blog.group-ib.com Open in urlscan Pro
185.129.100.113 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.group-ib.com/blackmatter
Submission: On August 06 via api (August 6th 2021, 9:41:44 am UTC) from GB

Summary HTTP 76 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 25 IPs in 6 countries across 20 domains to perform 76 HTTP transactions. The main IP is 185.129.100.113, located in Russian Federation and belongs to DDOS-GUARD, RU. The main domain is blog.group-ib.com.
TLS certificate: Issued by R3 on August 2nd 2021. Valid for: 3 months.

This is the only time blog.group-ib.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	185.129.100.113 185.129.100.113	57724 (DDOS-GUARD) (DDOS-GUARD)
37	151.236.71.44 151.236.71.44	204720 (CDNETWORKS) (CDNETWORKS)
2	178.248.236.28 178.248.236.28	197068 (QRATOR) (QRATOR)
2	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2b0::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	178.248.235.63 178.248.235.63	197068 (QRATOR) (QRATOR)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	176.34.180.108 176.34.180.108	16509 (AMAZON-02) (AMAZON-02)
3	209.197.3.19 209.197.3.19	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
6	151.236.71.248 151.236.71.248	204720 (CDNETWORKS) (CDNETWORKS)
2 2	2620:119:50e3... 2620:119:50e3:101::6cae:b45	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
2 3	185.33.220.244 185.33.220.244	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	54.228.198.56 54.228.198.56	16509 (AMAZON-02) (AMAZON-02)
3 6	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	185.129.100.115 185.129.100.115	57724 (DDOS-GUARD) (DDOS-GUARD)
76	25

1 185.129.100.113 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net

blog.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 151.236.71.44 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)

static.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.248.236.28 (Russian Federation)

ASN197068 (QRATOR, RU)

ws.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2b0::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.248.235.63 (Russian Federation)

ASN197068 (QRATOR, RU)

www.group-ib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.34.180.108 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-176-34-180-108.eu-west-1.compute.amazonaws.com

go.affec.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.197.3.19 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: vip0x013.map2.ssl.hwcdn.net

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.236.71.248 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)

thumb.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e3:101::6cae:b45 (United States) 2 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:22::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.244 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.228.198.56 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-228-198-56.eu-west-1.compute.amazonaws.com

map.go.affec.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.129.100.115 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net

stat.tildacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	tildacdn.com static.tildacdn.com ws.tildacdn.com thumb.tildacdn.com stat.tildacdn.com	452 KB
5	yandex.com 2 redirects mc.yandex.com	2 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	3 KB
3	adnxs.com 2 redirects secure.adnxs.com	3 KB
3	flashtalking.com servedby.flashtalking.com	4 KB
3	affec.tv 1 redirects go.affec.tv map.go.affec.tv	3 KB
3	google-analytics.com www.google-analytics.com	59 KB
2	facebook.com www.facebook.com	165 B
2	facebook.net connect.facebook.net	97 KB
2	marketo.net munchkin.marketo.net	6 KB
2	googletagmanager.com www.googletagmanager.com	68 KB
2	group-ib.com blog.group-ib.com www.group-ib.com	78 KB
1	twitter.com analytics.twitter.com	658 B
1	yandex.ru 1 redirects mc.yandex.ru	252 B
1	t.co t.co	453 B
1	google.de www.google.de	107 B
1	google.com www.google.com	107 B
1	doubleclick.net stats.g.doubleclick.net	89 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
76	20

	Domain	Requested by
37	static.tildacdn.com	blog.group-ib.com ws.tildacdn.com
6	thumb.tildacdn.com	blog.group-ib.com
5	mc.yandex.com	2 redirects blog.group-ib.com
3	secure.adnxs.com	2 redirects blog.group-ib.com
3	servedby.flashtalking.com	blog.group-ib.com servedby.flashtalking.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com blog.group-ib.com
2	map.go.affec.tv	1 redirects blog.group-ib.com
2	www.facebook.com	blog.group-ib.com connect.facebook.net
2	px.ads.linkedin.com	2 redirects
2	connect.facebook.net	blog.group-ib.com connect.facebook.net
2	munchkin.marketo.net	blog.group-ib.com munchkin.marketo.net
2	www.googletagmanager.com	blog.group-ib.com
2	ws.tildacdn.com	blog.group-ib.com
1	stat.tildacdn.com	static.tildacdn.com
1	analytics.twitter.com	static.ads-twitter.com
1	mc.yandex.ru	1 redirects
1	t.co	blog.group-ib.com
1	www.google.de	blog.group-ib.com
1	www.google.com	blog.group-ib.com
1	px4.ads.linkedin.com	blog.group-ib.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	go.affec.tv	www.googletagmanager.com
1	www.group-ib.com	blog.group-ib.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	blog.group-ib.com
76	27

This site contains links to these domains. Also see Links.

Domain
www.group-ib.com
www.recordedfuture.com
mojobiden.com
therecord.media
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com

Subject Issuer	Validity	Valid
blog.group-ib.com R3	`2021-08-02` - `2021-10-31`	3 months	crt.sh
*.tildacdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-19` - `2022-03-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2022-05-11`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
group-ib.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-12` - `2022-06-17`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
affec.tv Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-04` - `2022-02-22`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-04-15` - `2021-10-15`	6 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
mc.yandex.ru Yandex CA	`2021-07-28` - `2022-01-07`	5 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://blog.group-ib.com/blackmatter
Frame ID: 88B590B1A381BDA1D580EFABD18A3A22
Requests: 76 HTTP requests in this frame

Frame: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
Frame ID: 4B3AFC58BF08FDDC1E85EABCCFCDDCEE
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Tilda (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+tilda(?:cdn|\.ws|-blocks)/i
script /tilda(?:cdn|\.ws|-blocks)/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Hammer.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /hammer(?:\.min)?\.js/i

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

script /\/(?:([\d.])+\/)?highlight(?:\.min)?\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

76
Requests

100 %
HTTPS

42 %
IPv6

20
Domains

27
Subdomains

25
IPs

6
Countries

775 kB
Transfer

1804 kB
Size

15
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://www.group-ib.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/
Title:

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/?__cf_chl_jschl_tk__=pmd_873407f71fa6ff5db30d4fa74e046bcc4964225b-1628080267-0-gqNtZGzNAk2jcnBszQii
Title: called

Search URL Search Domain Scan URL

URL: http://mojobiden.com/

Search URL Search Domain Scan URL

URL: https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/?__cf_chl_jschl_tk__=pmd_45ca1a59508ec6dcf249c6e990aae271d9151acc-1628185797-0-gqNtZGzNAqKjcnBszQni
Title: Recorded Future

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/resources/threat-research/ransomware-2021.html?utm_source=blog_post&utm_campaign=revil_twins&utm_medium=organic

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?src=sp&u=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&title=It%27s%20alive!&utm_source=share2
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=It%27s%20alive!&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&utm_source=share2
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/security-assessment.html
Title: Security Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/red-teaming.html
Title: Red Teaming

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/pre-ir.html
Title: Pre-IR Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/compromise-assessment.html
Title: Compromise Assessment

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/cyberschool.html
Title: Cyber Education

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/investigation.html
Title: Investigations

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/digital-forensics.html
Title: Digital Forensics

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/ediscovery.html
Title: eDiscovery

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/intelligence-attribution.html
Title: Threat Intelligence & Attribution

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/threat-hunting-framework.html
Title: Threat Hunting Framework

