embee-research.ghost.io Open in urlscan Pro
2a04:4e42:200::775 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8...
Effective URL:
https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/...
Submission: On December 19 via manual (December 19th 2023, 8:07:22 am UTC) from IN — Scanned from DE

Summary HTTP 34 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 34 HTTP transactions. The main IP is 2a04:4e42:200::775, located in United States and belongs to FASTLY, US. The main domain is embee-research.ghost.io.
TLS certificate: Issued by R3 on October 23rd 2023. Valid for: 3 months.

This is the only time embee-research.ghost.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:440... 2606:4700:4400::ac40:96d2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	2a04:4e42:200... 2a04:4e42:200::775	54113 (FASTLY) (FASTLY)
3	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
2	2400:52e0:1e0... 2400:52e0:1e00::1080:1	200325 (BUNNYCDN) (BUNNYCDN)
3	54.187.159.182 54.187.159.182	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:224... 2600:9000:224a:e600:19:7d10:bd80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	34.213.26.22 34.213.26.22	16509 (AMAZON-02) (AMAZON-02)
34	8

2 2606:4700:4400::ac40:96d2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

d11-vh04.na1.hubspotlinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a04:4e42:200::775 (United States)

ASN54113 (FASTLY, US)

embee-research.ghost.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.64.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1e00::1080:1 (Germany)

ASN200325 (BUNNYCDN, SI)

plausible.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:224a:e600:19:7d10:bd80:93a1 (United States)

ASN16509 (AMAZON-02, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.213.26.22 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-213-26-22.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	ghost.io embee-research.ghost.io	6 MB
7	stripe.com js.stripe.com — Cisco Umbrella Rank: 1282 q.stripe.com — Cisco Umbrella Rank: 7730 m.stripe.com — Cisco Umbrella Rank: 1245	165 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 313	368 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1361	16 KB
2	plausible.io plausible.io — Cisco Umbrella Rank: 9753	2 KB
2	hubspotlinks.com 1 redirects d11-vh04.na1.hubspotlinks.com	4 KB
34	6

	Domain	Requested by
19	embee-research.ghost.io	d11-vh04.na1.hubspotlinks.com embee-research.ghost.io cdn.jsdelivr.net
3	q.stripe.com	d11-vh04.na1.hubspotlinks.com
3	js.stripe.com	embee-research.ghost.io js.stripe.com
3	cdn.jsdelivr.net	embee-research.ghost.io
2	m.stripe.network	js.stripe.com m.stripe.network
2	plausible.io	embee-research.ghost.io plausible.io
2	d11-vh04.na1.hubspotlinks.com	1 redirects
1	m.stripe.com	m.stripe.network
34	8

This site contains links to these domains. Also see Links.

Domain
search.censys.io
twitter.com
ghost.org

Subject Issuer	Validity	Valid
hubspotlinks.com Cloudflare Inc ECC CA-3	`2023-04-17` - `2024-04-16`	a year	crt.sh
ghost.io R3	`2023-10-23` - `2024-01-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2023-10-30` - `2024-01-25`	3 months	crt.sh
plausible.io R3	`2023-12-13` - `2024-03-12`	3 months	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-09` - `2024-01-18`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-05` - `2024-01-18`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Frame ID: 27EF67C99025E38166F0E87E4B357D1B
Requests: 26 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: 48AF70F1AB8B6B1A21AAA4AF2D7CC38A
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 01C816EF99981C2A9B2D9F3B6C759430
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Advanced Threat Intel Queries - Catching 83 Qakbot Servers with Regex, Censys and TLS Certificates

Page URL History Show full URLs

https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6... Page URL
https://d11-vh04.na1.hubspotlinks.com/events/public/v1/encoded/track/tc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqV... HTTP 307
https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-a... Page URL

Detected technologies

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Plausible (Analytics) Expand

Overall confidence: 100%
Detected patterns

plausible\.io/js/plausible\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

34
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

8
IPs

2
Countries

6962 kB
Transfer

10518 kB
Size

3
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.tls.certificates.leaf_data.subject_dn%3D%2FC%3D%5Cw%5Cw%2C+OU%3D%5Ba-zA-Z0-9+%5C.%5D%2B%2C+CN%3D%5Ba-z%5D%2B%5C.%5Ba-z%5D%2B%2F+and+services.tls.certificates.leaf_data.issuer_dn%3D%2FC%3D%5Cw%5Cw%2C+ST%3D%5Cw%5Cw%2C+L%3D%5Ba-zA-Z%5D%2B%2C+O%3D%5Ba-zA-Z0-9%5C.+%5D%2B%2C+CN%3D%5Ba-z%5D%2B%5C.%5Ba-z%5D%2B%2F+%E2%86%A9+&ref=embee-research.ghost.io
Title: A link can be found here

