www.sentinelone.com Open in urlscan Pro
104.26.2.18 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cvsoci.al/h1NNd04O
Effective URL:
https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Submission: On October 18 via api (October 18th 2024, 10:40:59 am UTC) from IN — Scanned from GB

Summary HTTP 114 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 44 IPs in 6 countries across 36 domains to perform 114 HTTP transactions. The main IP is 104.26.2.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 186213.
TLS certificate: Issued by E6 on September 1st 2024. Valid for: 3 months.

This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	18.245.46.53 18.245.46.53	16509 (AMAZON-02) (AMAZON-02)
2	51.11.20.152 51.11.20.152	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
17	104.26.2.18 104.26.2.18	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700::68... 2606:4700::6812:562a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	34.49.80.229 34.49.80.229	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
7	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.17.5 104.18.17.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
6	2606:4700::68... 2606:4700::6810:a091	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2013	15169 (GOOGLE) (GOOGLE)
4	2620:1ec:33:3... 2620:1ec:33:3::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.239.50.10 18.239.50.10	16509 (AMAZON-02) (AMAZON-02)
2	104.102.43.106 104.102.43.106	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a99	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	162.159.153.247 162.159.153.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1d::9b	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
2	2606:4700:303... 2606:4700:3037::6815:2d74	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	3.127.102.30 3.127.102.30	16509 (AMAZON-02) (AMAZON-02)
1	18.245.46.22 18.245.46.22	16509 (AMAZON-02) (AMAZON-02)
2	2620:1ec:29:1... 2620:1ec:29:1::72	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.89.210.141 185.89.210.141	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:206... 2600:9000:206f:b800:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE)
1	18.66.102.127 18.66.102.127	16509 (AMAZON-02) (AMAZON-02)
1 2	34.248.126.255 34.248.126.255	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700:303... 2606:4700:3031::ac43:d595	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	104.18.16.5 104.18.16.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	20.231.53.73 20.231.53.73	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	142.250.186.162 142.250.186.162	() ()
1 3	142.250.184.230 142.250.184.230	() ()
114	44

1 18.245.46.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-53.fra56.r.cloudfront.net

cvsoci.al	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.11.20.152 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

secure.intelligence-enterprise.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.26.2.18 (None, )

ASN13335 (CLOUDFLARENET, US)

www.sentinelone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:562a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.49.80.229 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 229.80.49.34.bc.googleusercontent.com

js.knock-ai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.sentinelone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.17.5 (None, )

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:a091 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ca.knock-ai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:33:3::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.50.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-50-10.ams58.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.102.43.106 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-43-106.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a99 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.159.153.247 (None, )

ASN13335 (CLOUDFLARENET, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1d::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::6815:2d74 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.calibermind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.127.102.30 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-22.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:29:1::72 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.141 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:b800:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-127.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.248.126.255 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-126-255.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:d595 (United States)

ASN13335 (CLOUDFLARENET, US)

e.calibermind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

327-mnm-087.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.16.5 (None, )

ASN13335 (CLOUDFLARENET, US)

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.231.53.73 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

q.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (None, )

ASN- ()

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.230 (None, ) 1 redirects

ASN- ()

13115870.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	sentinelone.com www.sentinelone.com — Cisco Umbrella Rank: 186213 go.sentinelone.com — Cisco Umbrella Rank: 315182	817 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	191 KB
10	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 136 td.doubleclick.net — Cisco Umbrella Rank: 192 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 13115870.fls.doubleclick.net ad.doubleclick.net	4 KB
8	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579	11 KB
6	linkedin.com 2 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	3 KB
6	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 5396 onesignal.com — Cisco Umbrella Rank: 1637 img.onesignal.com — Cisco Umbrella Rank: 9324	90 KB
5	clarity.ms www.clarity.ms — Cisco Umbrella Rank: 634 q.clarity.ms — Cisco Umbrella Rank: 6903	29 KB
5	knock-ai.com js.knock-ai.com — Cisco Umbrella Rank: 395209 ca.knock-ai.com — Cisco Umbrella Rank: 416223	10 KB
4	bing.com bat.bing.com — Cisco Umbrella Rank: 348	16 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	402 KB
3	google.co.uk www.google.co.uk — Cisco Umbrella Rank: 5087	191 B
3	calibermind.com cdn.calibermind.com — Cisco Umbrella Rank: 58783 e.calibermind.com — Cisco Umbrella Rank: 57571	63 KB
3	google.com 1 redirects region1.analytics.google.com — Cisco Umbrella Rank: 4401 www.google.com — Cisco Umbrella Rank: 3	88 B
2	bidr.io 1 redirects match.prod.bidr.io — Cisco Umbrella Rank: 598	407 B
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 479	2 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 6617 q.quora.com — Cisco Umbrella Rank: 5041	15 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	7 KB
2	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 8945 tag.demandbase.com — Cisco Umbrella Rank: 5931	34 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 77	13 KB
2	qualified.com js.qualified.com — Cisco Umbrella Rank: 16970 app.qualified.com — Cisco Umbrella Rank: 16988	242 KB
2	intelligence-enterprise.com secure.intelligence-enterprise.com — Cisco Umbrella Rank: 209328	12 KB
1	googleadservices.com www.googleadservices.com	3 KB
1	mktoresp.com 327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 689213	318 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	722 B
1	t.co t.co — Cisco Umbrella Rank: 859	630 B
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 812	98 B
1	company-target.com api.company-target.com — Cisco Umbrella Rank: 4087	512 B
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 18180	279 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 16506	284 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	314 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412	30 KB
1	cvsoci.al cvsoci.al	3 KB
0	abrankings.com Failed cdn.abrankings.com Failed
0	liadm.com Failed idx.liadm.com Failed
114	36

