URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-l...
Submission: On May 12 via api from TR — Scanned from DE

Summary

This website contacted 58 IPs in 5 countries across 45 domains to perform 156 HTTP transactions. The main IP is 104.26.2.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 219176.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 9th 2023. Valid for: a year.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
26 29 104.26.2.18 13335 (CLOUDFLAR...)
7 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 37 2620:12a:8001::2 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 23.201.248.34 16625 (AKAMAI-AS)
7 104.17.74.206 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:303... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:780... 20940 (AKAMAI-ASN1)
1 2001:4860:480... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 4 2a00:1450:400... 15169 (GOOGLE)
1 18.66.97.49 16509 (AMAZON-02)
2 4 172.217.18.102 15169 (GOOGLE)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a04:4e42:200... 54113 (FASTLY)
1 151.101.192.65 54113 (FASTLY)
2 104.102.38.132 16625 (AKAMAI-AS)
1 52.222.236.5 16509 (AMAZON-02)
1 162.159.153.247 13335 (CLOUDFLAR...)
2 2600:9000:223... 16509 (AMAZON-02)
1 2600:9000:223... 16509 (AMAZON-02)
1 108.138.15.119 16509 (AMAZON-02)
1 146.75.116.157 54113 (FASTLY)
1 5 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
1 52.222.236.63 16509 (AMAZON-02)
1 54.83.27.146 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.5 13414 (TWITTER)
2 104.244.42.67 13414 (TWITTER)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 13.32.121.45 16509 (AMAZON-02)
8 95.101.111.170 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
6 9 34.255.134.71 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 18.158.205.16 16509 (AMAZON-02)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 2 3.75.62.37 16509 (AMAZON-02)
1 34.98.64.218 396982 (GOOGLE-CL...)
1 69.173.144.165 26667 (RUBICONPR...)
1 1 172.217.18.98 15169 (GOOGLE)
1 2 185.89.210.180 29990 (ASN-APPNEX)
1 151.101.65.140 54113 (FASTLY)
2 35.156.45.170 16509 (AMAZON-02)
1 172.217.18.2 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 151.101.2.137 54113 (FASTLY)
1 35.71.131.137 16509 (AMAZON-02)
1 162.247.241.14 23467 (NEWRELIC-...)
156 58
Apex Domain
Subdomains
Transfer
73 sentinelone.com
www.sentinelone.com — Cisco Umbrella Rank: 219176
de.sentinelone.com
go.sentinelone.com — Cisco Umbrella Rank: 607355
2 MB
10 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 41
10466992.fls.doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 91
cm.g.doubleclick.net — Cisco Umbrella Rank: 234
13115870.fls.doubleclick.net
7 KB
9 prfct.co
pixel-geo.prfct.co — Cisco Umbrella Rank: 16876
4 KB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6710
c.6sc.co — Cisco Umbrella Rank: 9995
ipv6.6sc.co — Cisco Umbrella Rank: 7086
b.6sc.co — Cisco Umbrella Rank: 4613
14 KB
7 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 449
23 KB
7 google.com
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 83
1 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 410
114 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 414
www.linkedin.com — Cisco Umbrella Rank: 645
px4.ads.linkedin.com — Cisco Umbrella Rank: 6490
5 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3585
onesignal.com — Cisco Umbrella Rank: 1283
img.onesignal.com — Cisco Umbrella Rank: 7527
87 KB
6 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62
429 KB
5 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2495
www.google-analytics.com — Cisco Umbrella Rank: 39
68 KB
4 google.ru
www.google.ru — Cisco Umbrella Rank: 9112
735 B
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 390
13 KB
4 gstatic.com
fonts.gstatic.com
79 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 111475
e.calibermind.com — Cisco Umbrella Rank: 139710
61 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 11607
587 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 440
2 KB
2 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 301
493 B
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 85
59 KB
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 690
836 B
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1034
745 B
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1533
insight.adsrvr.org — Cisco Umbrella Rank: 571
3 KB
2 abrankings.com
cdn.abrankings.com — Cisco Umbrella Rank: 76490
8 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 9025
q.quora.com — Cisco Umbrella Rank: 3858
15 KB
2 brightfunnel.com
munchkin.brightfunnel.com — Cisco Umbrella Rank: 58889
api.brightfunnel.com — Cisco Umbrella Rank: 63617
7 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3651
7 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 695
script.hotjar.com — Cisco Umbrella Rank: 957
72 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 266
528 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 179
2 KB
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1607
157 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 352
239 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 472
273 B
1 clearbit.com
ga.clearbit.com — Cisco Umbrella Rank: 67811
1 KB
1 mktoresp.com
327-mnm-087.mktoresp.com
318 B
1 google.de
www.google.de — Cisco Umbrella Rank: 5171
408 B
1 t.co
t.co — Cisco Umbrella Rank: 510
376 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 718
15 KB
1 clickcease.com
www.clickcease.com — Cisco Umbrella Rank: 10867
54 KB
1 marinsm.com
tag.marinsm.com — Cisco Umbrella Rank: 43660
4 KB
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1392
8 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 885
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 636
295 B
1 typography.com
cloud.typography.com — Cisco Umbrella Rank: 7019
442 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 50
1 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1019
48 KB
156 45
Domain Requested by
37 de.sentinelone.com 2 redirects www.sentinelone.com
de.sentinelone.com
29 www.sentinelone.com 26 redirects www.sentinelone.com
9 pixel-geo.prfct.co 6 redirects www.sentinelone.com
7 js-agent.newrelic.com www.sentinelone.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
7 cdn.cookielaw.org www.sentinelone.com
cdn.cookielaw.org
6 b.6sc.co www.sentinelone.com
6 www.googletagmanager.com www.sentinelone.com
www.googleoptimize.com
www.googletagmanager.com
5 www.google.com 1 redirects www.sentinelone.com
4 www.google.ru www.sentinelone.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.sentinelone.com
4 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.sentinelone.com
4 fonts.gstatic.com fonts.googleapis.com
3 onesignal.com cdn.onesignal.com
3 px.ads.linkedin.com 3 redirects
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 epsilon.6sense.com munchkin.brightfunnel.com
2 secure.adnxs.com 1 redirects www.sentinelone.com
2 ups.analytics.yahoo.com 1 redirects www.sentinelone.com
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 analytics.twitter.com www.sentinelone.com
2 adservice.google.com 10466992.fls.doubleclick.net
13115870.fls.doubleclick.net
2 px4.ads.linkedin.com www.sentinelone.com
2 cdn.linkedin.oribi.io snap.licdn.com
2 cdn.abrankings.com www.googletagmanager.com
munchkin.brightfunnel.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 10466992.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
2 cdn.calibermind.com www.sentinelone.com
1 bam.nr-data.net js-agent.newrelic.com
1 insight.adsrvr.org js.adsrvr.org
1 img.onesignal.com www.sentinelone.com
1 www.googleadservices.com www.googletagmanager.com
1 alb.reddit.com www.sentinelone.com
1 cm.g.doubleclick.net 1 redirects
1 pixel.rubiconproject.com www.sentinelone.com
1 us-u.openx.net www.sentinelone.com
1 ipv6.6sc.co munchkin.brightfunnel.com
1 c.6sc.co munchkin.brightfunnel.com
1 ga.clearbit.com www.googletagmanager.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 www.google.de www.sentinelone.com
1 j.6sc.co www.sentinelone.com
1 api.brightfunnel.com munchkin.brightfunnel.com
1 stats.g.doubleclick.net www.google-analytics.com
1 t.co www.sentinelone.com
1 q.quora.com www.sentinelone.com
1 script.hotjar.com static.hotjar.com
1 www.linkedin.com 1 redirects
1 static.ads-twitter.com www.sentinelone.com
1 js.adsrvr.org www.googletagmanager.com
1 www.clickcease.com www.sentinelone.com
1 a.quora.com www.sentinelone.com
1 munchkin.brightfunnel.com www.sentinelone.com
1 tag.marinsm.com www.sentinelone.com
1 www.redditstatic.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 e.calibermind.com cdn.calibermind.com
1 region1.google-analytics.com www.googletagmanager.com
1 snap.licdn.com www.sentinelone.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cloud.typography.com 1 redirects
1 fonts.googleapis.com www.sentinelone.com
1 www.googleoptimize.com www.sentinelone.com
156 65
Subject Issuer Validity Valid
sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-09 -
2024-04-08
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
go.sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-22 -
2024-04-21
a year crt.sh
calibermind.com
E1
2023-04-28 -
2023-07-27
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-03 -
2024-05-02
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
attivonetworks.com
R3
2023-04-10 -
2023-07-09
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01
2023-03-09 -
2024-04-06
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2023-02-16 -
2023-08-16
6 months crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-04-12 -
2023-10-08
6 months crt.sh
tag.marinsm.com
GlobalSign Atlas R3 DV TLS CA 2022 Q3
2022-09-27 -
2023-10-29
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
*.brightfunnel.com
Amazon RSA 2048 M02
2023-02-28 -
2024-02-12
a year crt.sh
quora.com
R3
2023-04-16 -
2023-07-15
3 months crt.sh
cdn.abrankings.com
Amazon RSA 2048 M02
2023-03-19 -
2024-04-16
a year crt.sh
clickcease.com
Amazon RSA 2048 M02
2022-10-27 -
2023-11-25
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
www.google.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
*.google.com.ru
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-02-24 -
2023-08-06
5 months crt.sh
*.quora.com
R3
2023-04-16 -
2023-07-15
3 months crt.sh
*.google.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-03-11 -
2023-06-09
3 months crt.sh
www.google.de
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
clearbit.com
Amazon RSA 2048 M02
2023-03-17 -
2024-04-14
a year crt.sh
*.prfct.co
GlobalSign RSA OV SSL CA 2018
2022-10-28 -
2023-11-29
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-11-18 -
2023-12-19
a year crt.sh

This page contains 5 frames:

Primary Page: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Frame ID: 9D229C1C28679C7C6A04BE2D443546F1
Requests: 153 HTTP requests in this frame

Frame: https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Frame ID: 780D53D5907DDDC69498B1BA72818B39
Requests: 2 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: 101191B0FA2AE24BC6E673D363C815C1
Requests: 2 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Frame ID: 739834B421C67F7CA94352DB3722F7BA
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&upid=jskiafk&upv=1.1.0
Frame ID: A03B49A8701AFA2E7AC1D5BE05A8A187
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers - SentinelOneBack ButtonSearch IconFilter Icon

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

156
Requests

76 %
HTTPS

47 %
IPv6

45
Domains

65
Subdomains

58
IPs

5
Countries

3349 kB
Transfer

7165 kB
Size

50
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1 HTTP 302
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1
Request Chain 3
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 HTTP 302
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Request Chain 5
  • https://cloud.typography.com/7197018/6979812/css/fonts.css HTTP 302
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css HTTP 302
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Request Chain 6
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Request Chain 7
  • https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d HTTP 302
  • https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
Request Chain 8
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Request Chain 10
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869
Request Chain 12
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Request Chain 13
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Request Chain 14
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Request Chain 15
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Request Chain 16
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Request Chain 17
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Request Chain 18
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
Request Chain 19
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg
Request Chain 21
  • https://www.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
Request Chain 22
  • https://www.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
Request Chain 23
  • https://www.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
Request Chain 25
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11 HTTP 302
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Request Chain 26
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
Request Chain 51
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg
Request Chain 52
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg
Request Chain 53
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg
Request Chain 54
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
Request Chain 55
  • https://www.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg
Request Chain 56
  • https://www.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
Request Chain 58
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Request Chain 59
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Request Chain 70
  • https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F HTTP 302
  • https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Request Chain 91
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1683857426452%26url%3Dhttps%253A%252F%252Fwww.sentinelone.com%252Flabs%252Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&liSync=true&e_ipv6=AQJJXWi2-wPsUQAAAYgNuUnox7gCxrLeO66Qmx0y3Ij0X88oBOrdXZfsAjOgH0bLUGZPA5nPmVY5IQ
Request Chain 111
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag HTTP 302
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Request Chain 126
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_QiBWRs6TMFc0Y9N5v
Request Chain 127
  • https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1&verify=true
Request Chain 128
  • https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_QiBWRs6TMFc0Y9N5v
Request Chain 129
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_QiBWRs6TMFc0Y9N5v
Request Chain 130
  • https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfUWlCV1JzNlRNRmMwWTlONXY HTTP 302
  • https://pixel-geo.prfct.co/cb?partnerId=goo
Request Chain 132
  • https://secure.adnxs.com/seg?t=2&add=4530935 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Request Chain 138
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Request Chain 139
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJR839-PWm-sAAAAYgNuUqxN3nWGuanxEWGtNbXcLfY1kxYQNLzDTsbCqh5WFDpHTe3dejaSmXMbw
Request Chain 145
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&auid=289674782.1683857426&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=E6BdZKfgCqiv9u8Po8uv8A4&sscte=1&crd=&eitems=ChEI8KTyogYQ_O7mhZKAxPf3ARIdAMsh3UzAbeqXBGwBGwDsQSALb5Sb-z19j21iMlg&pscrd=EkxDaEFJOEtUeW9nWVE4T1dteXV6aHZvQk5FaVVBYUc5X0xIb0JNbGsySlByVElFSFR0ZmxSMUVKYVZzcHNvWTFtNFNVUXlRcWdHRzVzGlhDaEVJOEtUeW9nWVFsOW45OXVucHRfUEtBUkl0QU5sWXZNSU5rYzF0U21MQWtJX0Y0T2E5M3hodGRldGZNekpoeGdBa3hZXzk0N3BSbTFRbWxlVzQ0aDVj HTTP 302
  • https://www.google.com/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&auid=289674782.1683857426&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOEtUeW9nWVE4T1dteXV6aHZvQk5FaVVBYUc5X0xIb0JNbGsySlByVElFSFR0ZmxSMUVKYVZzcHNvWTFtNFNVUXlRcWdHRzVzGlhDaEVJOEtUeW9nWVFsOW45OXVucHRfUEtBUkl0QU5sWXZNSU5rYzF0U21MQWtJX0Y0T2E5M3hodGRldGZNekpoeGdBa3hZXzk0N3BSbTFRbWxlVzQ0aDVj&is_vtc=1&ocp_id=E6BdZKfgCqiv9u8Po8uv8A4&cid=CAQSKQBygQiDkxypmR0r0hbh8DUnHzKV_qYHZtoh2ff4CX6UnQfKOGGxDdgU&eitems=ChEI8KTyogYQ_O7mhZKAxPf3ARIdAMsh3UzmX0dwjoc0yFBiDxirCuiMRYmpllMM-dg&random=990948647 HTTP 302
  • https://www.google.ru/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&auid=289674782.1683857426&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOEtUeW9nWVE4T1dteXV6aHZvQk5FaVVBYUc5X0xIb0JNbGsySlByVElFSFR0ZmxSMUVKYVZzcHNvWTFtNFNVUXlRcWdHRzVzGlhDaEVJOEtUeW9nWVFsOW45OXVucHRfUEtBUkl0QU5sWXZNSU5rYzF0U21MQWtJX0Y0T2E5M3hodGRldGZNekpoeGdBa3hZXzk0N3BSbTFRbWxlVzQ0aDVj&is_vtc=1&ocp_id=E6BdZKfgCqiv9u8Po8uv8A4&cid=CAQSKQBygQiDkxypmR0r0hbh8DUnHzKV_qYHZtoh2ff4CX6UnQfKOGGxDdgU&eitems=ChEI8KTyogYQ_O7mhZKAxPf3ARIdAMsh3UzmX0dwjoc0yFBiDxirCuiMRYmpllMM-dg&random=990948647&ipr=y