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/fraud-hunting-platform.html
Title: Fraud Hunting Platform

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/digital-risk-protection.html
Title: Digital Risk Protection

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/antipiracy.html

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/about.html
Title: About Group-IB

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/media/
Title: Media Center

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/leadership.html
Title: Leadership

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/contacts.html
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/careers.html
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groupibHQ
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/GroupIB_GIB
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC9dl4udfrq8IqHKkETt86QQ
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/organization/1382013/
Title:

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/blog/rss.xml
Title:

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/cert.html
Title: CERT-GIB

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/incident-response.html
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/incident-response/retainer.html
Title: Incident Response Retainer

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D71960%26time%3D1628242883377%26url%3Dhttps%253A%252F%252Fblog.group-ib.com%252Fblackmatter%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true&e_ipv6=AQIOqr6-kQ6BwAAAAXsa1rXvsxbTGJeDXAehRf3Jg_pWiFAW8SGCTGKamCElcQ8Z8gp1ZIJX

Request Chain 61

https://secure.adnxs.com/px?gdpr=%5BGDPR_APPLIES%5D&gdpr_consent=%5BGDPR_TCF_CONSENT_STRING%5D&id=1490274&order_id=%5BORDER_ID%5D&seg=26795470&t=1&value=%5BREVENUE%5D HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fgdpr%3D%255BGDPR_APPLIES%255D%26gdpr_consent%3D%255BGDPR_TCF_CONSENT_STRING%255D%26id%3D1490274%26order_id%3D%255BORDER_ID%255D%26seg%3D26795470%26t%3D1%26value%3D%255BREVENUE%255D

Request Chain 62

https://map.go.affec.tv/map/af/?gdpr=%5BGDPR_APPLIES%5D&gdpr_consent=%5BGDPR_TCF_CONSENT_STRING%5D HTTP 303
https://secure.adnxs.com/getuid?https%3A%2F%2Fmap.go.affec.tv%2Fmap%2Fan%2F%24UID%3Fch%3D610d03c3212a40000101a225%26chc%3Daf%26floc%3D%26redirect_url%3D HTTP 302
https://map.go.affec.tv/map/an/1357012027286207979?ch=610d03c3212a40000101a225&chc=af&floc=&redirect_url=

Request Chain 63

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9357.cGhmrzf4K2VbmYknn3QSzuLmqLUHPtC7U2iDQ1FRr6wVgNfihN6m-ADdHp7jt_Lz.diBzkiY8vhJJZcw3WBiOWLTF7VM%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9357.VxNSKKuII4JcEWrjTAY0DjTZo-zBj0JQEj6kzo19-3qxS-Vk0MhvKI8VTNcNo8C4e0C3pz9gL9kdInGUkpdhog%2C%2C._yXXazzxkOv4idNusuonxTWMrMY%2C

Request Chain 70

https://mc.yandex.com/watch/25634039?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A608%3Acn%3A1%3Adp%3A0%3Als%3A166939739339%3Ahid%3A888528757%3Az%3A120%3Ai%3A20210806114123%3Aet%3A1628242884%3Ac%3A1%3Arn%3A1007784604%3Au%3A162824288488830748%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1628242882860%3Ads%3A0%2C46%2C67%2C0%2C0%2C0%2C%2C266%2C31%2C%2C%2C%2C382%3Adsn%3A1%2C45%2C66%2C1%2C0%2C0%2C%2C268%2C31%2C%2C%2C%2C383%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1628242884%3At%3AIt%27s%20alive! HTTP 302
https://mc.yandex.com/watch/25634039/1?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A608%3Acn%3A1%3Adp%3A0%3Als%3A166939739339%3Ahid%3A888528757%3Az%3A120%3Ai%3A20210806114123%3Aet%3A1628242884%3Ac%3A1%3Arn%3A1007784604%3Au%3A162824288488830748%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1628242882860%3Ads%3A0%2C46%2C67%2C0%2C0%2C0%2C%2C266%2C31%2C%2C%2C%2C382%3Adsn%3A1%2C45%2C66%2C1%2C0%2C0%2C%2C268%2C31%2C%2C%2C%2C383%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1628242884%3At%3AIt%27s%20alive%21

76 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request blackmatter Show response
blog.group-ib.com/ 104 KB
18 KB 113ms
67ms Document
text/html 185.129.100.113
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.129.100.113 , Russian Federation, ASN57724 (DDOS-GUARD, RU),

Reverse DNS

ddos-guard.net

Software

ddos-guard /

Resource Hash

bd3031a385d4290572186785e788f449e40913c36867607a19ba509f76d36c81

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: blog.group-ib.com
:scheme: https
:path: /blackmatter
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: ddos-guard
set-cookie: __ddg1=jcFgQ91BUQwdCLPte4Qf; Domain=.group-ib.com; HttpOnly; Path=/; Expires=Sat, 06-Aug-2022 09:41:22 GMT
date: Fri, 06 Aug 2021 09:41:22 GMT
content-type: text/html; charset=UTF-8
content-length: 17818
last-modified: Fri, 06 Aug 2021 09:28:14 GMT
etag: "19e0e-5c8e0a7a1bfdc-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-frame-options: SAMEORIGIN
x-host: blog.group-ib.com
cache-control: max-age=0 public

GET
H2 200 tilda-grid-3.0.min.css
static.tildacdn.com/css/ 4 KB
1 KB 64ms
20ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-grid-3.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 11
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-1010"
content-type: text/css
cache-control: max-age=86400

GET
H/1.1 200
OK tilda-blocks-2.14.css
ws.tildacdn.com/project200703/ 93 KB
17 KB 127ms
89ms Stylesheet
text/css 178.248.236.28
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.tildacdn.com/project200703/tilda-blocks-2.14.css?t=1628242093
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 6dc36143d36bdd5f62e95f70217299607b97f9b018275a9cb49b6358878e0ee6

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Aug 2021 09:31:22 GMT
Server: QRATOR
Transfer-Encoding: chunked
Content-Type: text/css
cache-control: max-age=0, public
X-Host: ws.tildacdn.com
Connection: keep-alive
Keep-Alive: timeout=15

GET
H2 200 tilda-animation-1.0.min.css
static.tildacdn.com/css/ 10 KB
1 KB 65ms
20ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-animation-1.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: d845ac461a77e54af0e48ca2e3dcac959f793205c2eefbf1d698bc0f73998f34

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 9
last-modified: Sun, 04 Jul 2021 13:39:45 GMT
server: nginx
etag: W/"60e1ba21-28a4"
content-type: text/css
cache-control: max-age=86400

GET
H2 200 tilda-cover-1.0.min.css
static.tildacdn.com/css/ 4 KB
917 B 65ms
21ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-cover-1.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 74bcacf05084912a5515513a323993746432f885e36536a524eb991b9883e73b

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 12
last-modified: Sun, 25 Apr 2021 08:12:17 GMT
server: nginx
etag: W/"60852461-e71"
content-type: text/css
cache-control: max-age=86400

GET
H2 200 highlight.min.css
static.tildacdn.com/css/ 1 KB
705 B 65ms
21ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/highlight.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 07a23b618075104849d8dc806499faf025761532347d5c244e488142de01e106

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 10
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-52d"
content-type: text/css
cache-control: max-age=86400