	Domain	Requested by
17	www.sentinelone.com	cvsoci.al www.sentinelone.com
11	cdn.cookielaw.org	www.sentinelone.com cdn.cookielaw.org
8	tags.srv.stackadapt.com	cvsoci.al www.sentinelone.com tags.srv.stackadapt.com
7	go.sentinelone.com	www.sentinelone.com go.sentinelone.com
4	px.ads.linkedin.com	2 redirects snap.licdn.com
4	td.doubleclick.net	www.googletagmanager.com
4	bat.bing.com	www.googletagmanager.com bat.bing.com www.sentinelone.com
4	www.googletagmanager.com	www.sentinelone.com www.googletagmanager.com
3	q.clarity.ms	www.clarity.ms
3	onesignal.com	cdn.onesignal.com
3	www.google.co.uk	www.sentinelone.com
3	js.knock-ai.com	www.sentinelone.com js.knock-ai.com
2	13115870.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.google.com	1 redirects www.sentinelone.com
2	px4.ads.linkedin.com	www.sentinelone.com
2	match.prod.bidr.io	1 redirects www.sentinelone.com
2	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
2	secure.adnxs.com	2 redirects
2	www.clarity.ms	cvsoci.al www.clarity.ms
2	cdn.calibermind.com	cvsoci.al www.googletagmanager.com
2	munchkin.marketo.net	cvsoci.al munchkin.marketo.net
2	ca.knock-ai.com	js.knock-ai.com
2	www.youtube.com	www.sentinelone.com www.youtube.com
2	cdn.onesignal.com	www.sentinelone.com cdn.onesignal.com
2	secure.intelligence-enterprise.com	cvsoci.al secure.intelligence-enterprise.com
1	ad.doubleclick.net
1	www.googleadservices.com	www.googletagmanager.com
1	img.onesignal.com	www.sentinelone.com
1	app.qualified.com	js.qualified.com
1	327-mnm-087.mktoresp.com	munchkin.marketo.net
1	e.calibermind.com	cdn.calibermind.com
1	analytics.twitter.com	www.sentinelone.com
1	t.co	www.sentinelone.com
1	q.quora.com	www.sentinelone.com
1	id.rlcdn.com	www.sentinelone.com
1	api.company-target.com	scripts.demandbase.com
1	attr.ml-api.io	www.sentinelone.com
1	s.ml-attr.com	1 redirects
1	tag.demandbase.com	cvsoci.al
1	static.ads-twitter.com	cvsoci.al
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	a.quora.com	cvsoci.al
1	snap.licdn.com	cvsoci.al
1	scripts.demandbase.com	cvsoci.al
1	geolocation.onetrust.com	cdn.cookielaw.org
1	js.qualified.com	www.sentinelone.com
1	ajax.googleapis.com	www.sentinelone.com
1	cvsoci.al
0	cdn.abrankings.com Failed	www.googletagmanager.com
0	idx.liadm.com Failed	secure.intelligence-enterprise.com
114	51

This site contains links to these domains. Also see Links.

Domain
jp.sentinelone.com
de.sentinelone.com
es.sentinelone.com
fr.sentinelone.com
it.sentinelone.com
nl.sentinelone.com
kr.sentinelone.com
community.sentinelone.com
partners.sentinelone.com
investors.sentinelone.com
www.dataset.com
twitter.com
www.facebook.com
www.linkedin.com
reddit.com
www.darkreading.com
www.ic3.gov
www.uptycs.com
www.virustotal.com
goo.gl
policies.google.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
cvsoci.al Amazon RSA 2048 M03	`2024-10-08` - `2025-11-06`	a year	crt.sh
secure.norm0care.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-24` - `2025-08-05`	a year	crt.sh
sentinelone.com E6	`2024-09-01` - `2024-11-30`	3 months	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
js.knock-ai.com WR3	`2024-09-04` - `2024-12-03`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
go.sentinelone.com E6	`2024-09-15` - `2024-12-14`	3 months	crt.sh
qualified.com WE1	`2024-09-04` - `2024-12-03`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.onesignal.com WE1	`2024-09-02` - `2024-12-01`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
*.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
ca.knock-ai.com WR3	`2024-09-14` - `2024-12-13`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
quora.com WR1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
calibermind.com WE1	`2024-10-10` - `2025-01-08`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2024-08-09` - `2025-09-07`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
*.google.co.uk WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
onesignal.com WE1	`2024-09-02` - `2024-12-01`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-19` - `2025-08-18`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
*.googleadservices.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Frame ID: 960AC3F0E11CA009601DA53189B33AF8
Requests: 110 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-KJPGLC9EVP&gacid=1177186213.1729248049&gtm=45je4ah0v889850326za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101836706&z=989166301
Frame ID: 114BDBB67E45C25062AF505B9EBCC606
Requests: 1 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: 798FACFF591EE31AA665E95767F0D4B7
Requests: 2 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/970186784?random=1729248049707&cv=11&fst=1729248049707&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 428D9905B4635AA5AC9AB6DABCA21E9E
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/ZQoyHXFTqngPcfcB/messenger?uuid=7c82d8ec-b481-4c8c-8c5a-398fc6d10aed
Frame ID: F7E60F3B41F8D050B2788B8EF190DBB1
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/970186784?random=1729248056678&cv=11&fst=1729248056678&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&ct_cookie_present=0
Frame ID: 5C71A7825203C00104AB6AB6EA4AD2EF
Requests: 1 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F
Frame ID: A1358B37C83C8172C45A65224929BC3B
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F
Frame ID: CE1514A53E0A927D89908539FC76025A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dark Angels | ESXi Ransomware Borrows Code & Victimology From RagnarLocker