Search URL Search Domain Scan URL

URL: https://twitter.com/drb_ra?ref=embee-research.ghost.io
Title: drb_ra

Search URL Search Domain Scan URL

URL: https://ghost.org/
Title: Ghost

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04 Page URL
https://d11-vh04.na1.hubspotlinks.com/events/public/v1/encoded/track/tc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04?_ud=b7f22e6e-0349-4f0c-9ec7-11b98f111b0b&_jss=1&_fl=8&_pl=3&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1600,1200 HTTP 307
https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtN...
d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/ 8 KB
3 KB 340ms
313ms Document
text/html 2606:4700:4400::ac40:96d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:96d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: false
cf-cache-status: DYNAMIC
cf-ray: 837e26ad0c3d1e4d-FRA
content-encoding: br
content-type: text/html;charset=utf-8
date: Tue, 19 Dec 2023 08:07:17 GMT
referrer-policy: no-referrer
server: cloudflare
vary: origin
x-content-type-options: nosniff
x-envoy-upstream-service-time: 8
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/event-tracking-td/envoy-proxy-cb48dccbd-px4sn
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 5fb9cb68-5324-47e0-a570-05ac52f3c11c
x-request-id: 5fb9cb68-5324-47e0-a570-05ac52f3c11c
x-robots-tag: none

GET
H2

200

Primary Request / Show response
embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/
Redirect Chain

https://d11-vh04.na1.hubspotlinks.com/events/public/v1/encoded/track/tc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M...
https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=2870332...

62 KB
12 KB

48ms
14ms

Document
text/html

2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Requested by: Host: d11-vh04.na1.hubspotlinks.com
URL: https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: b1157f328346c87a9cf04c438391b1ef827427c6e27d965f3ce74e3dfba97745

Request headers

Referer: https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 93218
alt-svc: clear
cache-control: public, max-age=0
content-encoding: gzip
content-length: 12351
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 08:07:17 GMT
etag: W/"f8d0-7qUHKoaX1j5bHgbGbnMe6OlOssk"
ghost-age: 0
ghost-cache: MISS
ghost-fastly: true
server: openresty
status: 200 OK
vary: Cookie, Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS
x-cache-hits: 29, 0
x-request-id: 8685459f-6d55-43b2-a0aa-71bb51e26b48 8685459f-6d55-43b2-a0aa-71bb51e26b48
x-served-by: cache-ams21026-AMS, cache-fra-eddf8230063-FRA
x-timer: S1702973238.796711,VS0,VE8

Redirect headers

access-control-allow-credentials: false
cf-cache-status: DYNAMIC
cf-ray: 837e26af1e8d1e4d-FRA
date: Tue, 19 Dec 2023 08:07:17 GMT
link: <https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email>; rel="canonical"
location: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
referrer-policy: no-referrer
server: cloudflare
vary: origin
x-content-type-options: nosniff
x-envoy-upstream-service-time: 34
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/event-tracking-td/envoy-proxy-cb48dccbd-ltqgb
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 80cb3175-56a1-4f4b-b0f2-b64435226b15
x-request-id: 80cb3175-56a1-4f4b-b0f2-b64435226b15
x-robots-tag: none

GET
H2 200 screen.css
embee-research.ghost.io/assets/built/ 49 KB
10 KB 8ms
8ms Stylesheet
text/css 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/assets/built/screen.css?v=4b294bb165
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: e8b93c637a0c1300e1da13db78122678f365466d59ca36889098feb0eb1222d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 661783
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 9550
ghost-fastly: true
x-request-id: dab7bfcc-df37-460b-9f3d-f6cbefcacf16, dab7bfcc-df37-460b-9f3d-f6cbefcacf16
x-served-by: cache-ams12770-AMS, cache-fra-eddf8230063-FRA
last-modified: Mon, 04 Dec 2023 15:20:44 GMT
server: openresty
x-timer: S1702973238.815378,VS0,VE1
etag: W/"c426-18c356ad8e0"
vary: Cookie, Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 28, 1

