0MTI2NTgsImV4aXN0aW5nIjp0cnVlfQ==
.deepinstinct.com/	1970-01-20 19:48:55	Name: _hjSession_1665869 Value: eyJpZCI6IjUyZWFjMTc2LWU2YzgtNDMyNi05M2I0LTA4MDMzMmZlZjQ4MCIsImMiOjE3MTI5MzM0MTI2NjAsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.deepinstinct.com/	1970-01-21 04:34:29	Name: _biz_pendingA Value: %5B%5D
.linkedin.com/	1970-01-20 21:58:29	Name: li_sugr Value: 517259e6-159e-4a31-941d-c6c0904e7b69
.linkedin.com/	1970-01-21 04:34:29	Name: bcookie Value: "v=2&bf6f4f6a-ea47-4b42-81f6-0f0bbfaafbf9"
.linkedin.com/	1970-01-20 19:50:19	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=3190:u=1:x=1:i=1712933412:t=1713019812:v=2:sig=AQHa3BGaE27_AM8LxYcDN8zl7roHgeNz"
.company-target.com/	1970-01-21 05:24:53	Name: tuuid Value: 09b6ebd3-b5b5-4f2a-90e3-584967973f6a
.company-target.com/	1970-01-21 05:24:53	Name: tuuid_lu Value: 1712933412\|ix:0\|mctv:0\|rp:0
.deepinstinct.com/	1970-01-20 21:58:29	Name: _fbp Value: fb.1.1712933412807.329248089
.bizibly.com/	1970-01-21 04:34:29	Name: _BUID Value: cf5931a8bd3bddbc375bb0d1b2782b6b
.t.co/	1970-01-21 05:24:53	Name: muc_ads Value: ccd18ce3-24f9-4081-bfc2-27d798c94358
.deepinstinct.com/	1970-01-21 04:34:29	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.twitter.com/	1970-01-21 05:24:53	Name: personalization_id Value: "v1_eD1JnhfdVzprzyBA7JbvVQ=="
.linkedin.com/	1970-01-20 20:32:05	Name: UserMatchHistory Value: AQJKcanxD3EXEAAAAY7SyZ_jF0aMc1N9DxTsSdTD-BO5bGonCg4EA5OLBikAVJ_oCaEacJuwQQPnWw
.linkedin.com/	1970-01-20 20:32:05	Name: AnalyticsSyncHistory Value: AQLO5L1r6NFwogAAAY7SyZ_jD_N0-2tYIFw1LO4SCCC-xZ372fFgwts_kwfnVk1i0AhznpYqvzS55gaijPB59w
.casalemedia.com/	1970-01-21 04:34:29	Name: CMID Value: ZhlKJLmqPdEAACUWAgqAWgAA
.casalemedia.com/	1970-01-20 21:58:29	Name: CMPS Value: 5268
.casalemedia.com/	1970-01-20 21:58:29	Name: CMPRO Value: 5268
.www.linkedin.com/	1970-01-21 04:34:29	Name: bscookie Value: "v=1&20240412145012bfcfb27b-ac70-4f42-8762-1a3c30d6ef3dAQGxbEUNXWLtZnyjct88AcTsrYCxVGxb"
.linkedin.com/	1970-01-21 00:08:05	Name: li_gc Value: MTswOzE3MTI5MzM0MTI7MjswMjFn3KTLmH4u/TBYTt+ABGjpszZRH9wird2plyDj4sKQOg==
.deepinstinct.com/	1970-01-21 05:24:53	Name: __q_state_DxHYmKWTScn3buDp Value: eyJ1dWlkIjoiNGVlNjUxYjMtMzk5Yy00MjUxLWFhYjAtNzQxN2RkNWYwNzVhIiwiY29va2llRG9tYWluIjoiZGVlcGluc3RpbmN0LmNvbSJ9
.tremorhub.com/	1970-01-21 04:34:50	Name: tvid Value: a09f1f2fca5d421ab101f5c6458c0fea
.tremorhub.com/	1970-01-21 05:24:53	Name: tv_UIDM Value: 09b6ebd3-b5b5-4f2a-90e3-584967973f6a
.deepinstinct.com/	1970-01-20 19:50:19	Name: _uetsid Value: f8065e90f8db11ee920b030abdacef04
.deepinstinct.com/	1970-01-21 05:10:29	Name: _uetvid Value: f8067510f8db11ee872fa19a5b9815fc
.bing.com/	1970-01-21 05:10:29	Name: MUID Value: 26FF6A3923B566A113337E66223E6709
.deepinstinct.com/	1970-01-21 00:08:05	Name: __hstc Value: 160033954.bda28c42e67f7b990074fb96e739f927.1712933414508.1712933414508.1712933414508.1
.deepinstinct.com/	1970-01-21 00:08:05	Name: hubspotutk Value: bda28c42e67f7b990074fb96e739f927
.deepinstinct.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.deepinstinct.com/	1970-01-20 19:48:55	Name: __hssc Value: 160033954.1.1712933414508
.hubspot.com/	1970-01-20 19:48:55	Name: __cf_bm Value: c2yfDkrDhfd6w6kt5bYlwdXksjBtRuX1WQ1h4WDmQqk-1712933417-1.0.1.1-JegQaT1E5r22z_aRTo9Xu955XMn3YDKBZvSwaLCntMmMQdnfx3xGROvfOPIQabi8Vp7C5eO_X_kGNenSMs1_6A
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: SjRqHmWbONB4_pGXQKk32Wvftnlnrcu2dYIK2HqC090-1712933417413-0.0.1.1-604800000