Page URL History Show full URLs

http://cvsoci.al/h1NNd04O HTTP 307
https://cvsoci.al/h1NNd04O Page URL
https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

114
Requests

94 %
HTTPS

44 %
IPv6

36
Domains

51
Subdomains

44
IPs

6
Countries

2025 kB
Transfer

6297 kB
Size

46
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://jp.sentinelone.com/
Title: 日本語

Search URL Search Domain Scan URL

URL: https://de.sentinelone.com/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://es.sentinelone.com/
Title: Español

Search URL Search Domain Scan URL

URL: https://fr.sentinelone.com/
Title: Français

Search URL Search Domain Scan URL

URL: https://it.sentinelone.com/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://nl.sentinelone.com/
Title: Dutch

Search URL Search Domain Scan URL

URL: https://kr.sentinelone.com/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://community.sentinelone.com/
Title: SentinelOne Community Community Login

Search URL Search Domain Scan URL

URL: https://partners.sentinelone.com/English/
Title: Channel Partners Deliver the Right Solutions, Together

Search URL Search Domain Scan URL

URL: https://investors.sentinelone.com/overview/default.aspx
Title: Investor Relations Financial Information & Events

Search URL Search Domain Scan URL

URL: https://www.dataset.com/
Title: DataSet The Live Data Platform

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/&text=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Search URL Search Domain Scan URL

URL: http://reddit.com/submit?url=https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Search URL Search Domain Scan URL

URL: https://www.darkreading.com/ics-ot/johnson-controls-international-hit-with-massive-ransomware-attack
Title: attack

Search URL Search Domain Scan URL

URL: https://twitter.com/MalGamy12/status/1706989619818954837
Title: binary

Search URL Search Domain Scan URL

URL: https://www.ic3.gov/Media/News/2022/220307.pdf
Title: FBI

Search URL Search Domain Scan URL

URL: https://www.uptycs.com/blog/another-ransomware-for-linux-likely-in-development
Title: observed

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836/community
Title: comments

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/2886771/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/SentinelOne
Title: Twitter

Search URL Search Domain Scan URL

URL: https://goo.gl/e5C9f4
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SentinelOne
Title: Facebook

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: Google Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SentinelOne/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sentinelone/

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cvsoci.al/h1NNd04O HTTP 307
https://cvsoci.al/h1NNd04O Page URL
https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cvsoci.al/h1NNd04O HTTP 307
https://cvsoci.al/h1NNd04O

Request Chain 63

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6437770863881823437

Request Chain 76

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1

Request Chain 82

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&e_ipv6=AQLTi9g4bu4BaQAAAZKfNzyLDg-f7SBK_BTKmhezM1LqOpdDmoF9DjlcMC9zxkAPs5LsJtBlnw

Request Chain 111

https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F HTTP 302
https://13115870.fls.doubleclick.net/activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F

Request Chain 113

https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQIWEkd5ZgmRqwAAAZKfN1aNf-rKMHPE9l5jW3Fe8krbGMGNuyVYhFEJwLnEcbgECwo1lAiW8g