GET
H2 200 jquery-1.10.2.min.js Show response
static.tildacdn.com/js/ 91 KB
32 KB 85ms
41ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/jquery-1.10.2.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 13
last-modified: Sun, 25 Apr 2021 08:11:36 GMT
server: nginx
etag: W/"60852438-16b88"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-scripts-3.0.min.js Show response
static.tildacdn.com/js/ 11 KB
4 KB 80ms
36ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-scripts-3.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ec69b109d174c69efc9d5f85de132aa616f544d30d2e09f3cc5faa4aa426c804

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 13
last-modified: Tue, 03 Aug 2021 12:32:32 GMT
server: nginx
etag: W/"61093760-2d45"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H/1.1 200
OK tilda-blocks-2.7.js Show response
ws.tildacdn.com/project200703/ 57 KB
13 KB 102ms
65ms Script
application/javascript 178.248.236.28
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.tildacdn.com/project200703/tilda-blocks-2.7.js?t=1628242093
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 34a7169ecc9505ee19bb7b1f267d88eb99b31b0be1ca671ff21007ae73167020

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Aug 2021 09:31:23 GMT
Server: QRATOR
Transfer-Encoding: chunked
Content-Type: application/javascript
cache-control: max-age=0, public
X-Host: ws.tildacdn.com
Connection: keep-alive
Keep-Alive: timeout=15

GET
H2 200 lazyload-1.3.min.js Show response
static.tildacdn.com/js/ 18 KB
6 KB 21ms
21ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/lazyload-1.3.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 32474df38fae62b8dd37ee4e3de4570c30660eb7f3f37cbfce348153e9a23c9b

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 13
last-modified: Wed, 14 Jul 2021 16:36:18 GMT
server: nginx
etag: W/"60ef1282-4683"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-animation-1.0.min.js Show response
static.tildacdn.com/js/ 18 KB
4 KB 21ms
21ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-animation-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e0b12efebc0c07ae891eb68081b93a56831dbcc6e614ebf1ccc471676b5e5f03

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 9
last-modified: Sun, 04 Jul 2021 13:39:45 GMT
server: nginx
etag: W/"60e1ba21-472e"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-cover-1.0.min.js Show response
static.tildacdn.com/js/ 8 KB
3 KB 22ms
21ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-cover-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: de83b00fb566ccbd2c0af882f431ace14bc313ca8c31a198b3b6585c481af4a7

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 12
last-modified: Tue, 20 Jul 2021 13:23:12 GMT
server: nginx
etag: W/"60f6ce40-20c2"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-events-1.0.min.js Show response
static.tildacdn.com/js/ 12 KB
3 KB 25ms
21ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-events-1.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 709af166465530f9ab9fde6a8da14bfc99352e3ff87b9b93abfef62b4b48463e

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 10
last-modified: Wed, 14 Jul 2021 10:42:48 GMT
server: nginx
etag: W/"60eebfa8-2e3a"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-slds-1.4.min.js Show response
static.tildacdn.com/js/ 24 KB
5 KB 25ms
21ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-slds-1.4.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 3e3277bbab0a2dc7a04abd8324535b2f970bba7b019dddc0e7b2834085f9766e

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 13
last-modified: Mon, 02 Aug 2021 10:14:20 GMT
server: nginx
etag: W/"6107c57c-61e7"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 hammer.min.js Show response
static.tildacdn.com/js/ 20 KB
7 KB 26ms
23ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/hammer.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 8
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-50f6"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-zoom-2.0.min.js Show response
static.tildacdn.com/js/ 18 KB
5 KB 27ms
23ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tilda-zoom-2.0.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: bedddba03e340da370d5d2dd181b67c3154861388eb3ca6ad4f0062b0adcdd22

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 13
last-modified: Fri, 06 Aug 2021 09:04:46 GMT
server: nginx
etag: W/"610cfb2e-467d"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 highlight.min.js Show response
static.tildacdn.com/js/ 41 KB
17 KB 77ms
34ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/highlight.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5ad5171287c6d8cd3f604df3559129c28c5aaea6cc67ccdef3d0a509dbdd7a64

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 8
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-a5cd"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 image.png
static.tildacdn.com/tild6361-3765-4130-b061-653635626264/-/empty/ 319 B
409 B 27ms
23ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6361-3765-4130-b061-653635626264/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: c8a1359a7d678c3e6fac8087be448eabc8ef8bd9af6c3b673bf939c8e898439c

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 9
server: nginx
content-type: image/png

GET
H2 200 about.png
static.tildacdn.com/tild6138-6538-4738-b030-393135323761/-/empty/ 733 B
823 B 27ms
24ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6138-6538-4738-b030-393135323761/-/empty/about.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: aa0be60ed739f7dabafdb20080b577066add49d1450638e7d0f4dbe89576d106

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 2021-08-05_174102.jpg
static.tildacdn.com/tild3935-3161-4738-a265-386230623837/-/empty/ 301 B
391 B 27ms
24ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3935-3161-4738-a265-386230623837/-/empty/2021-08-05_174102.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: f0102e4b01506e155d94f7a90eac6f00dbdf80a33155a9d840e959ff518441ee

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild6134-6166-4364-a664-386662313630/-/empty/ 864 B
955 B 27ms
24ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6134-6166-4364-a664-386662313630/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 587bfd92429b7b2200b10b9caacfdc3137339cbf6a8f7d508a5deb876f9e34a5

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 11
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild6435-6665-4261-b233-636635353236/-/empty/ 469 B
559 B 28ms
24ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6435-6665-4261-b233-636635353236/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf6dd38ec350a326c34ce367ea89d9c273a90cffea548827e388ef1106acd40b

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild3937-3662-4362-b633-356631316636/-/empty/ 439 B
530 B 28ms
25ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3937-3662-4362-b633-356631316636/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ed78d080722b8fc60da052d08981ccb32d3b8ec57a9785a5d596ea6ef7ba613a

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 10
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild3535-6566-4730-a365-373431333436/-/empty/ 247 B
338 B 28ms
25ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3535-6566-4730-a365-373431333436/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 179c2da1c8e3d145e451d00ae0a59f88f96654135dadbc8b1fe4d931a327ad22

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 12
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild3535-3937-4431-b938-363235366239/-/empty/ 246 B
337 B 28ms
25ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3535-3937-4431-b938-363235366239/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: fd7c6c727e06d5e1207e619fe0ae52ff02dbde3d7c6775acf04a72b99afa18fa

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 10
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild6235-6538-4061-b837-656533366337/-/empty/ 256 B
346 B 28ms
26ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6235-6538-4061-b837-656533366337/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: a5f3d592950360397e7b1a90b2954c5e8d397a7522b6244d020b24ab8b8d1ee5

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 image.png
static.tildacdn.com/tild3563-3463-4436-a564-313565333463/-/empty/ 412 B
502 B 28ms
26ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3563-3463-4436-a564-313565333463/-/empty/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2ee539c03c8c77934120b600067ad4e1c93a3df45ae26c354fbd416d5107129c

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 -01_8.jpg
static.tildacdn.com/tild3765-3363-4339-a237-623964303631/-/empty/ 448 B
539 B 29ms
26ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3765-3363-4339-a237-623964303631/-/empty/-01_8.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: c314248993e0427343c8d0c32583ea7ef12eb74effb15aefa550484eb3f132fa

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 13
server: nginx
content-type: image/png

GET
H2 200 Frame_20.jpg
static.tildacdn.com/tild3436-3631-4434-a132-346430336364/-/empty/ 414 B
504 B 29ms
26ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3436-3631-4434-a132-346430336364/-/empty/Frame_20.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b396e7e74b72abed0e035e1926b5bedb4bb800be5558f9739fc6b2be61406b47