62 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/468591697375107?v=2.9.153&r=stable&domain=www.deepinstinct.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
api.company-target.com
api.hubapi.com
app.qualified.com
bat.bing.com
cc.swiftype.com
cdn.bizible.com
cdn.bizibly.com
connect.facebook.net
content.hotjar.io
forms.hubspot.com
ibc-flow.techtarget.com
id.rlcdn.com
images.contentstack.io
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsleadflows.net
js.qualified.com
p.typekit.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.company-target.com
s.swiftypecdn.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag-logger.demandbase.com
tag.demandbase.com
track.hubspot.com
trk.techtarget.com
use.typekit.net
www.deepinstinct.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleoptimize.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
104.244.42.133
104.244.42.3
13.107.42.14
13.32.27.107
142.250.181.232
142.250.185.228
142.250.185.67
146.75.120.157
151.101.65.167
151.101.66.137
152.195.15.58
157.240.251.9
169.48.219.66
18.245.46.89
18.66.102.53
18.66.102.75
2001:4860:4802:32::36
2001:4860:4802:38::178
216.239.36.178
2600:9000:2156:d400:1d:8d6d:3b40:93a1
2606:4700:4400::6812:22e5
2606:4700:4400::ac40:973c
2606:4700::6810:4dba
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:8bd1
2606:4700::6811:e3a3
2606:4700::6812:1005
2606:4700::6812:8d11
2606:4700::6812:f06c
2620:1ec:21::14
2620:1ec:c11::237
2a00:1450:4001:80b::2003
2a00:1450:4001:812::2008
2a00:1450:4001:82b::200e
2a00:1450:400c:c0c::9c
2a02:26f0:280:6::213:7ac7
2a02:26f0:480:f::213:7ec6
2a02:26f0:480:f::213:7ee1
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a05:d014:275:cb00::c8
34.111.208.231
34.96.71.22
35.244.174.68
52.209.193.176
54.166.116.207
0130b680d34de9079a7677f6954c5fded22ad91a7791e2acd86f3ed53191a1d8
02ff37010af332234d9f865976b150a67fd08ddb723b2a0e45903edf1dba4818
05e0bd8cf7d2075f2758c6a75758d56c0528b119bd8560f9a72d40756575faa7
09e468b6ae3eaabab8e4f41329c722ee5ff819b477146ea02d27a7b1b49d5050
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0f701def79cf3f86b8f75e4f805436a387ff2718851060447561b89a6daae4e6
1109065bd46b1735c772ed9dde2e8e5153311eef14c8200e67fca8cebce8e184
140e801db59d24b4f0ba9e63042b32863068c1369989eb1e632e481f6fcf09f1
1a1ea29b4da0208aa78b7fa3d2b6f39179a1a5de6dfdbc80c0d4dc7443755807
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1ddc760e2140f51fc30ee68962155267a46deb974eb8277eadcb172e72db0209
1ea94e6fc8afdc8a96c72f6821974bbfe2126b9a960c469251c88f2d5dd02260
1ed76e4688ef9d3b8245de7492c54d081dbb25796bde18fe026183bc57b13501
2552d8d62d9c60f59b3b11a5d083d1ebd090c72de809fc7c76fb339825302241