Request Chain 116

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQJKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaJ4aP6A2rd6uq94enryEQjez924FTIWw5Q&pscrd=IhMIwOu0gd-XiQMVA46DBx1K1DkpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkh1VG9SYjBpZ29samdRTUdSd190STVFQ2lRTGV3cVlUTGlNM1F4UUV5YzUyV05ydkhBcUJJdw HTTP 302
https://www.google.com/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQJKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIwOu0gd-XiQMVA46DBx1K1DkpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkh1VG9SYjBpZ29samdRTUdSd190STVFQ2lRTGV3cVlUTGlNM1F4UUV5YzUyV05ydkhBcUJJdw&is_vtc=1&cid=CAQSKQDpaXnf247U71v2bdc-fpbfkO3idJBcWVmmhpbgbw0y3-uwQIH12LoQ&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaIQES4G6PQ6qBDTNzzJpa3rmC_wi84bfUw&random=3351001383 HTTP 302
https://www.google.co.uk/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQJKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIwOu0gd-XiQMVA46DBx1K1DkpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkh1VG9SYjBpZ29samdRTUdSd190STVFQ2lRTGV3cVlUTGlNM1F4UUV5YzUyV05ydkhBcUJJdw&is_vtc=1&cid=CAQSKQDpaXnf247U71v2bdc-fpbfkO3idJBcWVmmhpbgbw0y3-uwQIH12LoQ&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaIQES4G6PQ6qBDTNzzJpa3rmC_wi84bfUw&random=3351001383&ipr=y

114 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

h1NNd04O Show response
cvsoci.al/
Redirect Chain

http://cvsoci.al/h1NNd04O
https://cvsoci.al/h1NNd04O

2 KB
3 KB

1753ms
474ms

Document
text/html

18.245.46.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cvsoci.al/h1NNd04O
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-53.fra56.r.cloudfront.net
Software: /
Resource Hash: 86089969fd2991a47d6a7a94ca1241c2ef4855f782829630b5dfea0b5ee64a8a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 2509
Content-Type: text/html
Date: Fri, 18 Oct 2024 10:40:44 GMT
Via: 1.1 a4233498d2bd44dbd411d60d86f8334e.cloudfront.net (CloudFront), 1.1 08144b62d8ba59c510ae7682981f36c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: egSs7SkTMbJoC_Ydm0IIckL3Zs2hhrp7EO5wk9B9Rj9wPXphOv1rEg==
X-Amz-Cf-Pop: FRA60-P2 FRA56-P9
X-Amzn-Trace-Id: Root=1-67123b2c-2240de746246c4447b29adda
X-Cache: Miss from cloudfront
x-amz-apigw-id: f14u-EWUIAMErlg=
x-amzn-RequestId: 18cb00c4-0276-44ac-b459-c14f5ad5d9b4

Redirect headers

Location: https://cvsoci.al/h1NNd04O
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK 59121.js Show response
secure.intelligence-enterprise.com/js/ 25 KB
12 KB 463ms
50ms Script
text/javascript 51.11.20.152
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.intelligence-enterprise.com/js/59121.js
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.11.20.152 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0a0b4e344aff3f641aad12b4df8e0964ac745739e99a6cfe7eddcd1b97f607d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cvsoci.al/

Response headers

Transfer-Encoding: chunked
Cache-Control: public, max-age=86400
Content-Encoding: br
Connection: keep-alive
Request-Context: appId=cid-v1:abe8a76f-f1a2-4b2e-9017-0ea36ffb5c20
Date: Fri, 18 Oct 2024 10:40:45 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H/1.1 200
OK Capture.aspx
secure.intelligence-enterprise.com/Track/ 0
184 B 44ms
44ms Script
text/plain 51.11.20.152
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.intelligence-enterprise.com/Track/Capture.aspx?retType=js&trk_jshv=1&trk_uid=&trk_user=59121&trk_sw=1600&trk_sh=1200&trk_ref=&trk_tit=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&trk_loc=https%3A%2F%2Fcvsoci.al%2Fh1NNd04O&trk_agn=Netscape&trk_agv=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36&trk_dom=cvsoci.al&trk_cookie=NA&trk_culid=01JAFKEA2AQTPW9TFA9BY9QW6F
Requested by: Host: secure.intelligence-enterprise.com
URL: https://secure.intelligence-enterprise.com/js/59121.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.11.20.152 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cvsoci.al/

Response headers

Request-Context: appId=cid-v1:abe8a76f-f1a2-4b2e-9017-0ea36ffb5c20
Content-Length: 0
Date: Fri, 18 Oct 2024 10:40:45 GMT
Connection: keep-alive
Server: Kestrel

GET any
idx.liadm.com/idex/unknown/ 0
0

GET
H2 200 Primary Request / Show response
www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/ 359 KB
114 KB 578ms
90ms Document
text/html 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Requested by

Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a2aa135193fef82afd48f26d5aefcbb09ffb183629526b9181cdf064d8b9b11

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://.cloudfront.net/ https://.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://.googleapis.com .google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cvsoci.al/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=60
cf-cache-status: EXPIRED
cf-ray: 8d47e97dc860413c-LHR
content-encoding: br
content-security-policy: object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 10:40:45 GMT
last-modified: Fri, 18 Oct 2024 10:40:45 GMT
link: <https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/posts/85242>; rel="alternate"; title="JSON"; type="application/json", <https://www.sentinelone.com/?p=85242>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6L75UhFn3KUtAv1PrC24UQSSsxlUIE%2FknBwXzvnBGbA9gX5rJCYxpTQthQFfdFpReOfRpM5G9Z0S8ysMguWaMzt%2Bo2ThPdW8WsuN12zC84ERdYdaNGUnYU%2BR2nfXGlrx%2BQVRl0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT, MISS, MISS
x-cache-hits: 3, 0, 0, 0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-l45c8
x-served-by: cache-chi-klot8100034-CHI, cache-lcy-eglc8600056-LCY, cache-lcy-eglc8600032-LCY, cache-lcy-eglc8600032-LCY
x-styx-req-id: 3433b6f5-8cef-11ef-bb16-c2826556d9e4
x-timer: S1729248046.758383,VS0,VE8
x-xss-protection: 1; mode=block