156 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
104 KB
33 KB
Document
General
Full URL
https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9052b690dbc0d96645f48cd2dcdea9bad85f6c55e125a9a4546f9876f9cf9f2d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
7c5f20062e632c2b-FRA
content-encoding
br
content-security-policy
frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
content-type
text/html; charset=UTF-8
date
Fri, 12 May 2023 02:10:24 GMT
expect-ct
enforce; max-age=2592000;
last-modified
Fri, 12 May 2023 00:06:22 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/labs/80513>; rel="alternate"; type="application/json", <https://www.sentinelone.com/?p=80513>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TmjfxhP3qEmhtzgfCgdQLIt3xKyCGhy6NCwtBJzT5imH0LqnW6ZyURE8%2Fxq1eA4ztXl9W9goClJf6c5QRtcT4%2BnxNSPk7668V1mp%2FSByiP9jhLcT%2BtcJfu4qx%2F9i1KSfQargGbA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish
x-cache
HIT, MISS
x-cache-hits
4, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-a-6dd667745b-vlm8k
x-served-by
cache-chi-kigq8000142-CHI, cache-fra-eddf8230020-FRA
x-styx-req-id
091394c6-f06a-11ed-984a-3674b53ca9e3
x-timer
S1683857424.392013,VS0,VE130
x-xss-protection
1; mode=block
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8d41783702d7bb7a7a9c548b151903859eb90a32d29eeaa3487a7937611a27f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
rpnZu/dYNZPLIh9pLOSMrg==
age
24187
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6757
x-ms-lease-status
unlocked
last-modified
Thu, 11 May 2023 06:31:16 GMT
server
cloudflare
etag
0x8DB51E952FECC52
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
60d8fbe2-701e-017f-1e3b-840081000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f20078a25bb7f-FRA
optimize.js
www.googleoptimize.com/
126 KB
48 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0ffe82ccea2d18f7bd89e59622b55af524162376e266312225f8d79290776cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:24 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
49023
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 12 May 2023 02:10:24 GMT
classic-themes.min.css
de.sentinelone.com/wp-includes/css/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1
217 B
406 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 23:48:12 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
92042
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-8pcpg
content-length
189
x-served-by
cache-chi-kigq8000179-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:38 GMT
server
nginx
x-timer
S1683857425.146922,VS0,VE6
etag
W/"645a9bda-d9"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
1fe50db8-ef8d-11ed-8b8d-1e8dad1b9e89
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T4Q%2FFvKDZGcd3Ub5EDd%2BOdLq%2Fqovk7CuvUJT0eAi9cz4WnGhrW%2BH0rHCmVVVeVqA1IjXkx8n7RLNRMM4D0ZbuCm2HNbThRRrO%2BXHYgrDcBRR0AaLVHGBlfG0nQd0TOfSaaZnYTQ%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=1
cf-ray
7c5f20076f252c2b-FRA
content-length
0
tp_twitter_plugin.css
de.sentinelone.com/wp-content/plugins/recent-tweets-widget/
Redirect Chain
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
529 B
693 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Thu, 09 May 2024 19:18:42 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
92042
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-xmqps
content-length
286
x-served-by
cache-chi-klot8100134-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:34 GMT
server
nginx
x-timer
S1683857425.146609,VS0,VE6
etag
W/"645a9bd6-211"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
4f8218c9-ee9e-11ed-8401-0e44f9be69b8
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
2, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FJSoSHtOKlKtkofTsuqvPmk4ZXY%2F5jQNTi7IZFL0f4rEq5nwjn7R%2Fk6N1%2BwEJKhjhQ7mK4M5QDXxODex8xa6XqDJDGtFjg0MNkKFSwyeUP97bl%2BjjS8J6TpMWr1dQZjgMk%2FOxE%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
cf-ray
7c5f20076f292c2b-FRA
content-length
0
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 12 May 2023 02:10:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 12 May 2023 02:10:24 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 12 May 2023 02:10:24 GMT
2EC96BA1F5C4837D6.css
de.sentinelone.com/fonts/804059/
Redirect Chain
  • https://cloud.typography.com/7197018/6979812/css/fonts.css
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
104 KB
80 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Thu, 09 May 2024 19:18:49 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
90058
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-mt9hq
content-length
81369
x-served-by
cache-chi-kigq8000044-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:33 GMT
server
nginx
x-timer
S1683857426.797975,VS0,VE4
etag
W/"645a9bd5-1a12c"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
53d1ea48-ee9e-11ed-bcb8-de534c1ecbd5
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vqGdwThvHyuNYsm5vyl3H0vQyyJMA80pj90URfuEgggDIcCKf1iFrwieXB5CTTYYzgSUti6CiYqFoMVKMDUDDBth4PpmmbcG2CWjX%2FNj7isP8Mkdymdt6T525x5sDlKph8LmJXU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
cf-ray
7c5f200e6b6a2c2b-FRA
content-length
0
style.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
768 KB
123 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
02ba9c5c3388971d5ae9592e9194e2ebfba1070be332bc8b10be7983e0d393ad
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sun, 12 May 2024 01:15:28 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
3297
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-s89rh
content-length
125177
x-served-by
cache-chi-klot8100050-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857425.146674,VS0,VE6
etag
W/"645a9bd7-bfe86"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
7b80a468-f062-11ed-892c-c65799017a09
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ncVNn0nxSNjn7vQtk%2BPkSXl4TYdXa%2F3stWt37TddSMfBf8vk1zfyMrHKkh2SiYjqEkYG07w0CiIxyIDdnBG4gjQmIVZQadSefBzqGwsKzu59NQKkCiz1CkzdewFwnDzb6gO5Zl0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
cf-ray
7c5f20076f2b2c2b-FRA
content-length
0
wpp.min.js
de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
  • https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
3 KB
2 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9a3d1f5824ad4bd991a67acab64088920e43d25545ca6b4cb78736dc35b696a3
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 23:48:12 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
92042
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-qjlrk
content-length
1423
x-served-by
cache-chi-klot8100021-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:34 GMT
server
nginx
x-timer
S1683857425.146445,VS0,VE6
etag
W/"645a9bd6-bd7"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
1fe41ce8-ef8d-11ed-8167-26a3f0e135c7
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xRQexouhmAQ3gj7kk5mDpAGr4yhq0bZZihVBp2qzqb5WtUw%2B%2F%2BCh9kh4Ls%2BXrWv3RtC0WUcTch1aJy%2B5sEvaBYho8dM10XG2wy3fq4BHw2Mk%2BKMMqjqHWdvCjuRAK59XDagwk%2BM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
cf-ray
7c5f20076f2c2c2b-FRA
content-length
0
jquery-3.5.1.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
87 KB
35 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 18:51:39 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
92042
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-m46hj
content-length
36067
x-served-by
cache-chi-kigq8000169-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857425.146482,VS0,VE27
etag
W/"645a9bd7-15d84"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
b2681609-ef63-11ed-bf42-a2f507776d19
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
2, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3BBoFXsI0OzJiLwnTNyQbUyIawedMbnrDYk3ryI8T6RliRMNfy%2FRNCsLbRE1%2BIsa4o5ARK%2BfaEqix0puSDOBo6ljK04%2FyRnL75%2B8JZrj9jmFhKXAXg5mtzWyciCDTrKs1WoJxZM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
cf-ray
7c5f20076f2d2c2b-FRA
content-length
0
forms2.min.js
go.sentinelone.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 23 Mar 2023 21:46:36 GMT
server
cloudflare
age
5481
etag
"c607a9-33e51-5f79835f6a700"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7c5f2007ed1abb73-FRA
expires
Fri, 12 May 2023 06:10:24 GMT
header.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869
164 KB
52 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0f7a03e0e5ddc810f43fe825134e8f02b2dbe1cbefe1eef2aa4cbcead04df3a1
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sun, 12 May 2024 01:15:29 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:25 GMT
age
3295
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-8277f
content-length
52550
x-served-by
cache-chi-klot8100043-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857425.146936,VS0,VE20
etag
W/"645a9bd7-28eb6"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
7c08acb5-f062-11ed-bb52-161b94f0ec98
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2BFMctVkMIFaDe6eB6gyc3vJJPilnXjBK666HszVeNMyM0c1jkq6Xvou3S3bVf%2BLPsbIenhr2AftP%2Bhn3vC8BIidmTlJlYdUFbUPd%2FDnFn7kIV8CHFA4ZU%2BID00W7rAAIDORL6U%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1683853869
cf-ray
7c5f20076f2e2c2b-FRA
content-length
0
js
www.googletagmanager.com/gtag/
223 KB
78 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bec893b6d75290029eeab0c973721e66bce1e30ed40d68543f83bd03e0cbe086
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
80095
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 12 May 2023 02:10:26 GMT
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
681 B
512 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:08:49 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92520
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-xn6st
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.197802,VS0,VE1
etag
W/"645a9bd8-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
0109c8a2-ef90-11ed-8863-568e1e012c3b
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 2

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CQrXQCgGhNlAjR0t0uzYjoucmOFumbRLw%2BmhcyQFwRcEvRGXBQ%2FfiqqtgmlOpRXtNVMNxV0dRwnIrD%2BM1i87j%2F7w9BGVwZdUHiC%2FqcdZDTEfJ0%2FEbo0TqUPHF%2F2XrTeDoLHQCz8%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
cf-ray
7c5f20109cba2c2b-FRA
content-length
0
search-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
681 B
631 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 06:05:03 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92518
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-mt9hq
content-length
385
x-served-by
cache-chi-klot8100085-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.257352,VS0,VE1
etag
W/"645a9bd8-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
9ab6e876-eef8-11ed-bcb8-de534c1ecbd5
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
4, 1