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 8
server: nginx
content-type: image/png

GET
H2 200 ya-share.js Show response
static.tildacdn.com/js/ 82 KB
27 KB 29ms
27ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/ya-share.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2e59794c9e506814df50c2fe349d9fc8d6418a5959ba5a5b18cbc4742ebba1de

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 10
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-147ff"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
H2 200 tilda-slds-1.4.min.css
static.tildacdn.com/css/ 11 KB
2 KB 31ms
29ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-slds-1.4.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf2c58c07b25eedb7ac08c2e3c54a2a65e264979862a51a448ee81d96b8c1601

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 11
last-modified: Tue, 30 Mar 2021 09:27:55 GMT
server: nginx
etag: W/"6062ef1b-2bc7"
content-type: text/css
cache-control: max-age=86400

GET
H2 200 tilda-zoom-2.0.min.css
static.tildacdn.com/css/ 6 KB
2 KB 35ms
33ms Stylesheet
text/css 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/css/tilda-zoom-2.0.min.css
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ee834fea8083fdba1e884b530abe364c78d61ec45f0ea39a23a68faadced3f65

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 9
last-modified: Thu, 18 Mar 2021 12:08:37 GMT
server: nginx
etag: W/"605342c5-17bd"
content-type: text/css
cache-control: max-age=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 211 KB
68 KB 27ms
24ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7a1ead29fc05de620b1adb86728a27f470e0de9339d6b87932a8f3f52a3a7ce6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69157
x-xss-protection: 0
last-modified: Fri, 06 Aug 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 06 Aug 2021 09:41:23 GMT

GET
H2 200 SFUIDisplayMedium.woff
static.tildacdn.com/tild3239-3033-4235-a566-376533383664/ 71 KB
71 KB 65ms
21ms Font
application/x-font-woff 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/tild3239-3033-4235-a566-376533383664/SFUIDisplayMedium.woff
Requested by: Host: ws.tildacdn.com
URL: https://ws.tildacdn.com/project200703/tilda-blocks-2.14.css?t=1628242093
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 19cc6e4b03f164ccb8d68121c3dfc374926bc9eaab12a4216306963bdefd76de

Request headers

Origin: https://blog.group-ib.com
Referer: https://ws.tildacdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
tserver: 8
last-modified: Tue, 18 Apr 2017 12:57:08 GMT
server: nginx
age: 0
etag: "3ba1b30b31cc1d325b305f3951058787"
content-type: application/x-font-woff
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 72492
x-timestamp: 1492520227.30915

GET
H2 200 blog_4.jpg
static.tildacdn.com/tild6666-3530-4830-b032-626238386662/-/resize/20x/ 358 B
450 B 24ms
24ms Image
image/jpeg 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6666-3530-4830-b032-626238386662/-/resize/20x/blog_4.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 066992830c428b2fb261177f72e02bc992cdcb5f4cc117ceeea28032e26bf7bf

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 10
server: nginx
content-type: image/jpeg

GET
H2 200 SFUIDisplayLight.woff
static.tildacdn.com/tild6463-6361-4432-b234-333934313939/ 71 KB
71 KB 89ms
57ms Font
application/x-font-woff 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/tild6463-6361-4432-b234-333934313939/SFUIDisplayLight.woff
Requested by: Host: ws.tildacdn.com
URL: https://ws.tildacdn.com/project200703/tilda-blocks-2.14.css?t=1628242093
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 07cc9932ed0e2c7a958c6bf6e3a928847b9fe3f271832767ec89ee34e78f5227

Request headers

Origin: https://blog.group-ib.com
Referer: https://ws.tildacdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
tserver: 12
last-modified: Tue, 18 Apr 2017 12:57:03 GMT
server: nginx
age: 0
etag: "08edc0015cdeec9e755f0ce361281b27"
content-type: application/x-font-woff
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 72608
x-timestamp: 1492520222.13412

GET
H2 200 partners.jpg
static.tildacdn.com/tild3762-3761-4431-b366-353734386266/-/resizeb/20x/ 180 B
272 B 21ms
20ms Image
image/jpeg 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3762-3761-4431-b366-353734386266/-/resizeb/20x/partners.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 0a619506dabe4ed90f07f41f176c558a2b2c1623b63ad0f9eaedfd939fe13656

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 13
server: nginx
content-type: image/jpeg

GET
H2 200 Blue_Theme.jpg
static.tildacdn.com/tild3033-3961-4464-b634-333930373762/-/resizeb/20x/ 692 B
783 B 21ms
20ms Image
image/png 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3033-3961-4464-b634-333930373762/-/resizeb/20x/Blue_Theme.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: bbbc7f86631845d49d5baba17ec2b1cd20ddf67132a054b146396b042ea95bf1

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 12
server: nginx
content-type: image/png

GET
H2 200 fontpack_1200x630_2.jpg
static.tildacdn.com/tild3033-6232-4231-b565-353131643034/-/resizeb/20x/ 337 B
429 B 21ms
21ms Image
image/jpeg 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild3033-6232-4231-b565-353131643034/-/resizeb/20x/fontpack_1200x630_2.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2981e2f4f34c9cc18bdcbe5a2e18a0325cda21389e6132d09c3dbd39af02134d

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 12
server: nginx
content-type: image/jpeg

GET
H2 200 shutterstock_1822037.jpg
static.tildacdn.com/tild6364-3637-4562-a134-383338303134/-/resizeb/20x/ 362 B
453 B 21ms
21ms Image
image/jpeg 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tildacdn.com/tild6364-3637-4562-a134-383338303134/-/resizeb/20x/shutterstock_1822037.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: d833cc97a87c002d2ea8b77a80eae206e1cfa868922ddf77ad68d73a47c4607c

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2592000
tserver: 9
server: nginx
content-type: image/jpeg

GET
H2 200 tildastat-0.2.min.js Show response
static.tildacdn.com/js/ 6 KB
2 KB 20ms
20ms Script
application/javascript 151.236.71.44
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tildacdn.com/js/tildastat-0.2.min.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.44 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 65a7577f35726ea847bdf440ad18a70ee61c01ef0b5ee26b0e6a2352ace3a2ce

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
tserver: 11
last-modified: Thu, 25 Mar 2021 15:46:15 GMT
server: nginx
etag: W/"605cb047-1814"
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 280 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaa53b7966f71ea94c27d3ec4f5598a616723c1576bbc707698f8fc2db4b54b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 579 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d005c1939236926ac6f06522f0a1e32eeffda988f6272efb8b7a698be2dfb9d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 1662
date: Fri, 06 Aug 2021 09:13:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Fri, 06 Aug 2021 11:13:41 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 23ms
8ms Script
application/x-javascript 2a02:26f0:6c00:2b0::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b0::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Jun 2021 01:25:13 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=72575
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2079

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 74ms
23ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 34450
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1628242883.396335,VS0,VE0
x-served-by: cache-fra19125-FRA

GET
H/1.1 200
OK watch.js Show response
www.group-ib.com/javascripts/ 132 KB
61 KB 159ms
122ms Script
application/javascript 178.248.235.63
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.group-ib.com/javascripts/watch.js

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.235.63 , Russian Federation, ASN197068 (QRATOR, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