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 471ms
214ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: uiXk8gw/ehyoMvZ3GeQiaQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCEDAD087F157F
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 49068
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 06:37:40 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ca0be203-601e-00f9-010e-20596a000000
cf-ray: 8d47e980ce03776e-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7214
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 97ee7348-9176-4a4b-9af2-40711264546b.js Show response
js.knock-ai.com/ 33 KB
9 KB 235ms
55ms Script
application/javascript 34.49.80.229
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 229.80.49.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=d/mdHQ==, md5=5kJnp5LzzWIIqvCbzwi4ZA==
etag: "e64267a792f3cd6208aaf09bcf08b864"
age: 2841
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 8988
date: Fri, 18 Oct 2024 09:53:25 GMT
last-modified: Tue, 01 Oct 2024 09:16:01 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY0zb4U0tXWtW3Y428pKCTYCdu44zjKFQzHoMB1Xrvu_ted7EuRdvyOyw1aNbhjaPx_F6RDgYms6Cg
access-control-allow-headers: *
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727774161474099
content-length: 8988
server: UploadServer

GET
H2 200 style-default.min.css
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/ 488 KB
83 KB 83ms
81ms Stylesheet
text/css 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3744cdf7226ef40a651e4054a8589854e62cb4da5e5812c9013f23c11700813d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-5dxdh
content-encoding: gzip
cf-cache-status: EXPIRED
etag: W/"6711b1e9-7a062"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrYka7JBicpjMaeBBWApt6jNGOWsXQvgKZ1i3Zyc4Olfq6PUGtYAA7zo2Gj3wTcETWnVsp1%2FEbK5%2FefPiHZJXQWNpCplUNN9vj4AIveWNNmThUGMZohjWvpnmHzmEkAFYK62uKI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:15 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:45 GMT
content-type: text/css
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 20, 13, 0, 0
x-served-by: cache-chi-klot8100138-CHI, cache-lcy-eglc8600048-LCY, cache-lcy-eglc8600077-LCY, cache-lcy-eglc8600077-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248046.926140,VS0,VE7
x-styx-req-id: eaff5a6d-8ceb-11ef-b872-c25dfe06738a
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e97ed9de413c-LHR
accept-ranges: bytes
content-length: 84450
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.0/ 85 KB
30 KB 478ms
183ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.0/jquery.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: gzip
age: 298608
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Tue, 14 Oct 2025 23:43:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 14 Oct 2024 23:43:58 GMT
last-modified: Wed, 17 May 2023 18:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30433
x-xss-protection: 0
server: sffe

GET
H2 200 forms2.min.js Show response
go.sentinelone.com/js/forms2/js/ 199 KB
67 KB 674ms
224ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/js/forms2.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "5c01fe-31b91-62370c030d900"
age: 1817
x-content-type-options: nosniff
cf-ray: 8d47e981d948634d-LHR
expires: Fri, 18 Oct 2024 14:40:46 GMT
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/x-javascript
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 qualified.js Show response
js.qualified.com/ 1 MB
242 KB 233ms
60ms Script
text/javascript 104.18.17.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=ZQoyHXFTqngPcfcB

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

636c5d0f0e5121033707d78679623fd0f40b1d4494fcaaedbeb4b80aaff088de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-request-id: ed36de0e-7c86-416f-905c-b056a1bfdf4c
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6b3397e405f017aee37ef9ac1c05bca6"
age: 7285
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-cache: miss
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: text/javascript; charset=utf-8
vary: Accept,Accept-Encoding
x-runtime: 0.055976
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400
x-envoy-upstream-service-time: 82
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8d47e98488cc4889-LHR
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 327 KB
107 KB 278ms
109ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

13eaa3045195fe11283090773f6c401eaa7345eba2054cb76b86ad3fca0c1e5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 10:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109453
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 email-decode.min.js Show response
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 48ms
47ms Script
application/javascript 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"670fb497-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0PB8ScQTnf1dMosSGTZsOfMaZd0tBPRXkOJchyz4j0%2FEmFubvqlmpshoeuXPeKguHn%2BUoLTKPdieOPApExdtBeEQvA6s6D4%2FHB7XFz%2FxX5mTfY5p%2FecNaerbGK8YH8UOPMYRkwk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d47e97ed9df413c-LHR
expires: Sun, 20 Oct 2024 10:40:45 GMT
date: Fri, 18 Oct 2024 10:40:45 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 12:41:59 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 Dark-Angels-ESXi-Ransomware-Borrows-Code-Victimology-From-RagnarLocker.jpg
www.sentinelone.com/wp-content/uploads/2023/10/ 103 KB
104 KB 94ms
94ms Image
image/webp 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/uploads/2023/10/Dark-Angels-ESXi-Ransomware-Borrows-Code-Victimology-From-RagnarLocker.jpg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe1d647582e0c5e0a7d415fc21d503b39d8aa64750baa9f6a6caca0c5fb9532