GET
H2 200 source.js Show response
embee-research.ghost.io/assets/built/ 51 KB
18 KB 9ms
9ms Script
application/javascript 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/assets/built/source.js?v=4b294bb165
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: e3df1869daa63b392b43f8d5491e93b48b4056ff9421324be245e9d65c7e9c60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 661783
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 18403
ghost-fastly: true
x-request-id: 0a6691bc-6f54-4e41-8add-5a455111ca68, 0a6691bc-6f54-4e41-8add-5a455111ca68
x-served-by: cache-ams21051-AMS, cache-fra-eddf8230063-FRA
last-modified: Mon, 04 Dec 2023 15:20:44 GMT
server: openresty
x-timer: S1702973238.815382,VS0,VE1
etag: W/"ccd0-18c356ad8e0"
vary: Cookie, Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 27, 1

GET
H2 200 portal.min.js Show response
cdn.jsdelivr.net/ghost/portal@~2.36/umd/ 1 MB
258 KB 61ms
43ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js

Requested by

Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

905294f5d28180922d1b5cb1e5c46c01157ef38b6d69c17ceb3b46ca0ccab863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Origin: https://embee-research.ghost.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:07:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 22121
x-jsd-version: 2.36.5
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230036-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"1096bd-DvZjCw7RhYu/N7+ZNWVG9tOZ04k"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7wGzIHgDkq1v3vIQ0kZ0b3HxwCSMh6H0%2BD75W%2BystQpk1zO42tkfm6w9xevdma5zHMovBKwS%2BUwe0SlQ6UnLV95CYNdcRlAsEEBVA3adeIxdcQbYHyDE70q4210QYHLqopSlorfJCinDZr9rB%2Bc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin: *
cf-ray: 837e26b09bfa911e-FRA

GET
H2 200 / Show response
js.stripe.com/v3/ 578 KB
161 KB 34ms
12ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

602a41ac72856f979309e41f203569d1140f2fb90576dc4c92202382e5d220c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish
age: 60
x-cache: HIT
content-length: 164271
x-request-id: 8a831cbd-6bee-40e4-a427-021349866d98
x-served-by: cache-fra-eddf8230089-FRA
last-modified: Mon, 18 Dec 2023 21:48:24 GMT
server: Fastly
etag: "1da1aee3c30e122dde47681e32264833"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 142877

GET
H2 200 sodo-search.min.js Show response
cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/ 197 KB
65 KB 48ms
30ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/sodo-search.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Origin: https://embee-research.ghost.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:07:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7044
x-jsd-version: 1.1.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230102-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"313b2-PGFkfSo33Bwphw9PaHfsB1kMn/Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=minYWHXSBbzEJfiawLH7AP5N3eM9%2FU9lk2N0Ty5sX8D0AaTRfC2JqtXEne%2BJ1TJ7%2FSAz5dUqo7JcE2rvVMsfHJoz670t%2FB84y9H9xxMj4CvK1xptmMnvqL0FgiHBUYJKshYpscsVrWiDGCRRxEk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin: *
cf-ray: 837e26b09bf9911e-FRA

GET
H2 200 announcement-bar.min.js Show response
cdn.jsdelivr.net/ghost/announcement-bar@~1.1/umd/ 133 KB
45 KB 44ms
27ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/ghost/announcement-bar@~1.1/umd/announcement-bar.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9bbb29383e6b6b083e0d43954969879f85ccb598ba9d3e5e8f401ea0f5a311c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Origin: https://embee-research.ghost.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:07:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 17524
x-jsd-version: 1.1.8
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230109-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"21503-KWHfMOfsFaxOHrsJKAryB4KsSAE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XYn5Q0heWF4GWNNBH%2FMHpr9YGdiDz5YEOJKOwluEppGTAlFmhK17Ddw4NsvSNLQKTqsgQ3Zqqueo2%2BlnwMFbIw%2BFDnQDbhOWnNviwGhmDIHSnITnaHu6AJXUsFYnZNWx21YU1aIQ89gTG8FrNDY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin: *
cf-ray: 837e26b09bfb911e-FRA

GET
H2 200 cards.min.js Show response
embee-research.ghost.io/public/ 7 KB
2 KB 14ms
14ms Script
application/javascript 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/public/cards.min.js?v=4b294bb165
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 661782
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 1557
ghost-fastly: true
x-request-id: be8a4484-8878-4692-868a-daa6a1ec3160, be8a4484-8878-4692-868a-daa6a1ec3160
x-served-by: cache-ams12774-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.834348,VS0,VE1
etag: W/"431228c753b74a6958600d170f921e6d"
vary: Cookie, Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 28, 1