2a54686ef7289f24aa853789612d1da49e278af15120b1d8fc1401ff5c07729d
2d7c7930eb39d59cd8c2dc00652977da3ed72347e7cd465f7b540e10e2121c22
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
32cc58a56e1170810316c9cb82dd82a1fb379e2b82139b5ed039063bb40e4724
338bb102cb02ea5d873ff1df529cab30c5b8c52992cd089c20134d2d692bda69
3575cd73d754b670b319a5502e248f3cdee7920b2af18e206d42a6efc54d49df
3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429
3a9972297dfa97e4f6a11cc17f5767935ffa27d7c6d92123e38fd423bd4afd9e
3ad3f48e0876d9c90167457933958b33140d66ebb2c6b42107ade20b39fe2cdd
3c51542bd74124ed2bae5b0d8cb837dc7e567a94acaee00f4c686dfb8d272018
3c98404a986fe5182a2b6214d370226eb15a0cb58af0a25c5e9a95239535f5ee
45e339c7ed435f9e312fc3c4ec81724528e3fcc6d404ede9ac9e6992997deae9
488b5f9d2946120012efd50d989959509b06c83f9b720d0bb58edafadc71bfac
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d3e2dd099535045aef08a0eae076c90e23f526c7d683704293a9ef005ebcd6a
4d69811fcdf2dcc9ff875a6dd0309585ecdf1e55f46345aa9d507f816c4bdb96
4db83b291d4b780a54c7a0e998e64ce8cf5bace8d0612dc0082b0d961f04ce04
4fcc2873d9a9e427999107a83f322c299063db3dd645262a3330e4ed336208fc
50b4811918e32d93ed527f463f88ac9d4dafd29d14b5f17ee69f623bf3aba360
529f9f3aa54fc536d8b9b39f45d3d8bbfbbe067545c2c375ea3fd5f0d446ac14
5af2bd700fd3e70bdb66c457260e13362e077c992b9a8e91ef601515c91bf3fc
5be8aaeb682186c135e30933672211af0127c48e96ac3cb3e2b4a9379e8b861b
5f9fac8d51134fcba0174a1c8d00d921b09bcfa2159cab80c016d9c0c0e8453c
6006a799a37d5e75090b1631ac710ad8aeac54acf5a48b1beee8c2e52b9c9fd6
6353083e47f984144841ad6f17cb6fd0332a4b629c2089d603f8b2bf04dcf2f8
66e9a17c05981ae02d122a6845f9f904f13edeae0973af6fdbc44bb77ee5bbf0
67a86dcd9de0e056f9b4be883e95c1587463e7b87e5390982c02e1822f9c3356
6a231076c5c83e79bea81510940b1fdd77839f3873526b0d49485be6697d0e8f
6b9ce88e5e05f5b1d5350257a9a784577f596362134a854037a0ad0462c71431
6cc4c722a50b4152194b13e7e3c8a1a5a5f23b17988f8fa85404394efc5c0984
76edde0b40af332c205551b53d02c15a3640e5e9c44534ad139eee77c6c96909
7a80c7ae20682012e0a7a06ed486183dc5d7cd45763e09221073675bc067b606
813515d6fdf6f5a68a30bf6299346dc3ce0d551b79b8c76fb071c5299c41c747
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89973ccfb4b15890115d7c461e836f841a377e057d011416fd797b8602ae8eb7
8a61ba991bab87bb170f6256868d5f2f3264d28b40b8f8129e02a07a44651469
8b0ad567f607c61d4574b49cf17871843915be8c7e2a9621d05c8f55ff8739c5
8d0056dcc26b8dce6be00539697962adb12475fbf9cbf7fdcbc7c81b2ae7328d
8d3a1bf6e2df7ec1dc004f9ea76c89627a5a1d3350d2e01f833dd20ffddee5b6
8d5da73586712159bb569fbfbd370f05a258113b2591ba238ef4e7bde1db13b7
8e081ea7988f4b0266528e9ec8b76799e66157ff1a989f649710d6c725a7855a
94c1047f45725fdfd62ad286aae8ff577b87af99f3c6ff9e271fca751398cbbc