66dc19f5644fe6fac24a19fc890e36278d8d2b0d089791a67f7ff0c628a7f7bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://pathfactory.com/ https://groupib.pathfactory.com/
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://pathfactory.com/, ALLOW-FROM https://groupib.pathfactory.com/, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: keep-alive
X-Dns-Prefetch-Control: off
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Thu, 05 Aug 2021 22:10:01 GMT
Server: QRATOR
Etag: W/"610c61b9-20ea4"
X-Download-Options: noopen
X-Frame-Options: ALLOW-FROM https://pathfactory.com/, ALLOW-FROM https://groupib.pathfactory.com/, SAMEORIGIN
Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Type: application/javascript
Cache-Control: max-age=604800
Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none'; encrypted-media 'none'; payment 'none'; speaker 'none'; usb 'none';
Permissions-Policy: camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=(),
Content-Security-Policy: frame-ancestors 'self' https://pathfactory.com/ https://groupib.pathfactory.com/
Keep-Alive: timeout=15
Expires: Fri, 13 Aug 2021 09:41:23 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 1102ms
31ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:24 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
25 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25944
x-xss-protection: 0
pragma: public
x-fb-debug: LuWoASBylPklY7aA0Oh9ldChHKLWbANDrZIRhCo4zCeo13MSk/JocnGw+4lwH8fyAaC3sfaDPJ6znUkSpLWvFg==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Fri, 06 Aug 2021 09:41:23 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK 60c71f6ff2b0edd011640d57 Show response
go.affec.tv/j/ 2 KB
1 KB 149ms
38ms Script
application/javascript 176.34.180.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://go.affec.tv/j/60c71f6ff2b0edd011640d57?gdpr=[GDPR_APPLIES]&gdpr_consent=[GDPR_TCF_CONSENT_STRING]
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.180.108 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-180-108.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 06a082aa178adb8a8e057d05099d61daad3477077fa669c29dae7417c37a336a

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
P3p: CP="CAO DSP COR PSAo CONo HISo OTPo OUR IND NAV INT CNT OTC"
Cache-Control: no-cache, private, no-store, max-age=0, s-maxage=0, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 818
Expires: Wed, 04 Apr 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/container/19790;125109;13584;iframe/ Frame 4B3A 3 KB
3 KB 601ms
32ms Document
text/html 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app39.frk11 /
Resource Hash: 5d59e49cf21a4f8274ee20aff8f205aaf692993966456d9e71631e2ac1a06e05

Request headers

Host: servedby.flashtalking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.group-ib.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://blog.group-ib.com/

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Connection: close
Cache-Control: no-cache, no-store
Content-Type: text/html
Server: prod-xre-app39.frk11
Pragma: no-cache
X-HW: 1628242883.dop233.fr8.t,1628242883.cds108.fr8.shn,1628242883.dop233.fr8.t,1628242883.cds160.fr8.sc,1628242883.cds160.fr8.p

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
89 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-25492706-2&cid=1016920943.1628242883&jid=268460823&gjid=675004314&_gid=1631251296.1628242883&_u=YGBAgAADQAAAAE~&z=297304915

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 06 Aug 2021 09:41:23 GMT
content-type: text/plain
access-control-allow-origin: https://blog.group-ib.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 js Show response
www.google-analytics.com/gtm/ 99 KB
39 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-W6XV92M&t=gtm5&cid=1016920943.1628242883

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5fe5c82d2d65d64ac35ab12f009a98cabc3dcfb9babc5d5452d66282eb4a0d7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40100
x-xss-protection: 0
last-modified: Fri, 06 Aug 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 06 Aug 2021 09:41:23 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j92&a=1960282706&t=pageview&_s=1&dl=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&ul=en-us&de=UTF-8&dt=It%27s%20alive!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgAADQ~&jid=268460823&gjid=675004314&cid=1016920943.1628242883&tid=UA-25492706-2&_gid=1631251296.1628242883&gtm=2wg840PW7265&cd1=1016920943.1628242883&z=1323431053

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Aug 2021 07:01:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 9589
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 blog_4.jpg
thumb.tildacdn.com/tild6666-3530-4830-b032-626238386662/-/format/webp/ 128 KB
128 KB 89ms
32ms Image
image/webp 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6666-3530-4830-b032-626238386662/-/format/webp/blog_4.jpg
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e1cb5ba88790df5205d9d51afcdf19ba7e8e7a101ad0a617f71c03651a696d7f

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/webp

GET
H3-29 200 545899479446758 Show response
connect.facebook.net/signals/config/ 253 KB
72 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/545899479446758?v=2.9.44&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

02c0f927c4ba086f771d1139b3e769cb3da9cb4d6f02da62fd460b1a6f269194

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 73530
x-xss-protection: 0
pragma: public
x-fb-debug: Y0CxdVrRm1cF7nEWEg7/acVwyo3l+0eIEAqUZFU4Tygbx8cST0IZqZyMecM5TL6M7JlpfHPO6tXvjJKbedN8Xw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 06 Aug 2021 09:41:23 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D71960%26time%3D1628242883377%26url%3Dhttps%253A%252F%252Fblog.group-ib.com%252Fbl...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true&e_ipv6=AQIOqr6-kQ6BwAAAAXsa1rXvsxbTGJeDXAehRf3Jg_pWiFAW8SG...

0
155 B

980ms
144ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true&e_ipv6=AQIOqr6-kQ6BwAAAAXsa1rXvsxbTGJeDXAehRf3Jg_pWiFAW8SGCTGKamCElcQ8Z8gp1ZIJX
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:25 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: dg0Q8kaumBZgr50CrSoAAA==

Redirect headers

date: Fri, 06 Aug 2021 09:41:24 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=71960&time=1628242883377&url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&liSync=true&e_ipv6=AQIOqr6-kQ6BwAAAAXsa1rXvsxbTGJeDXAehRf3Jg_pWiFAW8SGCTGKamCElcQ8Z8gp1ZIJX
x-li-proto: http/2
x-li-pop: prod-eda6
content-length: 0
x-li-uuid: tx+CuEaumBYwlo0mxCoAAA==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 17ms
17ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-25492706-2&cid=1016920943.1628242883&jid=268460823&_u=YGBAgAADQAAAAE~&z=1407005908

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Aug 2021 09:41:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 17ms
16ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-25492706-2&cid=1016920943.1628242883&jid=268460823&_u=YGBAgAADQAAAAE~&z=1407005908

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Aug 2021 09:41:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=545899479446758&ev=PageView&dl=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&rl=&if=false&ts=1628242883403&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1628242883402.941877024&it=1628242883374&coo=false&rqm=GET

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 06 Aug 2021 09:41:23 GMT

GET
H2 200 adsct
t.co/i/ 43 B
453 B 185ms
135ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o6fwj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Fri, 06 Aug 2021 09:41:23 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dd4c5561cef558a2790e31ceeefa4b2afe5dd057affa08203f331142e2b8502c
x-transaction: 320fafb510a7c701
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?gdpr=%5BGDPR_APPLIES%5D&gdpr_consent=%5BGDPR_TCF_CONSENT_STRING%5D&id=1490274&order_id=%5BORDER_ID%5D&seg=26795470&t=1&value=%5BREVENUE%5D
https://secure.adnxs.com/bounce?%2Fpx%3Fgdpr%3D%255BGDPR_APPLIES%255D%26gdpr_consent%3D%255BGDPR_TCF_CONSENT_STRING%255D%26id%3D1490274%26order_id%3D%255BORDER_ID%255D%26seg%3D26795470%26t%3D1%26va...