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Eeu7GuKDrKTWOIYaEb5mnLSwViNMApyTH7pBIL%2BaFOVu7XZehCBMkd%2FpOq3%2FakCvaoGt148zQw4%2FdZhtBipauDtpmRWncWy6qU5aoYUv2ixJ126pvCES%2BOph5VeKlgnSRVyUrvE%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
cf-ray
7c5f20109cbc2c2b-FRA
content-length
0
navigation-close.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
667 B
553 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:28:29 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92517
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-8pcpg
content-length
339
x-served-by
cache-chi-klot8100133-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.197882,VS0,VE2
etag
W/"645a9bd8-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
c069cc6d-ef92-11ed-8b8d-1e8dad1b9e89
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F6f9wrRDzdzExEz4%2FdBcv06JIcQGrF9VASAegHMAq65oXzBdoXqvPQ4PK7Vxr5wNCdlzFI%2F0UvCS39o9sGOAe%2Bkjpxf8z%2FR8O88fnEXv7TWiHaun9f42Eubl%2B77RpKJNXYVh2%2Bc%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
cf-ray
7c5f2010acbd2c2b-FRA
content-length
0
navigation-close-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
667 B
618 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Thu, 09 May 2024 19:16:47 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92518
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-m46hj
content-length
339
x-served-by
cache-chi-kigq8000142-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.259970,VS0,VE1
etag
W/"645a9bd7-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
0b36de2b-ee9e-11ed-bf42-a2f507776d19
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOuaR7bnm0kZEwGMZZ0h1JanQecxw%2BZplmcLgfPtEgV%2FUwPj%2Bo7F1ix%2BAZofRmtZYObGN8mllhO2y2jQxXVsMKkhASwTf%2FXs6wB8B6bweMTg5C7j6%2FNosiOesa60PXuoySaubeI%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
cf-ray
7c5f2010acbe2c2b-FRA
content-length
0
SentinelLabs_Logo_RGB_WhitePurp.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
5 KB
6 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
72fc1a57801612f9e297e1c1954410ff840c40e713a6b4b40b2596e80338c2ee
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-pb9d7
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 09 May 2024 19:54:23 GMT
age
91580
x-cache
HIT, MISS
content-length
5631
x-served-by
cache-chi-klot8100088-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.196112,VS0,VE136
etag
"645a9bd7-15ff"
content-type
image/png
x-styx-req-id
4b9d2a7b-eea3-11ed-a787-2ecf4741fe96
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0e504V7jmmOZ3hlKP1R14npePvpROBpEhUla%2BmYmbGeD4j0idGtMJfaxFGPctMfP3qWgU37OOcGdM2FitKO5wsYDugRX1Rzpl1IvuPwuoY2Vxqz9Ybj%2B9ZA%2FUJWeID2L6grrQKM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
cf-ray
7c5f2010acbf2c2b-FRA
content-length
0
navigation-arrow-left.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
566 B
581 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Thu, 09 May 2024 19:16:47 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92516
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-c9jn5
content-length
326
x-served-by
cache-chi-kigq8000162-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.256762,VS0,VE10
etag
W/"645a9bd8-236"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
0b44a9cd-ee9e-11ed-b0d4-e6de7805a278
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qRxGXl9Jolwecefu8fRwuSqH1ITEoZRi3ZJzXQPu6yxJ1HGyXThYmY3%2Fz0yMq%2FdnxDO8vq9wv%2BZ4dcKtU7UVIW%2BS3pSA4EbYjqsfScC6iLznXiUaWrVbkzKNEUcwZNUKt0Qfwu4%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
cf-ray
7c5f2010acc12c2b-FRA
content-length
0
Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
56 KB
56 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cdf1e2dda0541ef6e400a432122ca5f69e0458f61838d9b62a2fd9f50112b36d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-s89rh
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 11 May 2024 10:25:37 GMT
age
56689
x-cache
HIT, MISS
content-length
57125
x-served-by
cache-chi-kigq8000025-CHI, cache-gig2250035-GIG
last-modified
Thu, 11 May 2023 09:36:22 GMT
server
nginx
x-timer
S1683857426.256926,VS0,VE134
etag
"645cb716-df25"
content-type
image/jpeg
x-styx-req-id
2be337ac-efe6-11ed-892c-c65799017a09
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zRl9XOl9UlWCjAyEJBj3b1bIS9lNx7yiYCH1cxzFxvRtYyfQKVOLfxNtqgZ%2BxsAKFX5ApBwGbrN2YcJQ%2BVAYaWIkfxxPHMlS4uUvnauJqAmzeTuINkMWlMbCLlVgRCdNhSEraTE%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers.jpg
cf-ray
7c5f2010acc32c2b-FRA
content-length
0
Babyk_4.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg
192 KB
193 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
bdea8449136cfa147076a60368e97f6f6a1ede917abb3350a778bc15c8180431
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-pjr2l
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 11 May 2024 10:14:50 GMT
age
57336
x-cache
HIT, MISS
content-length
197023
x-served-by
cache-chi-klot8100115-CHI, cache-gig2250035-GIG
last-modified
Wed, 10 May 2023 21:15:27 GMT
server
nginx
x-timer
S1683857426.259437,VS0,VE153
etag
"645c096f-3019f"
content-type
image/jpeg
x-styx-req-id
a9ebad09-efe4-11ed-a0d0-d2cfa11e2ba7
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AxQtVPcy4o9SYG2S8gZzLiU4h1kiN8Ht2X2GjvtERpuTkIb8gCS2LnZIEhDYAwjuMOemmnRMVjwklnJr9bOPptAQtVrIBUi9t%2FbmykcSfpOPKMz%2BhBLS80pogQ4O5LrDFyd%2B0Oo%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_4.jpg
cf-ray
7c5f2010acc52c2b-FRA
content-length
0
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Fri, 28 Apr 2023 14:11:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
gzip
etag
W/"644bd41c-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GfgdnJL8o4pjtZ8eYWhdJy0ElSHO3quFEC8Z5d27D8YcPsyAOqK2Yb86DneTFSxPpuzc%2FtHVS6Uzh9Rveo%2BY8aazr2O6ZA8YfxAX5MNnxChQ4xtqPOUU%2BB6%2FuQ2M%2FKUwl3Kb3vk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7c5f200f7c152c2b-FRA
expires
Sun, 14 May 2023 02:10:25 GMT
IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/03/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
11 KB
11 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
223befa75fc6c8b0b881d2f0e71e15e4aa1822b7de1ab3548874ddd8e929417f
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-8pcpg
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 02 May 2024 06:33:04 GMT
age
69161
x-cache
HIT, MISS
content-length
11001
x-served-by
cache-chi-klot8100040-CHI, cache-gig2250035-GIG
last-modified
Wed, 08 Mar 2023 20:53:08 GMT
server
nginx
x-timer
S1683857426.258561,VS0,VE156
etag
"6408f5b4-2af9"
content-type
image/jpeg
x-styx-req-id
3184bcf1-e8b3-11ed-8b8d-1e8dad1b9e89
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vQC5ejEP3DW7MkO5xApapdmjNBbozF7m%2FVvvjGR6K5d4hxdNwY4FXz1%2FlYpBJmZqlLr4tsMNxQODgg7BoVG5V8XdpMDYJCX0zSLdOcJ29v2fB3H%2FEI5Lge9QrBaAlXFVeSR67TI%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
cf-ray
7c5f2010acc62c2b-FRA
content-length
0
Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/02/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
11 KB
11 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7d94e2c346f15418051786ffb1ace2c2027613a2b353615f04d26351d43c7474
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-tlpdf
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 25 Apr 2024 20:17:36 GMT
age
69161
x-cache
HIT, MISS
content-length
11353
x-served-by
cache-chi-klot8100062-CHI, cache-gig2250035-GIG
last-modified
Mon, 06 Feb 2023 22:12:18 GMT
server
nginx
x-timer
S1683857426.260479,VS0,VE136
etag
"63e17b42-2c59"
content-type
image/jpeg
x-styx-req-id
37eb6dcc-e3a6-11ed-a271-86be3e5e9eda
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rJgjQ7ri5xGanJ1lKO6%2F1sCZ7Sjwoph15EI5BP96BXMzhHSYdXZ6VGkanAt%2F1lNwEoCa3%2FZWEXWdcAMpSw80sWlfCDdcG%2BCYUGmteTyEbCHIKEacipdm0vxqNBcWy%2F9VVUQD78E%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
cf-ray
7c5f2010acc72c2b-FRA
content-length
0
MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/02/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
10 KB
11 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ad65bef6f6b191511df5df1bbe040015b0f1bcfc8c1ef81a3af9d34637607145
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-a-7bf88c48c5-ckscr
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sun, 21 Apr 2024 05:00:52 GMT
age
69161
x-cache
HIT, MISS
content-length
10728
x-served-by
cache-chi-kigq8000025-CHI, cache-gig2250035-GIG
last-modified
Thu, 02 Feb 2023 09:16:57 GMT
server
nginx
x-timer
S1683857426.257757,VS0,VE136
etag
"63db7f89-29e8"
content-type
image/jpeg
x-styx-req-id
7d95a494-e001-11ed-bec8-9ea950589145
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mXhkRwHbntGfjfnGeqgJV%2BLFdywPqOF6P52Q2PBiHLxy7QJcjewi6uQmA0vSljH2Uu1nUIYkYQWQ2hAJFZQnDMl0AwkOt8%2FG2pedencDuTuPdtIHQBTJhmS4ep4otXzkE%2BxLdis%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/02/MalVirt-.NET-Virtualization-Thrives-in-New-Malvertising-Attacks-3-300x157.jpg
cf-ray
7c5f2010accc2c2b-FRA
content-length
0
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
1 KB
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:25 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
9933
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 19 Apr 2023 19:54:27 GMT
server
cloudflare
etag
W/"644046f3-346"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vp5V48msT9NyVwbnfDnP0t8A5C0TcrUXsAkyUOdCP4kQr0YDkXTWEDpk9z%2BOmZQTqO8wVp9xUY2WaSyECQ7Fbd%2F98Y6rhbSyZei5rUuFhPimuj94pc%2B0BAoPjca%2BaToWtsNFenvglhpNzNFuYBpk4A4W"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7c5f200fbc7c9bbc-FRA
clipboard.min.js
de.sentinelone.com/wp-includes/js/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
9 KB
4 KB
Script
General
Full URL
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 18:55:38 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
91948
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-xmqps
content-length
3466
x-served-by
cache-chi-kigq8000041-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:38 GMT
server
nginx
x-timer
S1683857426.034190,VS0,VE2
etag
W/"645a9bda-2331"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
41249b2c-ef64-11ed-8401-0e44f9be69b8
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ibsXdvqD1zet%2B1MoWyRuHz2urRSWZ7kzikzwQ7Si2E5YJ%2FPSUNQ8MFBbNcAwevDnuwd81HKzgvcOwOcvwkfuTAlBVsd49Xp9oh%2FxUZCYmCWeyxmZgyTNZoRsNha2eYTlhwU6hH4%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
cf-ray
7c5f200fdc4e2c2b-FRA
content-length
0
footer.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
127 KB
49 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5a48ec4dabb851ec6b94a81ab7a3b8f723de509d9485a545d3fae5f9ad289b93
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sun, 12 May 2024 01:15:30 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
3296
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-jllzd
content-length
50046
x-served-by
cache-chi-kigq8000047-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.346568,VS0,VE2
etag
W/"645a9bd7-1fb76"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
7c64824d-f062-11ed-8305-de970918b782
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ufXmslFVTsahXY6vKH%2Fj7SP8YbXJ1TqPajzm5Rfh9LoR%2BHOGhFi8rNdeVjeMlvnNj8XbKARW64unfqMT8tSkc15Ah0e0NfuAc5LIJEKruXDQJg6MhVqOBs%2BKPmgV5rxM6YdMuII%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
cf-ray
7c5f20105c9d2c2b-FRA
content-length
0
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=310158bdd1af84d475fdfad436b9d61d
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
194addf8fd862999286b33cf83116babe8c700ba3a28111777f49ca72c429970
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
2927
etag
W/"06f50014011c1fcd9e21b6b0481979de"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7c5f2010ca8e9969-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 15 May 2023 02:10:26 GMT
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
CqPSDQgRayZT5/dw1EENjQ==
age
48469
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1450
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:19 GMT
server
cloudflare
etag
0x8D97490BA2F1567
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2e907f89-801e-00a2-5be1-5a157a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f2007cefb9193-FRA
expires
Sat, 13 May 2023 02:10:24 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b9e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7c5f200818fe1c0f-FRA
access-control-allow-headers
Content-Type
a.js
cdn.calibermind.com/
213 KB
59 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
1672
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 19 Apr 2023 19:51:52 GMT
server
cloudflare
etag
W/"64404658-354c2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nhfPaRhJFCHVLeAqEzXYqLc7K56fG6qMIAfzhiLsLl3CZOpsaLJRqjruu%2FlY31p%2FeJ7x2kKwcs6Y1LtnEX9r7mC4n2MvmxaS0gNGExHhK0AfK02ssQDmZjx4c99rVmYCtg1x52uXo6%2BZpID1XOBRYnEX"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7c5f2010acfe9bbc-FRA
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.23.0/
312 KB
75 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
joMckLq8BtEunD8NH/4XVA==
age
79079
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
76366
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:58 GMT
server
cloudflare
etag
0x8D96DBF6CBEE741
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
90828af6-301e-00d6-58e1-5a933c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f2010af06bb7f-FRA
popular-posts
www.sentinelone.com/wp-json/wordpress-popular-posts/v1/
4 KB
4 KB
XHR
General
Full URL
https://www.sentinelone.com/wp-json/wordpress-popular-posts/v1/popular-posts
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=310158bdd1af84d475fdfad436b9d61d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76607d31a357b52055ffcb484c88d8872a6b9b208fbf15a1c8daf5b10f8d6915
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
referrer-policy
same-origin
server
cloudflare
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
7c5f20106c9e2c2b-FRA
expires
Thu, 01 Jan 1970 00:00:01 GMT
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sat, 06 May 2023 02:22:02 GMT
x-content-type-options
nosniff
age
517704
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19156
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 05 May 2024 02:22:02 GMT
js
www.googletagmanager.com/gtag/
223 KB
79 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP&l=dataLayer&cx=c
Requested by
Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2e207c92ddbac44f8ffb91f962bd646859d3a64334c95d6888f01f4d37bf6935
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
80107
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 12 May 2023 02:10:26 GMT
gtm.js
www.googletagmanager.com/
417 KB
110 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
98379332df0663f1223930bc4ea5374375509e554817b0d02ec27513af578425
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
112088
x-xss-protection
0
last-modified
Fri, 12 May 2023 00:02:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 12 May 2023 02:10:26 GMT
labs-bg-light.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
75 KB
76 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/labs-bg-light.png
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9bcdb94ad74931ea092ec31ed6aa7b1d7addd5cf819e8d374cd57883db25204a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-xn6st
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 09 May 2024 19:54:23 GMT
age
91579
x-cache
HIT, MISS
content-length
77240
x-served-by
cache-chi-kigq8000105-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.124531,VS0,VE137
etag
"645a9bd7-12db8"
content-type
image/png
x-styx-req-id
4b9d8a2b-eea3-11ed-8863-568e1e012c3b
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&callback=jQuery11240017934019154608682_1683857425993&_=1683857425994
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8597354b9e1b46852145de2bddf0737ecf7218937a4289f009c5006dc378cf75