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-8654c4f96b-nj8bw
fastly-io-info: ifsz=401401 idim=1200x628 ifmt=jpeg ofsz=105174 odim=1200x628 ofmt=webp
cf-cache-status: REVALIDATED
etag: "fdej7YQhrstxQSpXftxiAN9Q6LasZZ0bZncI0KSvPMs"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dhEqnAaSvSuE%2FuD7CnRtULBZC8G%2B8wib4CG%2FVz6VOzmE4Q5EWVB4iWWjGRfiAaefIoLTaoOWpHwiRENIdmjsia%2BbkAupX%2FuCXRbD5SGv85kCa7aP9f4FkX%2BpSqErV%2FugJk2tAA4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 09 Oct 2025 10:56:48 GMT
x-cache: MISS, HIT, HIT, MISS
date: Fri, 18 Oct 2024 10:40:45 GMT
content-type: image/webp
vary: Accept, Accept-Encoding
x-cache-hits: 0, 1, 0, 0
x-served-by: cache-ams21038-AMS, cache-ams21045-AMS, cache-lcy-eglc8600036-LCY, cache-lcy-eglc8600036-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
fastly-stats: io=1
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729227803.548055,VS0,VE3
x-styx-req-id: 0463b006-8564-11ef-9999-765fb9a0267a
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e97ed9e1413c-LHR
accept-ranges: bytes
content-length: 105174
fastly-io-served-by: vpop-etou8240197
server: cloudflare

GET
H2 200 DarkAngels_1.jpg
www.sentinelone.com/wp-content/uploads/2023/10/ 19 KB
20 KB 74ms
73ms Image
image/webp 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/uploads/2023/10/DarkAngels_1.jpg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac52eaa4abea0750cf1cb2adbd1ea79c4aa810ad824d519010934de5f09ac2ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5b56695d4d-5gmlh
fastly-io-info: ifsz=35921 idim=499x167 ifmt=jpeg ofsz=19478 odim=499x167 ofmt=webp
cf-cache-status: REVALIDATED
etag: "CJtPdgThXaxW40lcW5RUlTYQnWzDyp0+Al8wnkwM2fA"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eV0s1io8IysJRUK7QHQ073wDXHO3S8yS8bu4qEBmttL4Oty4CqqK8kTPp6JFCXzspNQEFRRtYngGoIfIYvsmtVhwVlIB7dPlD26P7BxSF60Jg5M8MypHipIsaHkrNF%2BSfYA1MZQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 11 Oct 2025 12:42:56 GMT
x-cache: HIT, MISS, MISS, MISS
date: Fri, 18 Oct 2024 10:40:45 GMT
content-type: image/webp
vary: Accept, Accept-Encoding
x-cache-hits: 0, 0, 0, 0
x-served-by: cache-ams21078-AMS, cache-ams2100108-AMS, cache-lcy-eglc8600065-LCY, cache-lcy-eglc8600065-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
fastly-stats: io=1
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729227803.531952,VS0,VE48
x-styx-req-id: 2ce57726-8705-11ef-bbc4-a2db7fca53cd
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e97ed9e4413c-LHR
accept-ranges: bytes
content-length: 19478
fastly-io-served-by: vpop-etou8240199
server: cloudflare

GET
H2 200 DarkAngels_3.jpg
www.sentinelone.com/wp-content/uploads/2023/10/ 17 KB
18 KB 87ms
86ms Image
image/webp 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/uploads/2023/10/DarkAngels_3.jpg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c4ecef61998c68ed320df94e9f5b581df489b288894dd3769a293e5f0bffca3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-rm7m4
fastly-io-info: ifsz=36524 idim=479x256 ifmt=jpeg ofsz=17400 odim=479x256 ofmt=webp
cf-cache-status: REVALIDATED
etag: "5rXevRdfi5Yv9oZ0Nufz+co+fZPmdHzZR1pvDtRPuTM"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=15ewJelfux9eo9HN9Mdl60rHybK3JjRrit%2Baa0IUgS4cVOUSdIAZdNZPLm6akED%2Fr9npZ2myo1tz3UGl1unXcfzl5QmP1ZkIg7Aj0ukkZRj3RRBmQH3jRfQc12r5WB0zLqRIG80%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 05:03:22 GMT
x-cache: MISS, MISS, MISS, MISS
date: Fri, 18 Oct 2024 10:40:45 GMT
content-type: image/webp
vary: Accept, Accept-Encoding
x-cache-hits: 0, 0, 0, 0
x-served-by: cache-ams21058-AMS, cache-ams2100128-AMS, cache-lcy-eglc8600075-LCY, cache-lcy-eglc8600075-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
fastly-stats: io=1
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729227803.530309,VS0,VE401
x-styx-req-id: 4c99a650-8d0e-11ef-b2e0-26381e4c950b
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e97ed9e6413c-LHR
accept-ranges: bytes
content-length: 17400
fastly-io-served-by: vpop-etou8240198
server: cloudflare