0
1005 B

19ms
19ms

Script
application/javascript

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fgdpr%3D%255BGDPR_APPLIES%255D%26gdpr_consent%3D%255BGDPR_TCF_CONSENT_STRING%255D%26id%3D1490274%26order_id%3D%255BORDER_ID%255D%26seg%3D26795470%26t%3D1%26value%3D%255BREVENUE%255D

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 06 Aug 2021 09:41:23 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e424d496-cafa-4f7c-87cb-6345312c61df
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 06 Aug 2021 09:41:23 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 44406e97-2859-4a07-ab34-cd008a7a88e6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fpx%3Fgdpr%3D%255BGDPR_APPLIES%255D%26gdpr_consent%3D%255BGDPR_TCF_CONSENT_STRING%255D%26id%3D1490274%26order_id%3D%255BORDER_ID%255D%26seg%3D26795470%26t%3D1%26value%3D%255BREVENUE%255D
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

204
No Content

1357012027286207979 Show response
map.go.affec.tv/map/an/
Redirect Chain

https://map.go.affec.tv/map/af/?gdpr=%5BGDPR_APPLIES%5D&gdpr_consent=%5BGDPR_TCF_CONSENT_STRING%5D
https://secure.adnxs.com/getuid?https%3A%2F%2Fmap.go.affec.tv%2Fmap%2Fan%2F%24UID%3Fch%3D610d03c3212a40000101a225%26chc%3Daf%26floc%3D%26redirect_url%3D
https://map.go.affec.tv/map/an/1357012027286207979?ch=610d03c3212a40000101a225&chc=af&floc=&redirect_url=

0
591 B

38ms
37ms

Script
text/html

54.228.198.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://map.go.affec.tv/map/an/1357012027286207979?ch=610d03c3212a40000101a225&chc=af&floc=&redirect_url=
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.228.198.56 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-228-198-56.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:23 GMT
Content-Encoding: gzip
Connection: keep-alive
Vary: Accept-Encoding
Content-Type: text/html

Redirect headers

Pragma: no-cache
Date: Fri, 06 Aug 2021 09:41:23 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 16708b5d-0dce-4c62-bbb7-6f1d5db2c765
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://map.go.affec.tv/map/an/1357012027286207979?ch=610d03c3212a40000101a225&chc=af&floc=&redirect_url=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9357.cGhmrzf4K2VbmYknn3QSzuLmqLUHPtC7U2iDQ1FRr6wVgNfihN6m-ADdHp7jt_Lz.diBzkiY8vhJJZcw3WBiOWLTF7VM%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9357.VxNSKKuII4JcEWrjTAY0DjTZo-zBj0JQEj6kzo19-3qxS-Vk0MhvKI8VTNcNo8C4e0C3pz9gL9kdInGUkpdhog%2C%2C._yXXazzxkOv4idNusuonxTWMrMY%2C

75 B
75 B

48ms
47ms

Image
text/html

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9357.VxNSKKuII4JcEWrjTAY0DjTZo-zBj0JQEj6kzo19-3qxS-Vk0MhvKI8VTNcNo8C4e0C3pz9gL9kdInGUkpdhog%2C%2C._yXXazzxkOv4idNusuonxTWMrMY%2C

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9357.VxNSKKuII4JcEWrjTAY0DjTZo-zBj0JQEj6kzo19-3qxS-Vk0MhvKI8VTNcNo8C4e0C3pz9gL9kdInGUkpdhog%2C%2C._yXXazzxkOv4idNusuonxTWMrMY%2C
date: Fri, 06 Aug 2021 09:41:23 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
289 B 145ms
50ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
last-modified: Tue, 03 Aug 2021 10:32:13 GMT
etag: "61029ac0-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Fri, 06 Aug 2021 10:41:23 GMT

GET
H2 200 groupiblogo.png
thumb.tildacdn.com/tild3335-3733-4536-b335-306437643333/-/resize/150x/-/format/webp/ 843 B
958 B 28ms
26ms Image
image/png 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild3335-3733-4536-b335-306437643333/-/resize/150x/-/format/webp/groupiblogo.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2e0c7e6603b288be408d7a1c29fc74e9a01089a5bc4506cee95e2a5567cd47ac

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/png

GET
H2 200 1.png
thumb.tildacdn.com/tild6163-6536-4637-b636-616533643962/-/format/webp/ 196 B
311 B 28ms
27ms Image
image/png 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6163-6536-4637-b636-616533643962/-/format/webp/1.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: bb9a3150006283c76a2f38e1a0e6dfaf3bbfced1e46755421911769bf1381554

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/png

GET
H2 200 groupiblogo.png
thumb.tildacdn.com/tild3335-3733-4536-b335-306437643333/-/format/webp/ 843 B
958 B 28ms
27ms Image
image/png 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild3335-3733-4536-b335-306437643333/-/format/webp/groupiblogo.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2e0c7e6603b288be408d7a1c29fc74e9a01089a5bc4506cee95e2a5567cd47ac

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/png

GET
H2 200 image.png
thumb.tildacdn.com/tild6361-3765-4130-b061-653635626264/-/resize/80x/-/format/webp/ 2 KB
2 KB 28ms
27ms Image
image/webp 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6361-3765-4130-b061-653635626264/-/resize/80x/-/format/webp/image.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e16f6925411b2991b37bb5154b2c90ac8c2a6feef1fbef47beb0e96071a63de5

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/webp

GET
H2 200 about.png
thumb.tildacdn.com/tild6138-6538-4738-b030-393135323761/-/resize/760x/-/format/webp/ 15 KB
15 KB 28ms
28ms Image
image/webp 151.236.71.248
CDNETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.tildacdn.com/tild6138-6538-4738-b030-393135323761/-/resize/760x/-/format/webp/about.png
Requested by: Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 12b0d17bef9ef2ba1d3139187def68ecd23f78d5be52a2dbbc03ce01526c621f

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:23 GMT
cache-control: max-age=2600000
x-cdn-edge-cache: HIT
x-cdn-edge-id: 2315
server: nginx
content-type: image/webp

GET
H2

200

1 Show response
mc.yandex.com/watch/25634039/
Redirect Chain

https://mc.yandex.com/watch/25634039?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%3A...
https://mc.yandex.com/watch/25634039/1?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%...

316 B
398 B

48ms
48ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/25634039/1?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A608%3Acn%3A1%3Adp%3A0%3Als%3A166939739339%3Ahid%3A888528757%3Az%3A120%3Ai%3A20210806114123%3Aet%3A1628242884%3Ac%3A1%3Arn%3A1007784604%3Au%3A162824288488830748%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1628242882860%3Ads%3A0%2C46%2C67%2C0%2C0%2C0%2C%2C266%2C31%2C%2C%2C%2C382%3Adsn%3A1%2C45%2C66%2C1%2C0%2C0%2C%2C268%2C31%2C%2C%2C%2C383%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1628242884%3At%3AIt%27s%20alive%21

Requested by

Host: blog.group-ib.com
URL: https://blog.group-ib.com/blackmatter

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

29243d52896581d8eb35f00348edc871d359e8dff1d0193db6675b7454fd9190

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Aug 2021 09:41:23 GMT
x-content-type-options: nosniff
last-modified: Fri, 06-Aug-2021 09:41:23 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://blog.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 316
x-xss-protection: 1; mode=block
expires: Fri, 06-Aug-2021 09:41:23 GMT