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7c5f2010abbbbb73-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&callback=jQuery11240017934019154608682_1683857425995&_=1683857425996
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdf5307b9f947c4adf8f297b2d3a0a09b61824c693559519da53462a7cc868b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7c5f2010abbcbb73-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
user-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
1 KB
1003 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/user-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:44:07 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
91579
x-cache
HIT, MISS
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-c9jn5
content-length
775
x-served-by
cache-chi-kigq8000178-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.141734,VS0,VE140
etag
W/"645a9bd7-556"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
ef9c6941-ef94-11ed-b0d4-e6de7805a278
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0
calendar-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:44:07 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
91579
x-cache
HIT, MISS
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-m46hj
content-length
847
x-served-by
cache-chi-klot8100128-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.141960,VS0,VE134
etag
W/"645a9bd8-7ae"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
ef9cf9d9-ef94-11ed-bf42-a2f507776d19
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0
arrow-left-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
835 B
681 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-left-dark.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Fri, 10 May 2024 20:17:01 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
91579
x-cache
HIT, MISS
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-qjlrk
content-length
489
x-served-by
cache-chi-klot8100114-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.143360,VS0,VE134
etag
W/"645a9bd8-343"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
9f6b24cf-ef6f-11ed-8167-26a3f0e135c7
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
616 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:08:49 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92520
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-xn6st
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857426.142668,VS0,VE1
etag
W/"645a9bd8-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
0109c8a2-ef90-11ed-8863-568e1e012c3b
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1
calendar-icon-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:44:07 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
91579
x-cache
HIT, MISS
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-c9jn5
content-length
842
x-served-by
cache-chi-klot8100021-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857426.143234,VS0,VE133
etag
W/"645a9bd7-798"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
ef9e2196-ef94-11ed-b0d4-e6de7805a278
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 05 May 2023 18:19:00 GMT
x-content-type-options
nosniff
age
546686
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19440
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:08:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 04 May 2024 18:19:00 GMT
zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sat, 06 May 2023 00:56:55 GMT
x-content-type-options
nosniff
age
522811
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20880
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:19:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 05 May 2024 00:56:55 GMT
Socicon.woff2
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/
63 KB
63 KB
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/Socicon.woff2?87visu
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:37:58 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-xmqps
age
91947
x-cache
HIT, HIT
content-length
64512
x-served-by
cache-chi-klot8100177-CHI, cache-gig2250058-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857427.612740,VS0,VE4
etag
"645a9bd7-fc00"
content-type
font/woff2
access-control-allow-origin
*
x-styx-req-id
14138fad-ef94-11ed-8401-0e44f9be69b8
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
4, 1
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
Babyk_5.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg
402 KB
403 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0740e0c9ce16c14ec5359705e5f33dcf14d624fe7412025166bbb18559274ddb
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-s89rh
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 11 May 2024 10:14:50 GMT
age
57336
x-cache
HIT, MISS
content-length
411905
x-served-by
cache-chi-kigq8000143-CHI, cache-gig2250035-GIG
last-modified
Wed, 10 May 2023 21:15:22 GMT
server
nginx
x-timer
S1683857426.257637,VS0,VE157
etag
"645c096a-64901"
content-type
image/jpeg
x-styx-req-id
a9ece70b-efe4-11ed-892c-c65799017a09
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RzhJNDZACAroqsNMvk%2BXg3%2BRrTeA%2FuBUmw%2Bsd9%2BnsHhj7ZSebQcLL4PNLvJ%2BlaAAHgAyTZ3HmuLsRuZFstoFtgXhPxczag8ob%2BtC2Ae2pFu7zEAZXUBLgyMwCOEL53dqrIPQPcs%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_5.jpg
cf-ray
7c5f2010fcfb2c2b-FRA
content-length
0
Babyk_8.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg
314 KB
314 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0add20162e5eb55d8a9dcf20d777ed581d0deb401eb52af249d730c57d8120fb
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-jllzd
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 11 May 2024 10:14:50 GMT
age
57336
x-cache
HIT, MISS
content-length
321348
x-served-by
cache-chi-kigq8000077-CHI, cache-gig2250035-GIG
last-modified
Wed, 10 May 2023 21:15:09 GMT
server
nginx
x-timer
S1683857426.258859,VS0,VE152
etag
"645c095d-4e744"
content-type
image/jpeg
x-styx-req-id
a9ed6422-efe4-11ed-8305-de970918b782
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PF7ClsCtXYCW60ZSFUifRoyvQLFvEtG1LTQaOjpd2%2Fld7ZCJLb5CJwDkuSx9UzXZze3dAMWSSMpQWeosJa2lU99QGQiiiO%2FTMzIm5QippDUuIz3ZwXflDKMJsF0QlrxfUzuFpQE%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_8.jpg
cf-ray
7c5f2010fcfc2c2b-FRA
content-length
0
Babyk_3.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg
399 KB
400 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b26b7b088a5b8b7965e25cca1aed06839156d86321803fa7ecaaf43111e090b6
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-a-6dd667745b-vlm8k
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 11 May 2024 10:14:50 GMT
age
57336
x-cache
HIT, MISS
content-length
409077
x-served-by
cache-chi-klot8100163-CHI, cache-gig2250035-GIG
last-modified
Wed, 10 May 2023 21:15:32 GMT
server
nginx
x-timer
S1683857426.257612,VS0,VE152
etag
"645c0974-63df5"
content-type
image/jpeg
x-styx-req-id
a9ed21c2-efe4-11ed-9533-3674b53ca9e3
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8nN7dGClbAVeH1Ykcu4MZ2N%2B0nJmRAcuHNUMTIgU6hPTZMMwiNWWTdTdXmrMHw2AxMtn3Fogv6HEwZ%2B72%2FQevL1nsmz60vuPDjFBnOe9REmKcGuFPTAWwqpVaUf6BTyTGJ2kbz8%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Babyk_3.jpg
cf-ray
7c5f2010fcfd2c2b-FRA
content-length
0
Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
7 KB
7 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c1bbc7f21571ec0ff24b408dcfb5c9a930e97ea58b5915225b9cc9d55f74fc6a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-c9jn5
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 09 May 2024 06:49:07 GMT
age
91580
x-cache
HIT, MISS
content-length
7020
x-served-by
cache-chi-kigq8000042-CHI, cache-gig2250035-GIG
last-modified
Thu, 04 May 2023 11:57:43 GMT
server
nginx
x-timer
S1683857426.256550,VS0,VE136
etag
"64539db7-1b6c"
content-type
image/jpeg
x-styx-req-id
986893dd-ee35-11ed-b0d4-e6de7805a278
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5KDJNg47rOJLRoNPBC5XrZsGR7wogzUKrbbKw9zCyuU%2BO1YGSc4OhvaMqR17ctRniROuglYNw2ZNTlxs8nOi9NI4uC0gOFHkuv7tGkUPO3q%2BaVZo0waJfJa27NZqLJs8UQnSLwo%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Kimsuky-Evolves-Reconnaissance-Capabilities-in-New-Global-Campaign-9-150x150.jpg
cf-ray
7c5f2010fcff2c2b-FRA
content-length
0
Transparent-Tribe-6-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/04/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg
10 KB
10 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9e0467a581ca75291a318f230502cb619e0f557f9e1117b2dd4658790473c8b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5787c6dd7c-5v8hx
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 25 Apr 2024 16:07:55 GMT
age
77444
x-cache
HIT, MISS
content-length
9852
x-served-by
cache-chi-klot8100021-CHI, cache-gig2250035-GIG
last-modified
Tue, 11 Apr 2023 12:56:23 GMT
server
nginx
x-timer
S1683857426.258515,VS0,VE136
etag
"643558f7-267c"
content-type
image/jpeg
x-styx-req-id
57108d89-e383-11ed-95a2-12b48b63ceae
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNFUYuZvHuXRwRjeq7t7ZVG7wWBwy1yHdYW%2B%2FZ8lOh%2FdvOdXsuYPPdk9I3LXj7ZGNZG6mE16Mm9XdAIU2F6dFnNw4kf6IFqCt0gjfQPl770lXiCQytg5aZtOlvtDDY%2BfV8biAJs%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/04/Transparent-Tribe-6-150x150.jpg
cf-ray
7c5f2010fd002c2b-FRA
content-length
0
Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/03/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
8 KB
8 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
774da926daffb16b9aaec10f3325c7dfb78e138a918a99597aaf367c4f97a989
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe2-a-765c7d8db7-5fbsh
strict-transport-security
max-age=31622400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
expires
Thu, 09 May 2024 14:14:56 GMT
age
77444
x-cache
HIT, MISS
content-length
8016
x-served-by
cache-chi-klot8100026-CHI, cache-gig2250035-GIG
last-modified
Wed, 29 Mar 2023 08:19:07 GMT
server
nginx
x-timer
S1683857426.257918,VS0,VE140
etag
"6423f47b-1f50"
content-type
image/jpeg
x-styx-req-id
dfbdf680-ee73-11ed-8338-e6a082baf9ea
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 0

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oZaUp6YzGak0Y6DzwxvbhbRtEMC68DMsh9uO3xdq3QH9dsAvAWCukspJ%2FJkWNyB6Cir1UIOoCVw%2BRPqDDG%2FCtbY09FDbZfW%2B0%2BbE3mHSIk%2Fd37LVOs2RUmfNq9z1ffdO9ZL%2FnV4%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/03/Dissecting-AlienFox-The-Cloud-Spammers-Swiss-Army-Knife-13-150x150.jpg
cf-ray
7c5f2010fd012c2b-FRA
content-length
0
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:ca7a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=54492
accept-ranges
bytes
content-length
4777
social-twitter-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:08:55 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:26 GMT
age
92518
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-pb9d7
content-length
1036
x-served-by
cache-chi-kigq8000162-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:35 GMT
server
nginx
x-timer
S1683857427.982514,VS0,VE2
etag
W/"645a9bd7-7e1"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
04bb50fd-ef90-11ed-a787-2ecf4741fe96
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
2, 1

Redirect headers

x-cache-hits
0, 0
content-security-policy
frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
age
0
x-redirect-by
WordPress
x-cache
MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-8277f
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100133-CHI, cache-gig2250035-GIG
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1683857426.256576,VS0,VE332
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
x-styx-req-id
28fed5f8-f06a-11ed-bb52-161b94f0ec98
cache-control
max-age=3600
accept-ranges
bytes
expires
Fri, 12 May 2023 03:10:26 GMT
social-linkedin-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
Protocol
H2
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1683853869
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires
Sat, 11 May 2024 00:08:56 GMT
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
age
92517
x-cache
HIT, HIT
x-pantheon-styx-hostname
styx-fe2-b-d6b974d69-pb9d7
content-length
993
x-served-by
cache-chi-klot8100042-CHI, cache-gig2250035-GIG
last-modified
Tue, 09 May 2023 19:15:36 GMT
server
nginx
x-timer
S1683857427.041174,VS0,VE2
etag
W/"645a9bd8-90f"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
056bc97f-ef90-11ed-a787-2ecf4741fe96
cache-control
max-age=31622400
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