GET
H2 200 cards.min.css
embee-research.ghost.io/public/ 39 KB
7 KB 8ms
8ms Stylesheet
text/css 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/public/cards.min.css?v=4b294bb165
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 54682e379031e7d89b632f95f6ce239060db2a9d7fce9f92638dc4a8cbd1ae41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 661783
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 6753
ghost-fastly: true
x-request-id: 9f71df49-98d2-438c-8302-cd121529d035, 9f71df49-98d2-438c-8302-cd121529d035
x-served-by: cache-ams12732-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.815364,VS0,VE1
etag: W/"d3c677de6b672445cc6386191937cf9b"
vary: Cookie, Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 30, 1

GET
H2 200 member-attribution.min.js Show response
embee-research.ghost.io/public/ 2 KB
925 B 15ms
15ms Script
application/javascript 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/public/member-attribution.min.js?v=4b294bb165
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 0b144beb896e0d7612e0eeab489e4e682adac07cbc139924ce892bde3ccd3605

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 661782
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 727
ghost-fastly: true
x-request-id: 6e6acdcc-6af8-4a13-9e1d-6ba762bf68d2, 6e6acdcc-6af8-4a13-9e1d-6ba762bf68d2
x-served-by: cache-ams21026-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.834444,VS0,VE1
etag: W/"909b42c515ee6c2aece5a3f270049f98"
vary: Cookie, Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 27, 1

GET
H2 200 plausible.js Show response
plausible.io/js/ 1 KB
1 KB 61ms
22ms Script
application/javascript 2400:52e0:1e00::1080:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://plausible.io/js/plausible.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1080 /

Resource Hash

021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: br
x-content-type-options: nosniff
cdn-edgestorageid: 1082
cdn-cachedat: 12/19/2023 07:36:55
cdn-pullzone: 682664
cross-origin-resource-policy: cross-origin
application: 10.0.0.3
alt-svc: h3=":443"; ma=2592000
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cache-control: public, max-age=3600
permissions-policy: interest-cohort=()
cdn-requestid: 02145f0fee3a3e56d6a9a44b2f1603ef
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 logo.svg-1.svg
embee-research.ghost.io/content/images/2023/11/ 7 MB
6 MB 14ms
14ms Image
image/svg+xml 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/2023/11/logo.svg-1.svg
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: ce406b5d3abda62e8c63326a5de8370dacb1ba7bf12035bf9a61f79b6dd37af6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1700587
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 5898964
ghost-fastly: true
x-request-id: ec3d531c-b9da-4f72-8002-49d00d99b58d, ec3d531c-b9da-4f72-8002-49d00d99b58d
x-served-by: cache-ams21061-AMS, cache-fra-eddf8230063-FRA
last-modified: Tue, 28 Nov 2023 12:18:14 GMT
server: openresty
x-timer: S1702973238.816381,VS0,VE1
etag: W/"777d25-18c15dd9efe"
vary: Cookie, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 13, 0

GET
H2 200 Advanced-Threat-Intel-Queries-With-Regular-Expressions.png
embee-research.ghost.io/content/images/size/w2000/2023/11/ 185 KB
185 KB 14ms
14ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w2000/2023/11/Advanced-Threat-Intel-Queries-With-Regular-Expressions.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 5bf5d70f9bfbf04d77659c506ade2cefaa2852a97861b4cf6cada8dc9f73d8ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1633280
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 189249
ghost-fastly: true
x-request-id: c270d000-a14c-40bc-b8cc-1924dc7b4883, c270d000-a14c-40bc-b8cc-1924dc7b4883
x-served-by: cache-ams12736-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:25:57 GMT
server: openresty
x-timer: S1702973238.816159,VS0,VE1
etag: W/"2e341-18c1fc389a3"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 122, 1

GET
H2 200 inter-roman.woff2
embee-research.ghost.io/assets/fonts/ 37 KB
37 KB 16ms
16ms Font
font/woff2 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/assets/fonts/inter-roman.woff2
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/assets/built/screen.css?v=4b294bb165
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 39e72c0794c12f2dbb14a0f61ca946b535f795b1478fcf795bd26e5cb52ded34

Request headers

Referer: https://embee-research.ghost.io/assets/built/screen.css?v=4b294bb165
Origin: https://embee-research.ghost.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1361136
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 37780
ghost-fastly: true
x-request-id: d64a21c1-e2bd-4919-ab02-65024dc8db57, d64a21c1-e2bd-4919-ab02-65024dc8db57
x-served-by: cache-ams12734-AMS, cache-fra-eddf8230063-FRA
last-modified: Mon, 27 Nov 2023 08:20:51 GMT
server: openresty
x-timer: S1702973238.842421,VS0,VE1
etag: W/"9394-18c0fddeab8"
vary: Cookie
content-type: font/woff2
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 11, 1