Redirect headers

pragma: no-cache
date: Fri, 06 Aug 2021 09:41:23 GMT
last-modified: Fri, 06-Aug-2021 09:41:23 GMT
location: /watch/25634039/1?wmode=7&page-url=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aaldhbh95bz4klu53%3Afp%3A419%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A608%3Acn%3A1%3Adp%3A0%3Als%3A166939739339%3Ahid%3A888528757%3Az%3A120%3Ai%3A20210806114123%3Aet%3A1628242884%3Ac%3A1%3Arn%3A1007784604%3Au%3A162824288488830748%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1628242882860%3Ads%3A0%2C46%2C67%2C0%2C0%2C0%2C%2C266%2C31%2C%2C%2C%2C382%3Adsn%3A1%2C45%2C66%2C1%2C0%2C0%2C%2C268%2C31%2C%2C%2C%2C383%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1628242884%3At%3AIt%27s%20alive%21
strict-transport-security: max-age=31536000
access-control-allow-origin: https://blog.group-ib.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 06-Aug-2021 09:41:23 GMT

POST
H3-29 200 /
www.facebook.com/tr/ 0
18 B 14ms
6ms Ping
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQepk5E7DbRXdzTZe

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 06 Aug 2021 09:41:23 GMT
content-type: text/plain
access-control-allow-origin: https://blog.group-ib.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H/1.1 200
OK /
servedby.flashtalking.com/spot/1/19790;125179;13584/ Frame 4B3A 42 B
355 B 68ms
26ms Image
image/gif 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servedby.flashtalking.com/spot/1/19790;125179;13584/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app48.frk11 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 06 Aug 2021 09:41:24 GMT
Server: prod-xre-app48.frk11
X-HW: 1628242883.dop233.fr8.shc,1628242884.dop233.fr8.t,1628242884.cds108.fr8.sc,1628242884.cds108.fr8.p
Content-Type: image/gif
Cache-Control: no-cache,no-store
Connection: Keep-Alive
Content-Length: 42

GET
H/1.1 200
OK /
servedby.flashtalking.com/segment/2/read/a;;pixel/ Frame 4B3A 42 B
496 B 69ms
28ms Image
image/gif 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servedby.flashtalking.com/segment/2/read/a;;pixel/?s=13584&d=blog.group-ib.com&r=blackmatter
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app26.frk11 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://servedby.flashtalking.com/container/19790;125109;13584;iframe/?ftXRef=[%INSERT_TRANSACTION_ID_HERE%]&ftXValue=[%INSERT_TRANSACTION_VALUE_HERE%]&ftXType=[%INSERT_TRANSACTION_TYPE_HERE%]&ftXName=[%INSERT_TRANSACTION_NAME_HERE%]&ftXNumItems=[%INSERT_TRANSACTION_QUANTITY_HERE%]&ftXCurrency=[%INSERT_TRANSACTION_CURRENCY_HERE%]&U1=[%INSERT_U1_HERE%]&U2=[%INSERT_U2_HERE%]&U3=[%INSERT_U3_HERE%]&U4=[%INSERT_U4_HERE%]&U5=[%INSERT_U5_HERE%]&U6=[%INSERT_U6_HERE%]&U7=[%INSERT_U7_HERE%]&U8=[%INSERT_U8_HERE%]&U9=[%INSERT_U9_HERE%]&U10=[%INSERT_U10_HERE%]&U11=[%INSERT_U11_HERE%]&U12=[%INSERT_U12_HERE%]&U13=[%INSERT_U13_HERE%]&U14=[%INSERT_U14_HERE%]&U15=[%INSERT_U15_HERE%]&U16=[%INSERT_U16_HERE%]&U17=[%INSERT_U17_HERE%]&U18=[%INSERT_U18_HERE%]&U19=[%INSERT_U19_HERE%]&U20=[%INSERT_U20_HERE%]&ft_referrer=https%3A//blog.group-ib.com/blackmatter&ns=&cb=698135.5315080254
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 06 Aug 2021 09:41:24 GMT
Server: prod-xre-app26.frk11
X-HW: 1628242884.dop132.fr8.shc,1628242884.dop132.fr8.t,1628242884.cds206.fr8.sc,1628242884.cds206.fr8.p
Content-Type: image/gif
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 42

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/160/ 11 KB
5 KB 36ms
36ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/160/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 06 Aug 2021 09:41:24 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Feb 2021 02:54:38 GMT
Server: AkamaiNetStorage
ETag: "19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4811
Expires: Sun, 14 Nov 2021 09:41:24 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
658 B 191ms
139ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o6fwj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.group-ib.com%2Fblackmatter

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 09:41:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Fri, 06 Aug 2021 09:41:25 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 03ba4329dc58fe67606cd661802e77074c7624be85e071c5b63e520c9df2f392
x-transaction: a93ec548db243d9c
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-29 204 a
www.googletagmanager.com/ 0
17 B 14ms
14ms Image
image/gif 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-W6XV92M&cv=1&t=ol&g=38&p=gtm&l=268&q=385&f=20&e=6&i=49&d=147&c=110&hc=1&fh=30&sr=0.050000&ps=0.021106695426053923&cb=228684344

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Aug 2021 09:41:25 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
stat.tildacdn.com/event/ 16 B
236 B 106ms
64ms XHR
application/json 185.129.100.115
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.tildacdn.com/event/
Requested by: Host: static.tildacdn.com
URL: https://static.tildacdn.com/js/jquery-1.10.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.129.100.115 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS: ddos-guard.net
Software: ddos-guard /
Resource Hash: fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://blog.group-ib.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://blog.group-ib.com
date: Fri, 06 Aug 2021 09:41:25 GMT
content-encoding: gzip
server: ddos-guard
vary: Accept-Encoding
content-type: application/json;charset=utf-8

Verdicts & Comments Add Verdict or Comment

286 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.flashtalking.com/	1970-01-20 13:48:34	Name: flashtalkingad1 Value: "GUID=4966B847A47769"
.group-ib.com/	1970-01-19 20:17:24	Name: _ym_visorc Value: w
.group-ib.com/	1970-01-19 20:18:34	Name: _ym_isad Value: 2
blog.group-ib.com/	1970-01-19 22:27:02	Name: tildauid Value: 1628242883346.835836
.blog.group-ib.com/	1970-01-19 20:18:49	Name: _gid Value: GA1.3.1631251296.1628242883
.group-ib.com/	1970-01-20 05:02:58	Name: _ym_uid Value: 162824288488830748
.group-ib.com/	1970-01-19 22:26:58	Name: _gcl_au Value: 1.1.134332137.1628242883
.group-ib.com/	1970-01-20 13:48:34	Name: _ga Value: GA1.2.1016920943.1628242883
.group-ib.com/	1970-01-19 20:18:49	Name: _gid Value: GA1.2.1631251296.1628242883
.blog.group-ib.com/	1970-01-19 20:17:22	Name: _dc_gtm_UA-25492706-2 Value: 1
.group-ib.com/	1970-01-20 05:02:58	Name: _ym_d Value: 1628242884
blog.group-ib.com/	1970-01-19 20:17:24	Name: tildasid Value: 1628242883346.903551
.group-ib.com/	1970-01-20 05:02:58	Name: __ddg1 Value: jcFgQ91BUQwdCLPte4Qf
.group-ib.com/	1970-01-19 22:26:58	Name: _fbp Value: fb.1.1628242883402.941877024
.blog.group-ib.com/	1970-01-20 13:48:34	Name: _ga Value: GA1.3.1016920943.1628242883