x-cache-hits
0, 0
content-security-policy
frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 varnish, 1.1 varnish
age
0
x-redirect-by
WordPress
x-cache
MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-6b7f6ff844-gmm2c
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100131-CHI, cache-gig2250035-GIG
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1683857426.256560,VS0,VE459
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
x-styx-req-id
28fe0564-f06a-11ed-9270-4e237e272df7
cache-control
max-age=3600
accept-ranges
bytes
expires
Fri, 12 May 2023 03:10:26 GMT
zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Sat, 06 May 2023 06:10:03 GMT
x-content-type-options
nosniff
age
504023
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20352
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 05 May 2024 06:10:03 GMT
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/
54 KB
11 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
g3u/cB4L4tfTQx7Hp+ONEQ==
age
77586
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11065
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:24 GMT
server
cloudflare
etag
0x8D97490BD2F4CA7
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4b382f98-d01e-0076-2ee1-5a5c5a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f20116dad9193-FRA
expires
Sat, 13 May 2023 02:10:26 GMT
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 23 Mar 2023 21:46:36 GMT
server
cloudflare
age
5482
etag
"c607a0-3437-5f79835f6a700"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7c5f2011fcbbbb73-FRA
content-length
2623
expires
Fri, 12 May 2023 06:10:26 GMT
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
331 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 23 Mar 2023 21:46:36 GMT
server
cloudflare
age
5482
etag
"c607a2-33c-5f79835f6a700"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7c5f2011fcbdbb73-FRA
content-length
246
expires
Fri, 12 May 2023 06:10:26 GMT
collect
region1.google-analytics.com/g/
0
257 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je35a0&_p=1121039866&cid=1754986622.1683857426&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1683857426&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&dt=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
p
e.calibermind.com/v1/
16 B
648 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-max-age
900
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m3OqDpZZFuUpFUz%2BIoK3czT51KqdSBpUj7CFZTyidSYn7McIOdwqObu53b8IVKqwnW1PGRm89Cowezv7scfRavD2H7zQLDSbLzFuZlywdyeZ%2Bs3Rrp7hF2Quxav0UZCFEmF9AP%2BEnc5vmW3Cad%2FV5g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
7c5f20126bc59969-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-headers
Content-Type,Authorization
content-length
16
x-request-id
131efff1-66ad-48da-9301-72d8d2fb5e42
optimize.js
www.google-analytics.com/gtm/
121 KB
47 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-K9ZDGR4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e028422c645a6cd5d1130e2740c4cd5e434881e00a29c2ccec6337baddf402d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
47734
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 12 May 2023 02:10:26 GMT
analytics.js
www.google-analytics.com/
51 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 12 May 2023 00:35:39 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
5687
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Fri, 12 May 2023 02:35:39 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1683857426289&cv=11&fst=1683857426289&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&auid=289674782.1683857426&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
da81da6ef07b4b9f77aead41e219318e9e23007844d896bcfb9d59439615e92a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1330
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
hotjar-2714452.js
static.hotjar.com/c/
9 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-49.fra56.r.cloudfront.net
Software
/
Resource Hash
f68c8fee11a5a8f56eafe7012b4ecace7fdc7c0dafc9b629ff27a897d66bd2bb
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/bff05b262c446031e03e94e5677e143d
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=60
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-id
Pyjn1bEd9Dam8qNrRACHtNObKDeRxwVOOwG5tahUWVCO4ooeVo3lPw==
activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-r...
10466992.fls.doubleclick.net/ Frame 780D
Redirect Chain
  • https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhyperviso...
  • https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww....
652 B
646 B
Document
General
Full URL
https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f102.1e100.net
Software
cafe /
Resource Hash
287e5881ed6cc0eb48b3dcbdd34f912eb9c65655e8a4579d5979ceeee1d5dcb7
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
307
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 12 May 2023 02:10:26 GMT
expires
Fri, 12 May 2023 02:10:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 12 May 2023 02:10:26 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
bat.js
bat.bing.com/
40 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Fri, 12 May 2023 02:10:25 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 711182D877B14B3880FA5C69162B7617 Ref B: FRAEDGE1315 Ref C: 2023-05-12T02:10:26Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Mon, 23 Jan 2023 21:56:14 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"03d5db9dfd00a5719bb4c9261e6fa1bb"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7356
56a667965d8d21035d00000d.js
tag.marinsm.com/serve/
12 KB
4 KB
Script
General
Full URL
https://tag.marinsm.com/serve/56a667965d8d21035d00000d.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.65 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cowboy /
Resource Hash
f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:26 GMT
Via
1.1 vegur, 1.1 varnish
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Age
0
X-Cache
MISS
Connection
keep-alive
Content-Length
3894
X-Served-By
cache-fra-eddf8230048-FRA
Server
Cowboy
X-Timer
S1683857426.357506,VS0,VE206
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
X-Cache-Hits
0
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:26 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
bf-munchkin.min.js
munchkin.brightfunnel.com/js/build/
20 KB
7 KB
Script
General
Full URL
https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-5.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
Via
1.1 f9c16664a13e70e73a4e280c7a0f2266.cloudfront.net (CloudFront)
Date
Fri, 12 May 2023 02:08:39 GMT
X-Amz-Cf-Pop
FRA56-P4
Age
108
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 16 Jun 2021 18:10:10 GMT
Server
AmazonS3
ETag
W/"20317c42053d4a6e5ba388544778b12a"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=300
X-Amz-Cf-Id
r1kNUbAeNmZ-76AfjLseSxCibREXanjqKiNoHRoC0u9RLjGrQ7cX_A==
qevents.js
a.quora.com/
40 KB
14 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.153.247 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
x-amz-version-id
VqBO7svKfismDjrOf54BMqOIARlRLNs7
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
EFHVSSHFCAR3Q2MQ
age
1378889
x-amz-server-side-encryption
AES256
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
VTIEJDoU/T/XPsZGeuScaTZ8m+cfQBXzFQdZ4VbGvhbiY2VPF+i92jFMgexds0lTfK0Xh4BcM5U=
last-modified
Sat, 22 Apr 2023 01:03:41 GMT
server
cloudflare
x-amz-meta-s3cmd-attrs
md5:47078e63380c6b0cbbfb6d8508b25ee7
etag
W/"47078e63380c6b0cbbfb6d8508b25ee7"
vary
Accept-Encoding
content-type
text/plain
cache-control
public, max-age=14400
cf-ray
7c5f2012b90e18d8-FRA
expires
Fri, 12 May 2023 06:10:26 GMT
client.js
cdn.abrankings.com/js/
35 KB
8 KB
Script
General
Full URL
https://cdn.abrankings.com/js/client.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:7c00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
public
date
Tue, 17 Jan 2023 00:48:39 GMT
content-encoding
gzip
via
1.1 63f629236e2f93bf1af732a50e42e586.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jun 2022 17:44:33 GMT
server
nginx/1.20.1
x-amz-cf-pop
FRA56-P3
age
9940907
etag
W/"62a8c901-8d68"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
max-age=15552000, public
x-amz-cf-id
ZQWLJnFUSFPhF-9ykSSNEfRGI6TcBNaL-lpLcRfk8cmZZAYzrKgtVw==
expires
Sun, 16 Jul 2023 00:48:39 GMT
js
www.googletagmanager.com/gtag/
121 KB
47 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10604934
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d5a3530bf163b8582765b6e0fe0cefecf12bc324a3382b3c5d8f732967471fa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48136
x-xss-protection
0
last-modified
Fri, 12 May 2023 00:02:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 12 May 2023 02:10:26 GMT
stat.js
www.clickcease.com/monitor/
171 KB
54 KB
Script
General
Full URL
https://www.clickcease.com/monitor/stat.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:6600:15:a0d3:77c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
6Er2d0GJvgnFniPQXIH7h8kzG7dJBNJf
content-encoding
gzip
via
1.1 8a6f67a9421de326f43e9107751b580e.cloudfront.net (CloudFront)
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
x-amz-cf-pop
FRA56-P4
age
7
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 22 Nov 2022 11:31:37 GMT
server
AmazonS3
etag
W/"1c27f449b067550681f23ad3e53988fa"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
microphone 'none'; camera 'none';
x-amz-cf-id
MNoXQR5uQCXg1eHW2PxUxHdig3I1nG1-pdVsftx5ykFm2QubD9FUVA==
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-15-119.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Thu, 11 May 2023 23:05:28 GMT
Content-Encoding
gzip
Via
1.1 3199fed6c4260c9448326645d333530a.cloudfront.net (CloudFront)
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-P7
Age
11099
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
Q7JydcbCvw6IQX1uGK25qZuhSjVANXs1sHGN_3o3FtoL5iI6yPeH9w==
js
www.googletagmanager.com/gtag/
121 KB
47 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
274a6e30204f660a6beb2d33b5770ceabd879f27d24a06e052465f192d4c2c27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48206
x-xss-protection
0
last-modified
Fri, 12 May 2023 00:02:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 12 May 2023 02:10:26 GMT
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230073-FRA
js
www.googletagmanager.com/gtag/
189 KB
68 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a0d4f7cf2a6e44aee6bfea6f308a1a988910cd648860875df7d94502a34de362
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69465
x-xss-protection
0
last-modified
Fri, 12 May 2023 00:02:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 12 May 2023 02:10:26 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
r7t3xbAZ3QK/7lQuu5X7ww==
age
34938
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2950
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:51 GMT
server
cloudflare
etag
0x8D96DBF68EC8D5B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0e75d206-d01e-00b1-14e1-5a209b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f20128e659193-FRA
otPcPanel.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/
47 KB
12 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
57AUyP21eMxOiwzpGGh99A==
age
44687
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11457
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:53 GMT
server
cloudflare
etag
0x8D96DBF6A0C163B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
526a64c6-301e-007c-14e1-5a45d3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7c5f20128e669193-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
20 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:bc61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Ye6OeZcNyuFoWog7CYs00A==
age
79431
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:12:05 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
960abd06-f01e-0180-53e1-5a3d19000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7c5f20128e679193-FRA
XDFrame
go.sentinelone.com/index.php/form/ Frame 1011
2 KB
864 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7c5f2012fd72bb73-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 12 May 2023 02:10:26 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
/
www.google.com/pagead/1p-user-list/970186784/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970186784/?random=1683857426289&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&fmt=3&is_vtc=1&random=1161585805&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ru/pagead/1p-user-list/970186784/
42 B
455 B
Image
General
Full URL
https://www.google.ru/pagead/1p-user-list/970186784/?random=1683857426289&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&fmt=3&is_vtc=1&random=1161585805&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/
36 B
372 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:4400:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 01:36:49 GMT
content-encoding
gzip
via
1.1 9e62923882d737ac8cd27f0d1b1c24ce.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2017
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
PL9x60PqYVTn04B7a_DmNKZgOgb1dZmYr0I03Ji-r5HaFdp22HuXbA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-co...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1683857426452%26url%3Dhttps%253A%252F%252Fwww.sentinelone.com%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-co...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-c...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&liSync=true&e_ipv6=AQJJXWi2-wPsUQAAAYgNuUnox7gCxrLeO66Qmx0y3Ij0X88oBOrdXZfsAjOgH0bLUGZPA5nPmVY5IQ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 472E98AAF7C14D47B3B4758019605BF7 Ref B: FRAEDGE1317 Ref C: 2023-05-12T02:10:27Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX7dZvLNmP9bCyM426+BA==

Redirect headers

date
Fri, 12 May 2023 02:10:26 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 71355566E17B44808A1BED053E173CF0 Ref B: FRAEDGE1822 Ref C: 2023-05-12T02:10:26Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1683857426452&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&liSync=true&e_ipv6=AQJJXWi2-wPsUQAAAYgNuUnox7gCxrLeO66Qmx0y3Ij0X88oBOrdXZfsAjOgH0bLUGZPA5nPmVY5IQ
x-li-proto
http/2
content-length
0
x-li-uuid
AAX7dZvIlMS51IGt+zCHrw==
token
cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/
36 B
373 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:4400:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 01:36:49 GMT
content-encoding
gzip
via
1.1 9e62923882d737ac8cd27f0d1b1c24ce.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2017
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
uaOaiG3SxtOXLmeZ22-3ymXL4X3aNIAOG4wQV3iosRsj9SeDV2UcOg==
modules.6fed24b60091da3b9aa3.js
script.hotjar.com/
264 KB
68 KB
Script
General
Full URL
https://script.hotjar.com/modules.6fed24b60091da3b9aa3.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-63.fra56.r.cloudfront.net
Software
/
Resource Hash
7abd2d7bbafa11f84e45b3fff7bd865618bd3617e6aaa9eed562fa233b12d165
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 11:06:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 e37b7824685046c107e13d08c43993fc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
54259
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
69318
last-modified
Thu, 11 May 2023 11:06:06 GMT
etag
"b79d54f0943fddf3924fb2bed52eceb4"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
j9Q_Xvun6KpfV_yvqazg0frOnCP3cTQ4U9xnt3bMCBR_uucfLDZPrw==
collect
www.google-analytics.com/j/
4 B
185 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1121039866&t=pageview&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&ul=en-us&de=UTF-8&dt=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=89716983&gjid=1906256859&cid=1754986622.1683857426&tid=UA-38175129-1&_gid=435500269.1683857426&_r=1&_slc=1&gtm=45He35a0n71KGGXSJ&z=614858489
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/
43 B
420 B
Image
General
Full URL
https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&tag=ViewContent&ts=1683857426476
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.83.27.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-83-27-146.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:26 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
,7654eb98c0a4cedaca98582f19bded10,10.0.0.220,4204,37.58.58.251,,123694167800,1,1683857426.855,0.001,,.,0,0,0.000,0.000,-,0,0,197,110,55,10,34729,,,,,,-,
Content-Type
image/gif
dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=*;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-act...
adservice.google.com/ddm/fls/z/ Frame 780D
42 B
401 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=*;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Requested by
Host: 10466992.fls.doubleclick.net
URL: https://10466992.fls.doubleclick.net/activityi;dc_pre=CLStgt7Z7v4CFTGH_QcdOEgLjQ;src=10466992;type=sitew0;cat=sitew0;ord=2003095080844;gtm=45He35a0;auiddc=289674782.1683857426;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10466992.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
134618848.js
bat.bing.com/p/action/
0
116 B
Script
General
Full URL
https://bat.bing.com/p/action/134618848.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Fri, 12 May 2023 02:10:25 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F871DF95BC664161835B3B70CD613CC1 Ref B: FRAEDGE1315 Ref C: 2023-05-12T02:10:26Z
x-cache
CONFIG_NOCACHE
adsct
t.co/1/i/
43 B
376 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=455721b7-e51e-4d82-92c5-2172d2c0115a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1888ee16-7a9e-48e4-a0bc-301ff94b1b9e&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-response-time
104
date
Fri, 12 May 2023 02:10:25 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
02fed440e5f13c17
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
60eb26d02da776444670506fe5b0850c20412ee49916bdbb4aaebd7213d74ddb
content-length
43
adsct
analytics.twitter.com/1/i/
43 B
724 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=455721b7-e51e-4d82-92c5-2172d2c0115a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1888ee16-7a9e-48e4-a0bc-301ff94b1b9e&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-response-time
105
date
Fri, 12 May 2023 02:10:25 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
013f89e506e8fd0b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
923f348a9744e905e67b08f1d907a686ac0cad1b093e2012e5ca023bc43222e7
content-length
43
iframe_api
www.youtube.com/
1 KB
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1683853869
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ce9c18a953a2eeb6d5efef7d4c04f4d73b055d3789152cbf42bd1b4dfd7e167b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
content-security-policy-report-only
base-uri 'self';default-src 'self' https: blob:;font-src https: data:;img-src https: data: android-webview-video-poster:;media-src blob: https:;object-src 'none';script-src 'report-sample' 'nonce-tndcF9sVvtnalIhbfmfjVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';style-src https: 'unsafe-inline';report-uri /cspreport
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-type
text/javascript; charset=utf-8
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cache-control
private, max-age=0
origin-trial
AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Fri, 12 May 2023 02:10:26 GMT
collect
stats.g.doubleclick.net/j/
4 B
352 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-38175129-1&cid=1754986622.1683857426&jid=89716983&gjid=1906256859&_gid=435500269.1683857426&_u=YADAAEAAQAAAACAAI~&z=1487490136
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:26 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sun, 20 Aug 2023 02:10:26 GMT
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=310158bdd1af84d475fdfad436b9d61d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c868ebeb22a6d2945834c14da4641969a62e35a6cfa434a974339df068324b6e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1422
etag
W/"2cf94922e2d551e8dc7c38c022a9a3ca"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7c5f20142ce99969-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 15 May 2023 02:10:26 GMT
sd
api.brightfunnel.com/v1/
4 B
542 B
XHR
General
Full URL
https://api.brightfunnel.com/v1/sd
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-45.fra60.r.cloudfront.net
Software
/
Resource Hash
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