GET
H2 200 image-338.png
embee-research.ghost.io/content/images/size/w1000/2023/11/ 56 KB
57 KB 37ms
36ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w1000/2023/11/image-338.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 8096c53b1754b65e9decf7620bb8a80110bea2a7b4a7c2ba78e57bf7b57fd554

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1401373
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 57708
ghost-fastly: true
x-request-id: 6b43e5ad-9e07-4bfe-842b-ea602d68d725, 6b43e5ad-9e07-4bfe-842b-ea602d68d725
x-served-by: cache-ams21060-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:26:24 GMT
server: openresty
x-timer: S1702973238.872877,VS0,VE1
etag: W/"e16c-18c1fc3f386"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 57, 1

GET
H2 200 image-339.png
embee-research.ghost.io/content/images/size/w1000/2023/11/ 87 KB
87 KB 44ms
43ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w1000/2023/11/image-339.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: f448dc782f109b2d90faa5dc429ea803d30ec7087c3de482131dfb7b5ee54518

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 896829
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 88953
ghost-fastly: true
x-request-id: 67fca312-5452-497a-a80b-3e7ba640e13c, 67fca312-5452-497a-a80b-3e7ba640e13c
x-served-by: cache-ams21023-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:26:24 GMT
server: openresty
x-timer: S1702973238.872847,VS0,VE1
etag: W/"15b79-18c1fc3f3ea"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 13, 1

GET
H2 200 image-340.png
embee-research.ghost.io/content/images/size/w1000/2023/11/ 79 KB
79 KB 43ms
42ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w1000/2023/11/image-340.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: abdf7a06892a7c9e0e21118a30dfc1dda5a47401ce13ed3958ee02ff52eb0cfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1342807
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 81051
ghost-fastly: true
x-request-id: 46fae5b2-37e0-4467-ac7c-cad6b9f0639b, 46fae5b2-37e0-4467-ac7c-cad6b9f0639b
x-served-by: cache-ams12783-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:26:24 GMT
server: openresty
x-timer: S1702973238.873107,VS0,VE1
etag: W/"13c9b-18c1fc3f3be"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 14, 1

GET
H2 200 image-341.png
embee-research.ghost.io/content/images/size/w1000/2023/11/ 77 KB
77 KB 48ms
47ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w1000/2023/11/image-341.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 3e139e25647941de577615522bc34fbf4cb2a21a5019f4702e69806b5780a869

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1633155
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 78502
ghost-fastly: true
x-request-id: 4854f7bc-7c76-4cb1-b19f-9e9d80cb1ad8, 4854f7bc-7c76-4cb1-b19f-9e9d80cb1ad8
x-served-by: cache-ams12750-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:26:25 GMT
server: openresty
x-timer: S1702973238.873088,VS0,VE1
etag: W/"132a6-18c1fc3f47c"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 138, 1

GET
H2 200 image-342.png
embee-research.ghost.io/content/images/size/w1000/2023/11/ 69 KB
70 KB 43ms
42ms Image
image/png 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embee-research.ghost.io/content/images/size/w1000/2023/11/image-342.png
Requested by: Host: embee-research.ghost.io
URL: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: d54b81417a5066b87358ba42f4f083c2e7198371e3d465f18f7bc1983f7fbcd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:17 GMT
via: 1.1 varnish, 1.1 varnish
age: 1633155
x-cache: HIT, HIT
status: 200 OK
alt-svc: clear
content-length: 71038
ghost-fastly: true
x-request-id: 222d28b2-6d53-43c6-a2bd-ab599caa34b8, 222d28b2-6d53-43c6-a2bd-ab599caa34b8
x-served-by: cache-ams21046-AMS, cache-fra-eddf8230063-FRA
last-modified: Thu, 30 Nov 2023 10:26:25 GMT
server: openresty
x-timer: S1702973238.873080,VS0,VE1
etag: W/"1157e-18c1fc3f509"
vary: Cookie
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 12, 1

GET
H2 204 /
embee-research.ghost.io/members/api/member/ 0
0 7ms
7ms Fetch 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/members/api/member/
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:18 GMT
via: 1.1 varnish, 1.1 varnish
age: 94299
x-cache: HIT, HIT
status: 204 No Content
alt-svc: clear
ghost-fastly: true
x-request-id: a8774113-3b2b-4a35-9e1e-40a6ffebda85, a8774113-3b2b-4a35-9e1e-40a6ffebda85
x-served-by: cache-ams12733-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.028813,VS0,VE1
vary: Cookie
access-control-allow-origin: *
cache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 18, 1