GET
H2 200 ABCWhytePlusVariable.woff2
www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ 242 KB
243 KB 126ms
126ms Font
font/woff2 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.sentinelone.com
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-qdkph
cf-cache-status: REVALIDATED
etag: "6711b1e9-3c6a4"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pWZ%2BYivzsMdbANjIo0Jkh6bwHJxQfaau2I3RNSWoGMi0Lsa2k12cePAtbR52C7iHQkneHDma82CLJBIc7twNGHoUk%2Fr38BAvufp5ySYZH8cHsXWG7SoCkbMmT5YS8awsyjl8N%2F0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:15 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: font/woff2
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 6, 0, 0, 0
x-served-by: cache-chi-klot8100054-CHI, cache-lcy-eglc8600090-LCY, cache-lcy-eglc8600065-LCY, cache-lcy-eglc8600065-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248041.567641,VS0,VE8
x-styx-req-id: eaff3cf6-8ceb-11ef-a176-5a8882821802
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e980dc89413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 247460
server: cloudflare

GET
H2 200 clipboard.min.js Show response
www.sentinelone.com/wp-includes/js/ 9 KB
4 KB 73ms
72ms Script
application/x-javascript 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-vvrfc
content-encoding: gzip
cf-cache-status: EXPIRED
etag: W/"6711b1ea-2331"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0IEVO51u9%2FbsNJ4h0GSBcS8Z8B24T0WlcRCr67kZKrWXJHoGnYlabnGUHUx6%2FJawuj7luCBcBKllTbhTi7azuWD%2FubIuUTYmBB5znRjbBYLBrLPHKO6yMIkFZzVVKBO7CBHBCAY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:36 GMT
x-cache: MISS, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/x-javascript
last-modified: Fri, 18 Oct 2024 00:55:06 GMT
vary: Accept-Encoding
x-cache-hits: 0, 88, 0, 0
x-served-by: cache-chi-kigq8000137-CHI, cache-lcy-eglc8600045-LCY, cache-lcy-eglc8600099-LCY, cache-lcy-eglc8600099-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248046.234025,VS0,VE8
x-styx-req-id: f6fcab72-8ceb-11ef-97b0-2ea2d7878a92
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e980dc81413c-LHR
accept-ranges: bytes
content-length: 3466
server: cloudflare

GET
H2 200 global.min.js Show response
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/ 29 KB
11 KB 74ms
73ms Script
application/x-javascript 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212904

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-rm7m4
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"6711b1e9-739c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D44%2FddhBTt3Q46h9x9jXHFxp9tVVvnnC8RkR6xQSiJh%2FChOfbUYV4fGC42KUoqMrT5x%2FGBWjPYeoIDtAGVwGDu48EbFu1hFGfh%2BJh8EvVQmBbFf7qHPKZk75j4REW2Dt9ifhi2k%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:55:35 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/x-javascript
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 1, 84, 0, 0
x-served-by: cache-chi-klot8100106-CHI, cache-lcy-eglc8600027-LCY, cache-lcy-eglc8600053-LCY, cache-lcy-eglc8600053-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248041.724041,VS0,VE6
x-styx-req-id: af1163d7-8ceb-11ef-b2e0-26381e4c950b
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e980dc87413c-LHR
accept-ranges: bytes
content-length: 10668
server: cloudflare

GET
H3 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 191ms
55ms Script
application/javascript 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"09282956186c8515ef0d208902803581"
age: 2817
expires: Mon, 21 Oct 2024 10:40:46 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript
vary: Accept-Encoding
access-control-allow-headers: OneSignal-Subscription-Id
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=259200
via: 1.1 google
cf-ray: 8d47e984fb9a79ae-LHR
server: cloudflare

GET
H2 200 02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json Show response
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/ 5 KB
2 KB 342ms
76ms XHR
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: F3zUIq857iGpcyK5PrUpqQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCDF012D7A954A
age: 71846
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 19 Oct 2024 10:40:46 GMT
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/json
last-modified: Fri, 27 Sep 2024 14:32:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 8ba91f3b-601e-00f9-09ea-10596a000000
cf-ray: 8d47e983be3760fe-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1781
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 97ee7348-9176-4a4b-9af2-40711264546b.json Show response
js.knock-ai.com/ 326 B
229 B 33ms
32ms Fetch
application/json 34.49.80.229
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Requested by: Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 229.80.49.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.sentinelone.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding: gzip
x-goog-hash: crc32c=uhxSig==, md5=XQTCayw0uJPhFpszoEnnIg==
etag: "5d04c26b2c34b893e1169b33a049e722"
age: 3558
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 196
date: Fri, 18 Oct 2024 09:41:28 GMT
last-modified: Tue, 01 Oct 2024 09:16:16 GMT
content-type: application/json
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY0CH4gijNysPNEEJXAcxj6OdGqxRinmMyhKhb3Fj4NMuKsAV_FguoqWQqBM3WeErSqWZed5DDaXTg
access-control-allow-headers: *
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727774176677479
content-length: 196
server: UploadServer