Date
Fri, 12 May 2023 02:10:27 GMT
Via
1.1 9ef1b108656dc6d0707b168b862883dc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Amzn-Trace-Id
Root=1-645da012-2768bc3d3d3b9f7618dd0a69;Sampled=0;lineage=9409b995:0
x-amzn-RequestId
e5c6dbe5-bc9a-48e2-8de6-dae22fae76c3
X-Cache
Miss from cloudfront
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
keep-alive
x-amz-apigw-id
EyXy-HB0oAMF6qw=
Content-Length
4
X-Amz-Cf-Id
Mo-szzlu5HWp4sIhuPRWESMUfWHYeVOQe9QQBYJ_Z1AdeUzzzcUCGw==
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/svg+xml
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame 1011
208 KB
69 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.sentinelone.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 23 Mar 2023 21:46:36 GMT
server
cloudflare
age
5483
etag
"c607a9-33e51-5f79835f6a700"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7c5f20146e93bb73-FRA
expires
Fri, 12 May 2023 06:10:26 GMT
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=151554a2-0db5-4358-8f96-e0fb27e1bb7c&sid=29310f20f06a11ed904e4b7723ae2a2c&vid=29313e60f06a11eda3a0b11942f6b4e6&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&r=&lt=2304&evt=pageLoad&sv=1&rn=12919
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:25 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 553F263956EC453D8CC26D3ABDE4A987 Ref B: FRAEDGE1315 Ref C: 2023-05-12T02:10:26Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
6si.min.js
j.6sc.co/
33 KB
11 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
12ce92cc3c4eb9d74f48e9a10eb919bdf30bbdc5ccf9843c6543fec302dec54f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 04 Apr 2023 21:13:35 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"642c92ff-8319"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
10492
expires
Fri, 12 May 2023 02:10:26 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-38175129-1&cid=1754986622.1683857426&jid=89716983&_u=YADAAEAAQAAAACAAI~&z=353723768
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-38175129-1&cid=1754986622.1683857426&jid=89716983&_u=YADAAEAAQAAAACAAI~&z=353723768
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tagjs
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
125 B
454 B
Script
General
Full URL
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Server
34.255.134.71 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-134-71.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cd5cf299995ac55b41916bbb525fb0cd013a50c617a00a5a0ef339f0fac38d65

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
125
Content-Type
text/javascript

Redirect headers

Location
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
www-widgetapi.js
www.youtube.com/s/player/cfa9e7cb/www-widgetapi.vflset/
185 KB
57 KB
Script
General
Full URL
https://www.youtube.com/s/player/cfa9e7cb/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14f5566d4c764cd781dad9a4f1a9530797597bac11661a2b8def07c4e59f1985
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 01:55:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
921
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
58043
x-xss-protection
0
last-modified
Wed, 10 May 2023 01:29:37 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 11 May 2024 01:55:05 GMT
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1683857426751&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1683857426751-54200&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:27 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
95c03728-a03d-4acf-8d6c-f1df19e31f6b
ga.js
ga.clearbit.com/v1/
4 KB
1 KB
Script
General
Full URL
https://ga.clearbit.com/v1/ga.js?authorization=pk_ed7b4bbadb390cf24ef37a1223019246
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.158.205.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-205-16.eu-central-1.compute.amazonaws.com
Software
envoy /
Resource Hash
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-envoy-response-flags
-
server
envoy
x-api-version
2018-03-28
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
x-account-id
330680ff-f4de-4d19-81d4-375af65453c9
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56f6d174823b14e652d9083cd8e89bbbfb71cc6f0940c53a518cab6805fab52c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
EXPIRED
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
a035b03a-595f-4b43-b8e9-f3bde236fede
x-runtime
0.030885
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"56f6d174823b14e652d9083cd8e89bbb"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
cf-ray
7c5f20158dbe9969-FRA
access-control-allow-headers
SDK-Version
expires
Fri, 12 May 2023 03:10:26 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/?random=1683857426836&cv=11&fst=1683857426836&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&auid=289674782.1683857426&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b5bffbdc59c8f25b3e80ec820fa4e6e0070c442aa7b6c8d8d4424a8c308d04e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1351
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/?random=1683857426851&cv=11&fst=1683857426851&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&auid=289674782.1683857426&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
85f7051d6ab6a54c97816eee0ad92c1ccdb9b5ffdd10256feb1433b45a192a5c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
c.6sc.co/
7 B
205 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
320 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
36dac674791ffd7ac98bb2f41a49df341f788ec86fa22e365d49b481dc6f0caa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a00:c98:2030:a004:1::13
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="467738_34603388_196559086_13_590_6_0";dur=1
content-length
24
expires
Fri, 12 May 2023 02:10:26 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%223576c97e67a9b7f8553a44ff1cc54791%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%228ba4c5a3fa178cfadac2b61291295db2874be830%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.google.com/pagead/1p-user-list/10940107324/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/10940107324/?random=1683857426836&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=256408910&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ru/pagead/1p-user-list/10940107324/
42 B
108 B
Image
General
Full URL
https://www.google.ru/pagead/1p-user-list/10940107324/?random=1683857426836&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=256408910&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/462891735/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/462891735/?random=1683857426851&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4087027296&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ru/pagead/1p-user-list/462891735/
42 B
108 B
Image
General
Full URL
https://www.google.ru/pagead/1p-user-list/462891735/?random=1683857426851&cv=11&fst=1683856800000&bg=ffffff&guid=ON&async=1&gtm=45be35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4087027296&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:26 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2030%3Aa004%3A1%3A%3A13%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
adsct
analytics.twitter.com/i/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_QiBWRs6TMFc0Y9N5v
43 B
112 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_QiBWRs6TMFc0Y9N5v
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-response-time
105
date
Fri, 12 May 2023 02:10:26 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
d90b2ab40261a58c
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
923f348a9744e905e67b08f1d907a686ac0cad1b093e2012e5ca023bc43222e7
content-length
43

Redirect headers

Location
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_QiBWRs6TMFc0Y9N5v
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=yah
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1&verify=true
0
121 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1&verify=true
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-75-62-37.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.10.57 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_QiBWRs6TMFc0Y9N5v&_origin=1&verify=true
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=opx
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_QiBWRs6TMFc0Y9N5v
43 B
273 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_QiBWRs6TMFc0Y9N5v
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_QiBWRs6TMFc0Y9N5v
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_QiBWRs6TMFc0Y9N5v
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_QiBWRs6TMFc0Y9N5v
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
3bafef7aa4e37890defcd73f0a080481
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_QiBWRs6TMFc0Y9N5v
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
cb
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=goo
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfUWlCV1JzNlRNRmMwWTlONXY
  • https://pixel-geo.prfct.co/cb?partnerId=goo
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Server
34.255.134.71 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-134-71.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel-geo.prfct.co/cb?partnerId=goo
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
240
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
pixel-geo.prfct.co/seg/
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/seg/?add=4530935&source=js_tag&a_id=56252
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.255.134.71 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-134-71.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/seg?t=2&add=4530935
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
43 B
1 KB
Image
General
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
HTTP/1.1
Server
185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 12 May 2023 02:10:27 GMT
AN-X-Request-Uuid
38fefa01-5f1a-4a7d-9f62-0e789558a7d4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
image/gif
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
37.58.58.251; 37.58.58.251; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Date
Fri, 12 May 2023 02:10:27 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
37.58.58.251; 37.58.58.251; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
db5f6e8e-f066-47c4-9fa0-7997c6866475
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
1466
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
cf-ray
7c5f20168c569bce-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 11 Jun 2023 02:10:26 GMT
rp.gif
alb.reddit.com/
42 B
157 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1683857427024&id=undefined&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&uuid=b5a270af-f6dc-4f45-a457-928346f49886&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
via
1.1 varnish
server
Varnish
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
details
epsilon.6sense.com/v3/company/
746 B
587 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.45.170 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-45-170.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9b2dc2a6592abd91e0dee577ef85461138e643d96bf3f3756f7c6d856d8d5e8b

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 8ba4c5a3fa178cfadac2b61291295db2874be830
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
content-length
399
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.45.170 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-45-170.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.sentinelone.com
access-control-max-age
1800
date
Fri, 12 May 2023 02:10:27 GMT
server
nginx
/
www.googleadservices.com/pagead/conversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/970186784/?random=1683857427053&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&bttype=purchase&auid=289674782.1683857426&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f2.1e100.net
Software
cafe /
Resource Hash
66914088783a68a4bcb47f0873b55ebe9d34afe66dc2d030f25bd71f0edaa8c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1732
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervi...
13115870.fls.doubleclick.net/ Frame 7398
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhype...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2...
507 B
333 B
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f102.1e100.net
Software
cafe /
Resource Hash
6784aff47a25bcd4ab457a34ec7f2a4e7d33f829c4ee2992b3bd3991712e8e5e
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
310
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 12 May 2023 02:10:27 GMT
expires
Fri, 12 May 2023 02:10:27 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 12 May 2023 02:10:27 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJR839-PWm-sAAAAYgNuUqxN3nWGuanxEWGtNbXcLfY1kxYQNLzDTsbCqh5WFDpHTe3dejaSmXMbw
43 B
246 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJR839-PWm-sAAAAYgNuUqxN3nWGuanxEWGtNbXcLfY1kxYQNLzDTsbCqh5WFDpHTe3dejaSmXMbw
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:26 GMT
content-encoding
gzip
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 0CB13AC892F7475AB9E3D9220D7910EC Ref B: FRAEDGE1317 Ref C: 2023-05-12T02:10:27Z
linkedin-action
1
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
content-type
image/gif
x-li-proto
http/2
content-length
65
x-li-uuid
AAX7dZvNS/RFvn6SMweNmA==