POST
H2 202 event Show response
plausible.io/api/ 2 B
502 B 47ms
21ms XHR
text/plain 2400:52e0:1e00::1080:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://plausible.io/api/event
Requested by: Host: plausible.io
URL: https://plausible.io/js/plausible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-1080 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Dec 2023 08:07:18 GMT
cdn-edgestorageid: 1080
cdn-cachedat: 12/19/2023 08:07:18
cdn-pullzone: 682664
application: 10.0.1.5
alt-svc: h3=":443"; ma=2592000
content-length: 2
x-request-id: F6ItIyWt2hPv3DNNUtQO
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 202
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cache-control: must-revalidate, max-age=0, private
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
cdn-requestid: e56cf05de1543205e52f162a20b51356
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 / Show response
embee-research.ghost.io/ghost/api/content/settings/ 2 KB
1 KB 7ms
7ms Fetch
application/json 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/ghost/api/content/settings/?key=5b00360b75171de09d2f740e1c&limit=all
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 7fd5984766d6b5f68a02c5423c4a5d985df3fb91280340183e5e6a410e060f8f

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:18 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 94299
x-cache: HIT, HIT
status: 200 OK
content-version: v5.75
alt-svc: clear
content-length: 794
ghost-fastly: true
x-request-id: fbe8aaf9-e52a-4b42-8a33-c454613918f7, fbe8aaf9-e52a-4b42-8a33-c454613918f7
x-served-by: cache-ams12769-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.148288,VS0,VE1
etag: W/"79f-vBmF4iBI448R+atqZe6gKGQnAUE"
vary: Accept-Version, Cookie, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 18, 1

GET
H2 200 / Show response
embee-research.ghost.io/ghost/api/content/tiers/ 437 B
494 B 8ms
8ms Fetch
application/json 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/ghost/api/content/tiers/?key=5b00360b75171de09d2f740e1c&limit=all&include=monthly_price,yearly_price,benefits
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: ea154a658cf5ba6cf1540b657987e4fcfd00d45166247f5fef0b06145cec5319

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:18 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 94299
x-cache: HIT, HIT
status: 200 OK
content-version: v5.75
alt-svc: clear
content-length: 317
ghost-fastly: true
x-request-id: 7c34efbb-4448-4952-b9ef-46a8d1e7a02d, 7c34efbb-4448-4952-b9ef-46a8d1e7a02d
x-served-by: cache-ams21058-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.148512,VS0,VE1
etag: W/"1b5-b0/x18mkjTR6L8kehfvHdG7TdRg"
vary: Accept-Version, Cookie, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 18, 1

GET
H2 200 / Show response
embee-research.ghost.io/ghost/api/content/newsletters/ 424 B
464 B 8ms
8ms Fetch
application/json 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/ghost/api/content/newsletters/?key=5b00360b75171de09d2f740e1c&limit=all
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 965a68e391935e57237ebbdcc4c3abef4bad9b78b899bbbbe1207af181d5ba3a

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

ghost-age: 0
date: Tue, 19 Dec 2023 08:07:18 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 94299
x-cache: HIT, HIT
status: 200 OK
content-version: v5.75
alt-svc: clear
content-length: 301
ghost-fastly: true
x-request-id: a92b6efe-8be8-408a-9212-81a74a4896d6, a92b6efe-8be8-408a-9212-81a74a4896d6
x-served-by: cache-ams21046-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.148491,VS0,VE1
etag: W/"1a8-1yqZA6yhlSx9D29afCuwuY8hT9k"
vary: Accept-Version, Cookie, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0
ghost-cache: MISS
accept-ranges: bytes
x-cache-hits: 18, 1

GET
H2 200 / Show response
embee-research.ghost.io/members/api/announcement/ 21 B
290 B 40ms
40ms Fetch
application/json 2a04:4e42:200::775
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://embee-research.ghost.io/members/api/announcement/
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/announcement-bar@~1.1/umd/announcement-bar.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::775 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: openresty /
Resource Hash: 12c7dfa3ed440aacad42055f50a0af1e724aa57f55736178dbb57fcd6f09162f