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
blog.group-ib.com
connect.facebook.net
go.affec.tv
map.go.affec.tv
mc.yandex.com
mc.yandex.ru
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
secure.adnxs.com
servedby.flashtalking.com
snap.licdn.com
stat.tildacdn.com
static.ads-twitter.com
static.tildacdn.com
stats.g.doubleclick.net
t.co
thumb.tildacdn.com
ws.tildacdn.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.group-ib.com
www.linkedin.com
104.111.234.67
104.244.42.3
104.244.42.5
108.174.10.14
151.101.12.157
151.236.71.248
151.236.71.44
176.34.180.108
178.248.235.63
178.248.236.28
185.129.100.113
185.129.100.115
185.33.220.244
209.197.3.19
2620:119:50e3:101::6cae:b45
2620:1ec:22::14
2a00:1450:4001:801::2003
2a00:1450:4001:827::2004
2a00:1450:4001:827::200e
2a00:1450:4001:82b::2008
2a00:1450:400c:c06::9a
2a02:26f0:6c00:2b0::25ea
2a02:6b8::1:119
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
54.228.198.56
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
02c0f927c4ba086f771d1139b3e769cb3da9cb4d6f02da62fd460b1a6f269194
066992830c428b2fb261177f72e02bc992cdcb5f4cc117ceeea28032e26bf7bf
06a082aa178adb8a8e057d05099d61daad3477077fa669c29dae7417c37a336a
07a23b618075104849d8dc806499faf025761532347d5c244e488142de01e106
07cc9932ed0e2c7a958c6bf6e3a928847b9fe3f271832767ec89ee34e78f5227
090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9
0a619506dabe4ed90f07f41f176c558a2b2c1623b63ad0f9eaedfd939fe13656
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12b0d17bef9ef2ba1d3139187def68ecd23f78d5be52a2dbbc03ce01526c621f
179c2da1c8e3d145e451d00ae0a59f88f96654135dadbc8b1fe4d931a327ad22
19cc6e4b03f164ccb8d68121c3dfc374926bc9eaab12a4216306963bdefd76de
29243d52896581d8eb35f00348edc871d359e8dff1d0193db6675b7454fd9190
2981e2f4f34c9cc18bdcbe5a2e18a0325cda21389e6132d09c3dbd39af02134d
2e0c7e6603b288be408d7a1c29fc74e9a01089a5bc4506cee95e2a5567cd47ac
2e59794c9e506814df50c2fe349d9fc8d6418a5959ba5a5b18cbc4742ebba1de
2ee539c03c8c77934120b600067ad4e1c93a3df45ae26c354fbd416d5107129c
32474df38fae62b8dd37ee4e3de4570c30660eb7f3f37cbfce348153e9a23c9b
34a7169ecc9505ee19bb7b1f267d88eb99b31b0be1ca671ff21007ae73167020
3e3277bbab0a2dc7a04abd8324535b2f970bba7b019dddc0e7b2834085f9766e
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
587bfd92429b7b2200b10b9caacfdc3137339cbf6a8f7d508a5deb876f9e34a5
5ad5171287c6d8cd3f604df3559129c28c5aaea6cc67ccdef3d0a509dbdd7a64
5d59e49cf21a4f8274ee20aff8f205aaf692993966456d9e71631e2ac1a06e05
5fe5c82d2d65d64ac35ab12f009a98cabc3dcfb9babc5d5452d66282eb4a0d7d
65a7577f35726ea847bdf440ad18a70ee61c01ef0b5ee26b0e6a2352ace3a2ce
66dc19f5644fe6fac24a19fc890e36278d8d2b0d089791a67f7ff0c628a7f7bd
6dc36143d36bdd5f62e95f70217299607b97f9b018275a9cb49b6358878e0ee6
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271
709af166465530f9ab9fde6a8da14bfc99352e3ff87b9b93abfef62b4b48463e
74bcacf05084912a5515513a323993746432f885e36536a524eb991b9883e73b
7a1ead29fc05de620b1adb86728a27f470e0de9339d6b87932a8f3f52a3a7ce6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
9d005c1939236926ac6f06522f0a1e32eeffda988f6272efb8b7a698be2dfb9d
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a5f3d592950360397e7b1a90b2954c5e8d397a7522b6244d020b24ab8b8d1ee5
aa0be60ed739f7dabafdb20080b577066add49d1450638e7d0f4dbe89576d106
aaa53b7966f71ea94c27d3ec4f5598a616723c1576bbc707698f8fc2db4b54b4
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b396e7e74b72abed0e035e1926b5bedb4bb800be5558f9739fc6b2be61406b47
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
bb9a3150006283c76a2f38e1a0e6dfaf3bbfced1e46755421911769bf1381554
bbbc7f86631845d49d5baba17ec2b1cd20ddf67132a054b146396b042ea95bf1
bd3031a385d4290572186785e788f449e40913c36867607a19ba509f76d36c81
bedddba03e340da370d5d2dd181b67c3154861388eb3ca6ad4f0062b0adcdd22
c314248993e0427343c8d0c32583ea7ef12eb74effb15aefa550484eb3f132fa
c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc
c8a1359a7d678c3e6fac8087be448eabc8ef8bd9af6c3b673bf939c8e898439c
cf2c58c07b25eedb7ac08c2e3c54a2a65e264979862a51a448ee81d96b8c1601
cf6dd38ec350a326c34ce367ea89d9c273a90cffea548827e388ef1106acd40b
d833cc97a87c002d2ea8b77a80eae206e1cfa868922ddf77ad68d73a47c4607c
d845ac461a77e54af0e48ca2e3dcac959f793205c2eefbf1d698bc0f73998f34
de83b00fb566ccbd2c0af882f431ace14bc313ca8c31a198b3b6585c481af4a7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0b12efebc0c07ae891eb68081b93a56831dbcc6e614ebf1ccc471676b5e5f03
e16f6925411b2991b37bb5154b2c90ac8c2a6feef1fbef47beb0e96071a63de5
e1cb5ba88790df5205d9d51afcdf19ba7e8e7a101ad0a617f71c03651a696d7f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
ec69b109d174c69efc9d5f85de132aa616f544d30d2e09f3cc5faa4aa426c804
ed78d080722b8fc60da052d08981ccb32d3b8ec57a9785a5d596ea6ef7ba613a
ee834fea8083fdba1e884b530abe364c78d61ec45f0ea39a23a68faadced3f65
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0102e4b01506e155d94f7a90eac6f00dbdf80a33155a9d840e959ff518441ee
f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce
fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce
fd7c6c727e06d5e1207e619fe0ae52ff02dbde3d7c6775acf04a72b99afa18fa

blog.group-ib.com Open in urlscan Pro 185.129.100.113 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

76 Requests

100 %HTTPS

42 %IPv6

20 Domains

27 Subdomains

25 IPs

6 Countries

775 kBTransfer

1804 kBSize

15 Cookies

34 Outgoing links

Redirected requests

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.group-ib.com Open in urlscan Pro
185.129.100.113 Public Scan

Screenshot
Live screenshot

Full Image

76
Requests

100 %
HTTPS

42 %
IPv6

20
Domains

27
Subdomains

25
IPs

6
Countries

775 kB
Transfer

1804 kB
Size

15
Cookies

76 HTTP transactions
3 data transactions