Redirect headers

date
Fri, 12 May 2023 02:10:27 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: E6BD9986C34049D1B53DB27BB26BE079 Ref B: FRAEDGE1822 Ref C: 2023-05-12T02:10:27Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQJR839-PWm-sAAAAYgNuUqxN3nWGuanxEWGtNbXcLfY1kxYQNLzDTsbCqh5WFDpHTe3dejaSmXMbw
x-li-proto
http/2
content-length
0
x-li-uuid
AAX7dZvLoxjXmK2Xsf3seQ==
0
bat.bing.com/action/
0
120 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=151554a2-0db5-4358-8f96-e0fb27e1bb7c&sid=29310f20f06a11ed904e4b7723ae2a2c&vid=29313e60f06a11eda3a0b11942f6b4e6&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&sw=1600&sh=1200&sc=24&evt=custom&rn=949974
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 12 May 2023 02:10:26 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B7331F213C57412CA16BB9CD28F6BA55 Ref B: FRAEDGE1315 Ref C: 2023-05-12T02:10:27Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
184 B
778 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151601
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
886abc149c92bbdebfc7755494a79d63b1725b53157259a0e9777df45f9b1d33
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:27 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
3d7571e1-871a-4b61-b9fc-61789d01bef2
x-runtime
0.014281
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"886abc149c92bbdebfc7755494a79d63"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept, Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate
cf-ray
7c5f201759b62bf8-FRA
access-control-allow-headers
SDK-Version
dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=*;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threa...
adservice.google.com/ddm/fls/z/ Frame 7398
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=*;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F
Requested by
Host: 13115870.fls.doubleclick.net
URL: https://13115870.fls.doubleclick.net/activityi;dc_pre=CMz9rN7Z7v4CFU7juwgd1u4FWA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;gtm=45fe35a0;auiddc=289674782.1683857426;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://13115870.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
77b6f85e-9da4-4d45-86d9-51617adb8f2d
img.onesignal.com/permanent/
4 KB
4 KB
Image
General
Full URL
https://img.onesignal.com/permanent/77b6f85e-9da4-4d45-86d9-51617adb8f2d
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23600677937c4e800aa1a50a451c6d196032d4b9a0e2e5f92f840af3ab3aef58
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=15552000; includeSubDomains
cf-cache-status
REVALIDATED
x-guploader-uploadid
ADPycdvn3GWTwW5HhAXQvWxUaEALjjmbDCEgMnTTlT3A2AzxAL9t_chBw9zn7C96-9TyOiuW0AiqDjINucUdGCu7FniJpSjonL8g
x-goog-meta-x-goog-source-etag
"9b97702edc961ca0af6f17ac34b36c16"
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3768
pragma
no-cache
last-modified
Tue, 14 Feb 2023 03:27:57 GMT
server
cloudflare
etag
"-CKqTk+aIlP0CEAE="
vary
Origin, Accept-Encoding
x-goog-generation
1676345277204906
content-type
application/octet-stream
x-goog-hash
crc32c=lAqoLw==, md5=m5dwLtyWHKCvbxesNLNsFg==
cache-control
public, max-age=2678400
x-goog-meta-cache-control
public, maxage=604800
x-goog-stored-content-length
3768
accept-ranges
bytes
cf-ray
7c5f2017cf449969-FRA
expires
Mon, 12 Jun 2023 02:10:27 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1121039866&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&ul=en-us&de=UTF-8&dt=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aDDAAEADQAAAACAAI~&jid=&gjid=&cid=1754986622.1683857426&tid=UA-38175129-1&_gid=435500269.1683857426&gtm=45He35a0n71KGGXSJ&cd1=&cd2=&cd3=&cd4=Germany&cd5=&z=215332569
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 May 2023 17:28:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
31328
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
www.google.ru/pagead/1p-conversion/970186784/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww....
  • https://www.google.com/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flab...
  • https://www.google.ru/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs...
42 B
64 B
Image
General
Full URL
https://www.google.ru/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&auid=289674782.1683857426&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOEtUeW9nWVE4T1dteXV6aHZvQk5FaVVBYUc5X0xIb0JNbGsySlByVElFSFR0ZmxSMUVKYVZzcHNvWTFtNFNVUXlRcWdHRzVzGlhDaEVJOEtUeW9nWVFsOW45OXVucHRfUEtBUkl0QU5sWXZNSU5rYzF0U21MQWtJX0Y0T2E5M3hodGRldGZNekpoeGdBa3hZXzk0N3BSbTFRbWxlVzQ0aDVj&is_vtc=1&ocp_id=E6BdZKfgCqiv9u8Po8uv8A4&cid=CAQSKQBygQiDkxypmR0r0hbh8DUnHzKV_qYHZtoh2ff4CX6UnQfKOGGxDdgU&eitems=ChEI8KTyogYQ_O7mhZKAxPf3ARIdAMsh3UzmX0dwjoc0yFBiDxirCuiMRYmpllMM-dg&random=990948647&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H3
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 12 May 2023 02:10:27 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.ru/pagead/1p-conversion/970186784/?random=1628088827&cv=11&fst=1683857427053&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne&value=0&auid=289674782.1683857426&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOEtUeW9nWVE4T1dteXV6aHZvQk5FaVVBYUc5X0xIb0JNbGsySlByVElFSFR0ZmxSMUVKYVZzcHNvWTFtNFNVUXlRcWdHRzVzGlhDaEVJOEtUeW9nWVFsOW45OXVucHRfUEtBUkl0QU5sWXZNSU5rYzF0U21MQWtJX0Y0T2E5M3hodGRldGZNekpoeGdBa3hZXzk0N3BSbTFRbWxlVzQ0aDVj&is_vtc=1&ocp_id=E6BdZKfgCqiv9u8Po8uv8A4&cid=CAQSKQBygQiDkxypmR0r0hbh8DUnHzKV_qYHZtoh2ff4CX6UnQfKOGGxDdgU&eitems=ChEI8KTyogYQ_O7mhZKAxPf3ARIdAMsh3UzmX0dwjoc0yFBiDxirCuiMRYmpllMM-dg&random=990948647&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async-api.ad3273bd-1.232.0.min.js
js-agent.newrelic.com/
3 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/async-api.ad3273bd-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e9e3652349e81228cb2c0309b3e6a9f23da99f571017f01a984da348ddb4a257
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
OjwEEoZjF9pbnlt.Cg9dV5pJF0e7Bjo3
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
2HV6J6QHFFESHJRR
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1353
x-amz-id-2
BXEPYmEflhh8Vht8sn9Q1DUjjjCdyno/0vK0P4vna65JsDaTt7F35BfMmDx7zQLw8OCOg9e2TFA=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.576779,VS0,VE0
etag
"d7011e3a3501d54c9be8929572a18598"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1638
session-manager.2a8d47d1-1.232.0.min.js
js-agent.newrelic.com/
15 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/session-manager.2a8d47d1-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de1b63b04b142bb4eef4fd7311fc5b56fe61563db26d21bc69b2f7c42fcdd994
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
D9U.McFOdEj4dYMN5VJBUueQRx486Iwz
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
33YC9JCZQM6STQJG
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5781
x-amz-id-2
MFfb7MGqGrqmfqqSXBRxyB8p3seuC8FOIGAdlP3GdJhGKDscVqHW57p863nKhRGgnkRzZizmvC4=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.576836,VS0,VE0
etag
"e42e9b9282d7865427c32ad60eea44b4"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1182
up
insight.adsrvr.org/track/ Frame A03B
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&upid=jskiafk&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Fri, 12 May 2023 02:10:27 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
lazy-loader.c8cd494b-1.232.0.min.js
js-agent.newrelic.com/
921 B
615 B
Script
General
Full URL
https://js-agent.newrelic.com/lazy-loader.c8cd494b-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24b5fa9227e2539d460d47bb58bc2cfd5ab7b460b10ed08f5f237a1c4227fa30
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
JxOZDsaCO.84OJr88feb47MQNIiB.lPY
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
HFKEC7V8RSG7GQ3Z
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
410
x-amz-id-2
sMPeOof8K4e91kQ20uXJDDwefRnsVFND0s9EnxyiOeAw9CM1xr2qBuk5sozOrYVezXVrvqQ6llg=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.602549,VS0,VE0
etag
"43b458adcc5ab7566291590de5438262"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
922
875.2c240adb-1.232.0.min.js
js-agent.newrelic.com/
9 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/875.2c240adb-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d16927d37f8e26f8565d8f37936c1cac3ae49299c69cfe76f84baf43677c3ec4
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
hJYscwmqXwVNvHS80_0vRqxt_Uk.MPpY
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
33Y6DMYX2M755T46
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3692
x-amz-id-2
12ESXK8BgHWgzbN3nQPaydy+L59jXSGMNsIQOuRJSUSgpXbpopBHG7CYiWTsgYBLZaJ3F98QqLg=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.614683,VS0,VE0
etag
"12b760183a18786621f95a5599ea91d1"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
922
page_view_event-aggregate.5a238c1f-1.232.0.min.js
js-agent.newrelic.com/
11 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.5a238c1f-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b759dcb812df0caaa1b5a8d4b4d86a8f6f41f4b4f4c53589f54cf4d15bc82124
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
m6hQu7Qmu3oSTIZPOga15if6q1_usD02
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
33Y1F68V5R4G1R1S
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4123
x-amz-id-2
LE8Mmxf56EgzLRhRoenpxF0OXZIwo/pswFnDB4N8n+EeKaME6HXt1Xk7L6rvqhOxcNjSk/xOwSY=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.615247,VS0,VE0
etag
"397497131773c37606e11fcb4222917f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
925
page_view_timing-aggregate.ddd91465-1.232.0.min.js
js-agent.newrelic.com/
12 KB
5 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.ddd91465-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
55ae2bb63b3739d001918259bb945000b092bfa1a7347ba9330239ce0c96de4d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
ZN8S09QpTi3DRaBHssxUl.rChDa0uNQQ
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
33Y867HS6MYT7985
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4571
x-amz-id-2
CILtP2UgtVGD48J+UTjWq+irCqTwzRZs1VccfZLy4xzSBKIMwL+jwnc8ZZpkzmwxwhHr4pdQKRs=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.615628,VS0,VE0
etag
"38f4d68378bfe3989db669dc9385b7c0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
929
metrics-aggregate.c2ad263a-1.232.0.min.js
js-agent.newrelic.com/
4 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/metrics-aggregate.c2ad263a-1.232.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
04c3e27b4e50b05e753624b18d153a73a64bd66f8544d04d73278b9cca80b643
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id
Kwxbmu4apiKNi1wg_2QBa578nUzXK.xS
content-encoding
gzip
via
1.1 varnish
date
Fri, 12 May 2023 02:10:27 GMT
strict-transport-security
max-age=300
x-amz-request-id
33YF3D3MNZZ7XXTH
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1663
x-amz-id-2
0t28v8WC4ksNHlPsbHnq2BFvbag9JdhBEGj1l2cZmwZMryjnQUGTG7J4qr+P0dP0z2Q8RhqNGa0=
x-served-by
cache-fra-etou8220073-FRA
last-modified
Mon, 08 May 2023 21:20:25 GMT
server
AmazonS3
x-timer
S1683857428.615588,VS0,VE0
etag
"581d99ebc34c05e0a160a0c4a848cae7"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
921
NRJS-7f7a0b93139dcf56f90
bam.nr-data.net/1/
49 B
528 B
Script
General
Full URL
https://bam.nr-data.net/1/NRJS-7f7a0b93139dcf56f90?a=773889139&v=1.232.0&to=ZlwDMkMCWxJQUkdYXF8WIAVFCloPHkJaX1RdXA%3D%3D&rst=3322&ck=0&s=0&ref=https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/&ap=515&be=220&fe=3030&dc=2083&perf=%7B%22timing%22:%7B%22of%22:1683857424314,%22n%22:0,%22dn%22:1,%22dne%22:10,%22c%22:10,%22s%22:17,%22ce%22:29,%22rq%22:29,%22rp%22:220,%22rpe%22:229,%22di%22:2273,%22ds%22:2279,%22de%22:2304,%22dc%22:3229,%22l%22:3230,%22le%22:3251%7D,%22navigation%22:%7B%7D%7D&fp=1703&fcp=1776&at=ShsARAsYSBw%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/async-api.ad3273bd-1.232.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Fri, 12 May 2023 02:10:27 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Vary
Accept-Encoding
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
CF-Ray
7c5f201b3e01bbc1-FRA
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A26%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:28 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
test
cdn.abrankings.com/
2 B
420 B
XHR
General
Full URL
https://cdn.abrankings.com/test?url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&abr_id=1280
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:7c00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-my-header
my-header-content
date
Fri, 12 May 2023 02:10:28 GMT
content-encoding
gzip
via
1.1 82514a5a8cf35fb3132b0b5ab9cb724c.cloudfront.net (CloudFront)
server
nginx/1.20.1
x-amz-cf-pop
FRA56-P3
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
max-age=60, public
x-amz-cf-id
whI1KwHjr2nk_cXYsQR_Q88q_iZTEomoqA-9fvYm80khWckzWkgKHw==
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:29 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A28%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:30 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
492 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=11554424-df7f-4f86-8e65-29a40c5bfd41&session=cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2012%20May%202023%2002%3A10%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Availability%20of%20leaked%20Babuk%20source%20code%20is%20fuelling%20a%20proliferation%20of%20file%20lockers%20targeting%20VMware%20ESXi.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Hypervisor%20Ransomware%20%7C%20Multiple%20Threat%20Actor%20Groups%20Hop%20on%20Leaked%20Babuk%20Code%20to%20Build%20ESXi%20Lockers%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&pageViewId=32208d18-cb06-4a29-8eed-7fcd2c12d29f
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Fri, 12 May 2023 02:10:31 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

189 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 boolean| credentialless object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA object| OneTrustStub function| OptanonWrapper object| google_tag_manager object| google_tag_data object| dataLayer object| google_optimize object| analytics string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| wpp_params object| WordPressPopularPosts function| $ function| jQuery object| MktoForms2 function| FontFaceOnload function| Swiper function| Collage object| FaqSearcher function| HeadingSizer object| HomeScrolling function| LogoCrossfader object| MarketoWrap object| ScrolledSections function| TestimonialCarousel function| VideoCarousel function| VideoTabs function| VimeoPlaylist function| documentInitOneSignal function| OneSignal function| gtag object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ function| onYouTubeIframeAPIReady object| gaGlobal function| postscribe object| google_tag_manager_external function| ClipboardJS string| GoogleAnalyticsObject function| ga object| GooglebQhCsO function| hj object| _hjSettings function| rdt object| _pa object| freeEditElems number| len undefined| curr string| bfId number| bfSession string| _linkedin_partner_id object| _linkedin_data_partner_ids function| qp number| abr_id object| script string| target object| elem function| twq object| Optanon object| OneTrust function| addCaptchaScript object| jQuery11240017934019154608682 function| lintrk boolean| _already_called_lintrk object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| terminusTracker object| gaplugins object| gaData object| qevents function| UET function| UET_init function| UET_push object| ueto_458fcf55de object| uetq object| regeneratorRuntime object| twttr object| lazyLoadInstance function| sidebarSticky function| checkPageScroll object| anchors object| anchor object| swiper undefined| largest object| hljs object| MarkerAnimation function| LazyLoad function| WOW object| AmazonPolly object| AnimatedBox object| Autopop object| Calendar object| GlobalMediaViewer object| Glossary object| Greenhouse object| Highlighter object| ImageModalOpener object| Magnifier object| MultiStepForm object| PathFactoryUtils object| ProgressBar object| ResourceCenter object| TableOfContents object| TechCenter object| Threats object| Tooltip object| UrlShortener object| UtmLinks function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| ccConsole boolean| ccinstalled number| r function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si function| facebookEventsHelper function| googleAdsEventsHelper object| _pq object| scriptUrl object| ttPolicy object| YT object| YTConfig boolean| yt_embedsEnableHouseBrandAndYtCoexistence function| onYTReady object| MunchkinTracker number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 string| abr_url object| abr function| abrankings function| Template7 function| ttd_dom_ready function| TTDUniversalPixelApi object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels boolean| _storagePopulated boolean| abr_completed string| dateDayShort string| dateDay string| dateDD string| dateMon string| dateMM string| dateMonth string| dateYYYY string| dateYY