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

ghost-age: 94299
date: Tue, 19 Dec 2023 08:07:18 GMT
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
status: 200 OK
alt-svc: clear
content-length: 21
ghost-fastly: true
x-request-id: 664d6adc-f391-4be2-bf7f-d29eee650796, 48bccb3d-1c1f-4c53-8735-bc326f14b813
x-served-by: cache-ams21080-AMS, cache-fra-eddf8230063-FRA
server: openresty
x-timer: S1702973238.148487,VS0,VE20
etag: W/"15-VHZm2rrAaOUNAcH6ZcKLsrprl30"
vary: Cookie, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
ghost-cache: HIT
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 m-outer-27c67c0d52761104439bb051c7856ab1.html Show response
js.stripe.com/v3/ Frame 48AF 200 B
840 B 6ms
6ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/?utm_campaign=Email_Executive-Brief_WW&utm_medium=email&_hsmi=287033221&_hsenc=p2ANqtz--Bssp5zOgK_QZ-OK3Xk8xKfFBCruXChz5t9EGaqRFJ1VOThOnnl0yRaqdjZavAOhMOr9OuDwCsGXgdz4PvGITx9ppc8KX9T-nvrsMqjUuHkPRAXWw&utm_content=287032084&utm_source=hs_email
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1662264
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 08:07:18 GMT
etag: "27c67c0d52761104439bb051c7856ab1"
last-modified: Fri, 08 Sep 2023 21:23:50 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 408602
x-content-type-options: nosniff
x-request-id: bfcb4539-b4ca-4890-86df-1d3f57962121
x-served-by: cache-fra-eddf8230089-FRA

GET
H2 200 m-outer-6576085ca35ee42f2f484cda6763e4aa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 48AF 631 B
533 B 8ms
8ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 19 Dec 2023 08:07:18 GMT
via: 1.1 varnish
age: 1242729
x-cache: HIT
content-length: 399
x-request-id: 9ce3b33c-4d24-4b1c-8104-ed91c519c123
x-served-by: cache-fra-eddf8230089-FRA
last-modified: Fri, 08 Sep 2023 21:23:49 GMT
server: Fastly
etag: "70cacf09ae81711ac6dcbc5ee59750c4"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 388914

POST
H2 200 csp-report
q.stripe.com/ Frame 48AF 0
717 B 511ms
169ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Host: d11-vh04.na1.hubspotlinks.com
URL: https://d11-vh04.na1.hubspotlinks.com/Ctc/2M+113/d11-vh04/VX7zhS4HG-xhW2TZvWY5DgXNqVfQRxk57cR0tMLtlV45nXHsW6N1X8z6lZ3pgW4YxJqT1SksjdW8jvdg113vhWyW6vd4M85VQw2WW4kMS7S6M-qHBW4wTpXf2ghgvhW2MrWfB7Psmp5W42DhxB66vFmMW2Z3f8G6sZTf6W2Xn29F9d8-k9W1HVFLh2fjmklW4MCtNv345tv_W7r8rMT7lv8sVW6MBRfm5cpwlrW4gxxCF2xkhFLV78r-C47kyhBW43D3Nx7GMKgsW35zWRg1y58byW8Z6lwl4XZ1QdW1jJkBx3F8yTpW2R3GxC5hmYdNW2s-pxf4S17VPW54Sr5t18r0w9W8YcsCV8PY8NQN6ZR6pcZQd4JW2fgblh7sCndyW1PtQj85M8P8CW8K_W3F8snSjrW6-8dpY4X2xbNW8BFqHG5X7R5cW2fP8zz5x2z6NW7BqwHg49HL3PW5YRhn99kVLsNN4mQrVPdrvhKW7HFyH68sWCx5N3C03rWv00wdW78Ks255QsF18W53yl4d7KXFRLW5C2wvh8C7kVWf5K9hmb04

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 19 Dec 2023 08:07:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1702973238583639
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1702973238583021
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 48AF 0
718 B 509ms
168ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 19 Dec 2023 08:07:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1702973238583175
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1702973238582959
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 01C8 930 B
2 KB 43ms
12ms Document
text/html 2600:9000:224a:e600:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:224a:e600:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 41
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 08:06:40 GMT
etag: "06bfcd88af438673a8bf9b845a11aa6e"
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-amz-cf-id: ReNE30Qmn7kEtlMPvNJbr3Q7NbOQjYeqzowfup6YrEM5tun2hkSBYg==
x-amz-cf-pop: DUS51-P1
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 csp-report
q.stripe.com/ Frame 01C8 0
491 B 456ms
168ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 19 Dec 2023 08:07:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1702973238583351
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 0
x-stripe-client-envoy-start-time-us: 1702973238583045
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 01C8 87 KB
14 KB 11ms
11ms Script
text/javascript 2600:9000:224a:e600:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:224a:e600:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:06:50 GMT
content-encoding: br
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
age: 29
x-content-type-options: nosniff
etag: W/"69cb7809b5011312e716f29b3d19dce6"
x-amz-cf-pop: DUS51-P1
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
x-amz-cf-id: BvXBJHiUPOo5eJD4vy5fZ3sFPW8G3zHRZ3rdaDyiJo6SXZGyMTU4lA==