9868c23a7f08f3b18037fb675b583d8ffcd971ff2247fb9004abe43b8aa4eb90
9a496e8b9da307a0d817e4104c0418c6ff0c8841c6bbb8e426a424d304ac3296
9d9e8a96a73580c975860c5b2fa6488d785af4b44e2f0a0a35cbbc891c863746
9fa0395c7d91df251b50d8dec4347ac7b0e8860316764832c1342fe249001fc6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
bda2cf571d7ea45f68afcdc87f968090dbf4bbdec2c7d6d19ce591b3980c296f
bde90aad3f990f2b447c8e3469aa65b377b1a01af68d9c792e90ae3f3d82bda0
c1bf2f1787d4c57156e2faff7d7259eccbafd4ea70e2cfdb065448e9e9a866fc
c38430e8e8eeedf87f6a7860ee009e354dbd44f3865a62663239922b35590d7f
c8e3b35aa911b1e6364305e850e35072e75dbceb7fb3ed39b6c9fdf1d216b464
c9038a1c01cc91cb142d1d867eb145499b73cdc4d6bad61558fa7e67fa39570c
c9476026edd0c62a79ca209ab6ccb1b5f2611ef3049b8d771071878003f6871e
c9a95f9262273cfe4ae43a8a0dbb61ce3d4fbcff4b54d2350258b39cd08b32e0
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d66b13d15c9f6d62412758da1d16472e96466304912f1fe178ef8d5b3b44cda0
d6e9e5229882bb6b58dee519e807407b62f90b3b5b0982394780c8fdd6cf40f4
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd2c60ce2a0e8c99bffd15d5941f53f0b508eaeb2c66b0181d563ed23240ff15
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e550590605f348a6163e6f1d157578a98364ee307dd221516f9f2401363e0c20
ec123bd26b1064cd72ca8c52f9c5576d95587da65aa9e2efdbc2fcccf892a8f4
ed68e9372692d4291e1c260947a7b57e89fa9724bc3040c9cfe3edacd7360cb1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6c6142ca7d544ac9af662547dc404225e959789e811607d8acea4f07e0d89d
efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a
f3e455aab43c84d676775111c19d7998853e5ace9a6271e41462c8c8a15c018a
f3e4e112b2d5e33eab4dc97800b6ea00858a4fedaf26f0fe21d5748863df3991
f62718444edb75d73a7cd29202bbd3a0a438b295118da5029d05aabb5079028e
f94786fe65dcbc65b0099b471ae2bb89bbabd7fa7d8573dd3c4e0f5bbe555447
fa8cabe3021c19ba54e07d28a7722cd4bfdef39dea07207518113f7e161166bb
fc34634f7877f5b977b7acb5ae7c8c384fa4a11ed5a6424f02a8508af60f6530
fe2d748cbd7dde62aad4dd1fcf6e6a81675c7fec34601791ac4ab1d2ce6317f7
fff0bdb3f70b85b820a949503a24610fb007cf4582f1e67f4835a14de511d50f

www.deepinstinct.com Open in urlscan Pro 2a05:d014:275:cb00::c8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

116 Requests

98 %HTTPS

53 %IPv6

36 Domains

46 Subdomains

48 IPs

4 Countries

2518 kBTransfer

6951 kBSize

41 Cookies

40 Outgoing links

Redirected requests

116 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.deepinstinct.com Open in urlscan Pro
2a05:d014:275:cb00::c8 Public Scan

Screenshot
Live screenshot

Full Image

116
Requests

98 %
HTTPS

53 %
IPv6

36
Domains

46
Subdomains

48
IPs

4
Countries

2518 kB
Transfer

6951 kB
Size

41
Cookies

116 HTTP transactions
0 data transactions