50 Cookies

Domain/Path Name / Value
.sentinelone.com/ Name: __cfredirector_sm
Value: DE
.go.sentinelone.com/ Name: __cf_bm
Value: ABvUfA3UPg0S5Eml6LIWXNEFaDgk61uzMu.VtYdJLIw-1683857424-0-AWM6uF5SwCHX5cjsZkKuexHetKMEw0wHkJD3WZMNUCnl3KxFbMdtUcPzr8D8NniNNGrkbqY3SyVWEDojHax/2q0=
.onesignal.com/ Name: __cf_bm
Value: dSOQziDeEnIHRj2XU3xRMaVklLfWQFDnDYSCN21o0eI-1683857426-0-AY+YCmsBvaC94iiwCq96xXljAHWaA3jkYgrd1ZJUHvLNAJlz69GgAfhqrReeDM//uiHxueIYSpOl7cPb5MQS9Uc=
.sentinelone.com/ Name: ajs_anonymous_id
Value: e5641041-826f-484c-8d87-bb6c09646e8f
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1683857426.1.0.1683857426.0.0.0
.sentinelone.com/ Name: _gcl_au
Value: 1.1.289674782.1683857426
.doubleclick.net/ Name: IDE
Value: AHWqTUmIgQZb0ZvgIJNu4cXweTnJCn_ed3GiglKO2Czy6CM1JZWLaZ93I7uaCE3JGZ0
.sentinelone.com/ Name: _ga
Value: GA1.2.1754986622.1683857426
.sentinelone.com/ Name: _gid
Value: GA1.2.435500269.1683857426
.sentinelone.com/ Name: _gat_UA-38175129-1
Value: 1
www.sentinelone.com/ Name: ln_or
Value: eyI0MzI4OTAiOiJkIn0%3D
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !3VJN06YocZzrL2mkCIQPm+cqSAXSESR03EC7mkt9NLV/5CuR0xMHqiiZA31Sn4tB/1xCiKokG9FdGe4=
.youtube.com/ Name: YSC
Value: wieQOoM5u6M
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: T5rhj4_uRYg
.sentinelone.com/ Name: bf_lead
Value: 1b34es3c0kao00
.linkedin.com/ Name: UserMatchHistory
Value: AQIbRMcdDR02jAAAAYgNuUh1l9UURFqGWb4u48TYlYY8tGPC6Xasdf-un9VhF6M04tr1-vY_mvHNuQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJvQaeO6Dk8CQAAAYgNuUh1yhK2ri_uZpYF8OKo0o1WkhtigX3uysMfbL9ywq4jUcuihy-fiMkoHCWrF8uQxQ
.linkedin.com/ Name: bcookie
Value: "v=2&9f94b1a1-c664-4c66-8b9f-1d97f91475b4"
.linkedin.com/ Name: lidc
Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2671:u=1:x=1:i=1683857426:t=1683943826:v=2:sig=AQEpCvJt4PB7wi0Ot1dQ-g2wL-mvGyVT"
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Fri+May+12+2023+02%3A10%3A26+GMT%2B0000+(GMT)&version=6.23.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fhypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.t.co/ Name: muc_ads
Value: 91b9f3d8-4b45-464f-b674-ff7451c0c432
.sentinelone.com/ Name: _hjSessionUser_2714452
Value: eyJpZCI6ImVhY2Q2OTE5LTY4MzQtNThmOC04MDY5LTk0YzZkNGZkM2NjYSIsImNyZWF0ZWQiOjE2ODM4NTc0MjY2NDYsImV4aXN0aW5nIjpmYWxzZX0=
.sentinelone.com/ Name: _hjFirstSeen
Value: 1
.sentinelone.com/ Name: _hjIncludedInSessionSample_2714452
Value: 1
.sentinelone.com/ Name: _hjSession_2714452
Value: eyJpZCI6ImExZmQyYzBkLTUxNmUtNGU0YS1iMTMzLWEyMTZkZmY0MWY1OSIsImNyZWF0ZWQiOjE2ODM4NTc0MjY2NTUsImluU2FtcGxlIjp0cnVlfQ==
.sentinelone.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
.twitter.com/ Name: guest_id_marketing
Value: v1%3A168385742660044442
.twitter.com/ Name: guest_id_ads
Value: v1%3A168385742660044442
.twitter.com/ Name: personalization_id
Value: "v1_8AFvpJk1g7sxjc2mpQFiIQ=="
.twitter.com/ Name: guest_id
Value: v1%3A168385742660044442
.bing.com/ Name: MUID
Value: 15C79C443D9E645732578F4B3C4C65A8
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1683857426751-54200
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023051202102664e1f1fd-b070-4bbb-86b6-5ad5537d3ad5AQEAvCBsxjCqMpo4qEb-8CrRxnQj8NC2"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODM4NTc0MjY7MjswMjFvhgfflhxXTbpqYVAkbemflN3P8Bj1iRpcIC1DGRVazQ==
www.sentinelone.com/ Name: _gd_visitor
Value: 11554424-df7f-4f86-8e65-29a40c5bfd41
www.sentinelone.com/ Name: _gd_session
Value: cd61ab42-fa7f-4d6d-8ee5-6c3d7d45647a
.prfct.co/ Name: pa_uid
Value: pa_QiBWRs6TMFc0Y9N5v
.prfct.co/ Name: pa_twitter_ts
Value: 1683857426962
.prfct.co/ Name: pa_yahoo_ts
Value: 1683857426998
.sentinelone.com/ Name: _rdt_uuid
Value: 1683857427023.b5a270af-f6dc-4f45-a457-928346f49886
.prfct.co/ Name: pa_openx_ts
Value: 1683857427031
.prfct.co/ Name: pa_rubicon_ts
Value: 1683857427033
.prfct.co/ Name: pa_google_ts
Value: 1683857427034
.sentinelone.com/ Name: _uetsid
Value: 29310f20f06a11ed904e4b7723ae2a2c
.sentinelone.com/ Name: _uetvid
Value: 29313e60f06a11eda3a0b11942f6b4e6
.6sc.co/ Name: 6suuid
Value: aad017028f40000013a05d647c000000aee50900
.adnxs.com/ Name: uuid2
Value: 7134290309521331386
.adnxs.com/ Name: anj
Value: dTM7k!M4/8CxrEQF']wIg2GUinY)Ne!@wnf-Te9(>wL5L!!'E]$cCAP
.yahoo.com/ Name: A3
Value: d=AQABBBOgXWQCEGgVCY8_PrX5va81gyk3WHgFEgEBAQHxXmRnZOANyiMA_eMAAA&S=AQAAAhhtOwfexVkfYXOqOvJvKvY
.analytics.yahoo.com/ Name: IDSYNC
Value: 18z4~2ble

1 Console Messages

Source Level URL
Text
network error URL: https://www.sentinelone.com/wp-json/wordpress-popular-posts/v1/popular-posts
Message:
Failed to load resource: the server responded with a status of 500 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10466992.fls.doubleclick.net
13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
adservice.google.com
alb.reddit.com
analytics.twitter.com
api.brightfunnel.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.onesignal.com
cloud.typography.com
cm.g.doubleclick.net
de.sentinelone.com
e.calibermind.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
ga.clearbit.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
img.onesignal.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.adsrvr.org
munchkin.brightfunnel.com
munchkin.marketo.net
onesignal.com
pixel-geo.prfct.co
pixel.rubiconproject.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.google-analytics.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag.marinsm.com
ups.analytics.yahoo.com
us-u.openx.net
www.clickcease.com
www.google-analytics.com
www.google.com
www.google.de
www.google.ru
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.sentinelone.com
www.youtube.com
104.102.38.132
104.17.74.206
104.244.42.5
104.244.42.67
104.26.2.18
108.138.15.119
13.107.42.14
13.32.121.45
146.75.116.157
151.101.192.65
151.101.2.137
151.101.65.140
162.159.153.247
162.247.241.14
172.217.18.102
172.217.18.2
172.217.18.98
18.158.205.16
18.66.97.49
185.89.210.180
192.28.144.124
2001:4860:4802:32::36
23.201.248.34
2600:9000:20eb:4400:2:53b2:240:93a1
2600:9000:223d:7c00:11:8a36:7200:93a1
2600:9000:223e:6600:15:a0d3:77c0:93a1
2606:4700:3031::ac43:d595
2606:4700:3037::6815:2d74
2606:4700:4400::6812:2b9e
2606:4700::6812:d63b
2606:4700::6812:d73b
2606:4700::6813:bc61
2620:12a:8001::2
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:806::2002
2a00:1450:4001:806::2003
2a00:1450:4001:809::2004
2a00:1450:4001:80b::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:813::200e
2a00:1450:4001:828::2008
2a00:1450:4001:828::200e
2a00:1450:4001:82a::200e
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2002
2a00:1450:400c:c02::9a
2a02:26f0:7100::210:180
2a02:26f0:780::210:ca7a
2a04:4e42:200::396
3.75.62.37
34.255.134.71
34.98.64.218
35.156.45.170
35.71.131.137
52.222.236.5
52.222.236.63
54.83.27.146
69.173.144.165
95.101.111.170
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87
02ba9c5c3388971d5ae9592e9194e2ebfba1070be332bc8b10be7983e0d393ad
04c3e27b4e50b05e753624b18d153a73a64bd66f8544d04d73278b9cca80b643
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
0740e0c9ce16c14ec5359705e5f33dcf14d624fe7412025166bbb18559274ddb
0add20162e5eb55d8a9dcf20d777ed581d0deb401eb52af249d730c57d8120fb
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
0f7a03e0e5ddc810f43fe825134e8f02b2dbe1cbefe1eef2aa4cbcead04df3a1
0ffe82ccea2d18f7bd89e59622b55af524162376e266312225f8d79290776cf7
12ce92cc3c4eb9d74f48e9a10eb919bdf30bbdc5ccf9843c6543fec302dec54f
14f5566d4c764cd781dad9a4f1a9530797597bac11661a2b8def07c4e59f1985
194addf8fd862999286b33cf83116babe8c700ba3a28111777f49ca72c429970
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
223befa75fc6c8b0b881d2f0e71e15e4aa1822b7de1ab3548874ddd8e929417f
23600677937c4e800aa1a50a451c6d196032d4b9a0e2e5f92f840af3ab3aef58
24b5fa9227e2539d460d47bb58bc2cfd5ab7b460b10ed08f5f237a1c4227fa30
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
274a6e30204f660a6beb2d33b5770ceabd879f27d24a06e052465f192d4c2c27
287e5881ed6cc0eb48b3dcbdd34f912eb9c65655e8a4579d5979ceeee1d5dcb7
2b5bffbdc59c8f25b3e80ec820fa4e6e0070c442aa7b6c8d8d4424a8c308d04e
2e207c92ddbac44f8ffb91f962bd646859d3a64334c95d6888f01f4d37bf6935
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
36dac674791ffd7ac98bb2f41a49df341f788ec86fa22e365d49b481dc6f0caa
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55ae2bb63b3739d001918259bb945000b092bfa1a7347ba9330239ce0c96de4d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56f6d174823b14e652d9083cd8e89bbbfb71cc6f0940c53a518cab6805fab52c
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
5a48ec4dabb851ec6b94a81ab7a3b8f723de509d9485a545d3fae5f9ad289b93
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
66914088783a68a4bcb47f0873b55ebe9d34afe66dc2d030f25bd71f0edaa8c9
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288
6784aff47a25bcd4ab457a34ec7f2a4e7d33f829c4ee2992b3bd3991712e8e5e
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
72fc1a57801612f9e297e1c1954410ff840c40e713a6b4b40b2596e80338c2ee
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
76607d31a357b52055ffcb484c88d8872a6b9b208fbf15a1c8daf5b10f8d6915
774da926daffb16b9aaec10f3325c7dfb78e138a918a99597aaf367c4f97a989
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7abd2d7bbafa11f84e45b3fff7bd865618bd3617e6aaa9eed562fa233b12d165
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7d94e2c346f15418051786ffb1ace2c2027613a2b353615f04d26351d43c7474
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8597354b9e1b46852145de2bddf0737ecf7218937a4289f009c5006dc378cf75
85f7051d6ab6a54c97816eee0ad92c1ccdb9b5ffdd10256feb1433b45a192a5c
886abc149c92bbdebfc7755494a79d63b1725b53157259a0e9777df45f9b1d33
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
9052b690dbc0d96645f48cd2dcdea9bad85f6c55e125a9a4546f9876f9cf9f2d
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
98379332df0663f1223930bc4ea5374375509e554817b0d02ec27513af578425
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
9a3d1f5824ad4bd991a67acab64088920e43d25545ca6b4cb78736dc35b696a3
9b2dc2a6592abd91e0dee577ef85461138e643d96bf3f3756f7c6d856d8d5e8b
9bcdb94ad74931ea092ec31ed6aa7b1d7addd5cf819e8d374cd57883db25204a
9e0467a581ca75291a318f230502cb619e0f557f9e1117b2dd4658790473c8b9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d4f7cf2a6e44aee6bfea6f308a1a988910cd648860875df7d94502a34de362
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad65bef6f6b191511df5df1bbe040015b0f1bcfc8c1ef81a3af9d34637607145
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
b26b7b088a5b8b7965e25cca1aed06839156d86321803fa7ecaaf43111e090b6
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b759dcb812df0caaa1b5a8d4b4d86a8f6f41f4b4f4c53589f54cf4d15bc82124
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
bdea8449136cfa147076a60368e97f6f6a1ede917abb3350a778bc15c8180431
bec893b6d75290029eeab0c973721e66bce1e30ed40d68543f83bd03e0cbe086
c1bbc7f21571ec0ff24b408dcfb5c9a930e97ea58b5915225b9cc9d55f74fc6a
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
c868ebeb22a6d2945834c14da4641969a62e35a6cfa434a974339df068324b6e
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
cd5cf299995ac55b41916bbb525fb0cd013a50c617a00a5a0ef339f0fac38d65
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
cdf1e2dda0541ef6e400a432122ca5f69e0458f61838d9b62a2fd9f50112b36d
cdf5307b9f947c4adf8f297b2d3a0a09b61824c693559519da53462a7cc868b4
ce9c18a953a2eeb6d5efef7d4c04f4d73b055d3789152cbf42bd1b4dfd7e167b
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d16927d37f8e26f8565d8f37936c1cac3ae49299c69cfe76f84baf43677c3ec4
d5a3530bf163b8582765b6e0fe0cefecf12bc324a3382b3c5d8f732967471fa8
d8d41783702d7bb7a7a9c548b151903859eb90a32d29eeaa3487a7937611a27f
da81da6ef07b4b9f77aead41e219318e9e23007844d896bcfb9d59439615e92a
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
de1b63b04b142bb4eef4fd7311fc5b56fe61563db26d21bc69b2f7c42fcdd994
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
e028422c645a6cd5d1130e2740c4cd5e434881e00a29c2ccec6337baddf402d1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e9e3652349e81228cb2c0309b3e6a9f23da99f571017f01a984da348ddb4a257
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f68c8fee11a5a8f56eafe7012b4ecace7fdc7c0dafc9b629ff27a897d66bd2bb
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678