POST
H2 200 6 Show response
m.stripe.com/ Frame 01C8 156 B
669 B 546ms
173ms XHR
application/json 34.213.26.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.213.26.22 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-213-26-22.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

da389411aec49ed377940f867c8ffed5997f3506af8c7da51aad664d868e4162

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Tue, 19 Dec 2023 08:07:18 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1702973238718724
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1702973238717925
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
m.stripe.com/	1970-01-21 02:38:53	Name: m Value: 8ef92967-df8b-4d0a-98bf-7bc93231e7ee1f9bc2
.embee-research.ghost.io/	1970-01-21 01:48:29	Name: __stripe_mid Value: 703dc09e-7301-40cc-8260-fec749bdf94132faa6
.embee-research.ghost.io/	1970-01-20 17:02:55	Name: __stripe_sid Value: 71fe064f-92e7-41f2-a3e6-7fb8ba8a5a0bd33f4c

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
d11-vh04.na1.hubspotlinks.com
embee-research.ghost.io
js.stripe.com
m.stripe.com
m.stripe.network
plausible.io
q.stripe.com
151.101.64.176
2400:52e0:1e00::1080:1
2600:9000:224a:e600:19:7d10:bd80:93a1
2606:4700:4400::ac40:96d2
2606:4700::6810:5514
2a04:4e42:200::775
34.213.26.22
54.187.159.182
021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94
0b144beb896e0d7612e0eeab489e4e682adac07cbc139924ce892bde3ccd3605
12c7dfa3ed440aacad42055f50a0af1e724aa57f55736178dbb57fcd6f09162f
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
39e72c0794c12f2dbb14a0f61ca946b535f795b1478fcf795bd26e5cb52ded34
3e139e25647941de577615522bc34fbf4cb2a21a5019f4702e69806b5780a869
54682e379031e7d89b632f95f6ce239060db2a9d7fce9f92638dc4a8cbd1ae41
5bf5d70f9bfbf04d77659c506ade2cefaa2852a97861b4cf6cada8dc9f73d8ab
602a41ac72856f979309e41f203569d1140f2fb90576dc4c92202382e5d220c8
73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4
7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6
7fd5984766d6b5f68a02c5423c4a5d985df3fb91280340183e5e6a410e060f8f
8096c53b1754b65e9decf7620bb8a80110bea2a7b4a7c2ba78e57bf7b57fd554
905294f5d28180922d1b5cb1e5c46c01157ef38b6d69c17ceb3b46ca0ccab863
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
965a68e391935e57237ebbdcc4c3abef4bad9b78b899bbbbe1207af181d5ba3a
9bbb29383e6b6b083e0d43954969879f85ccb598ba9d3e5e8f401ea0f5a311c1
abdf7a06892a7c9e0e21118a30dfc1dda5a47401ce13ed3958ee02ff52eb0cfb
b1157f328346c87a9cf04c438391b1ef827427c6e27d965f3ce74e3dfba97745
ce406b5d3abda62e8c63326a5de8370dacb1ba7bf12035bf9a61f79b6dd37af6
d54b81417a5066b87358ba42f4f083c2e7198371e3d465f18f7bc1983f7fbcd7
da389411aec49ed377940f867c8ffed5997f3506af8c7da51aad664d868e4162
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3df1869daa63b392b43f8d5491e93b48b4056ff9421324be245e9d65c7e9c60
e8b93c637a0c1300e1da13db78122678f365466d59ca36889098feb0eb1222d7
ea154a658cf5ba6cf1540b657987e4fcfd00d45166247f5fef0b06145cec5319
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
f448dc782f109b2d90faa5dc429ea803d30ec7087c3de482131dfb7b5ee54518

embee-research.ghost.io Open in urlscan Pro 2a04:4e42:200::775 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

100 %HTTPS

63 %IPv6

6 Domains

8 Subdomains

8 IPs

2 Countries

6962 kBTransfer

10518 kBSize

3 Cookies

3 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

embee-research.ghost.io Open in urlscan Pro
2a04:4e42:200::775 Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

8
IPs

2
Countries

6962 kB
Transfer

10518 kB
Size

3
Cookies

34 HTTP transactions
0 data transactions