OPTIONS
H3 200 97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/ Frame 0
0 364ms
128ms Preflight 34.49.80.229
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 229.80.49.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.sentinelone.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: DELETE,GET,HEAD,POST,PUT
access-control-allow-origin: *
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
date: Fri, 18 Oct 2024 10:40:46 GMT
expires: Fri, 18 Oct 2024 10:40:46 GMT
server: UploadServer
via: 1.1 google
x-guploader-uploadid: AHmUCY0jW406jsDDWFW4BEZsL6etzPN35pzaGczhZiAKv40LaK9SvvA5fK6R_RQpKy1XPuMsT7ZcXGB17w

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 378 KB
119 KB 205ms
79ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fe1b5ee4652156a40232c891663c006c57bb16f4a17558f6c8c2fb3f621fcadf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 18 Oct 2024 10:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 121189
x-xss-protection: 0
server: Google Tag Manager

GET
DATA 200
OK truncated
/ 115 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 115 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 116 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08d80a196fd16e446bb1d5c7e94adf0b719406286686ab3606e0e49a1dc122d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 118 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Type: image/svg+xml

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
314 B 198ms
67ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26e34b9fbbd2ecafe25af980f19ddc63342ffad01477b0fe851ac8c35bfea847

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d47e9851da66555-LHR
access-control-allow-origin: *
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
DATA 200
OK truncated
/ 117 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6bfc62c8e653fb944b2a6937d2822241c304fa49bbe90ede334a582385f47e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Type: image/svg+xml

GET
H2 200 getForm Show response
go.sentinelone.com/index.php/form/ 6 KB
2 KB 102ms
102ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&callback=jQuery3710047443855734374374_1729248046698&_=1729248046699
Requested by: Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 525a80420c078ff1e15f2d844a62b03fef28aac31552b072caf2ee25b7924d89

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cf-ray: 8d47e9845d53634d-LHR
cached: true
content-encoding: gzip
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 getForm Show response
go.sentinelone.com/index.php/form/ 2 KB
1 KB 62ms
61ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2816&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&callback=jQuery3710047443855734374374_1729248046700&_=1729248046701
Requested by: Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fc7239c1df36760b9944d11c0c72096fa3d4cedadab12c885bc606577ebeb6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cf-ray: 8d47e9846d69634d-LHR
cached: true
content-encoding: gzip
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 240ms
86ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1729212904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1fcce91080e0c58b41ddc4bb6e9dad66c72e78802dc59622d8b0a42e5458d3af

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options: nosniff
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires: Fri, 18 Oct 2024 10:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en-GB for more info."
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: base-uri 'self';default-src 'self' https: blob:;font-src https: data:;img-src https: data: android-webview-video-poster:;media-src blob: https:;object-src 'none';report-uri /cspreport/common;script-src 'report-sample' 'nonce-P3ISo4O-kyzSJaG9YOU6MQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';style-src https: 'unsafe-inline'
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 Gartner_Homepage_Banner.png
www.sentinelone.com/wp-content/uploads/2024/09/ 64 KB
65 KB 52ms
52ms Image
image/webp 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/uploads/2024/09/Gartner_Homepage_Banner.png

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d088e735e1df1e3e110bced2732b0ec4be974ae0a72fadfc8be82f726f7c0a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-547989f88d-m9fh4
fastly-io-info: ifsz=81851 idim=1920x40 ifmt=png ofsz=65854 odim=1920x40 ofmt=webp
cf-cache-status: HIT
etag: "K+Dn2OSnHvfFkwcP6UMk/YuLe+iyrXd5o6KGoQ7iF4s"
age: 5
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2FMasTGhjtlCQTEsELsSrMzJXVJOa62e1nXvI04NKY%2FpBQBkKKtFKnO9xloNTfV%2F9leLPdBr%2F81%2BBj3LS2jRvR9J6O3TKENZ38mFNlASkJCRdcRbvGPqHx0UEF6J9XMV3VgMWsg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 15:29:38 GMT
x-cache: MISS, MISS, HIT, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: image/webp
vary: Accept, Accept-Encoding
x-cache-hits: 0, 0, 7, 0
x-served-by: cache-ams2100086-AMS, cache-ams21081-AMS, cache-lcy-eglc8600082-LCY, cache-lcy-eglc8600082-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
fastly-stats: io=1
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729216254.354949,VS0,VE3
x-styx-req-id: fa05c96b-7b52-11ef-b404-b6e21daa1c2f
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e984a953413c-LHR
accept-ranges: bytes
content-length: 65854
fastly-io-served-by: img06-europe-west3
server: cloudflare

GET
H2 200 globe-light.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 729 B
878 B 81ms
80ms Image
image/svg+xml 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/globe-light.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-6q4ll
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6711b1e9-2d9"
age: 5
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FfXb%2BwgVtYtcZSgMsHQJQqRly3yFra4N3iHThHpL9aDZlAfRAa77ZXMqivl391eR2Vrx%2FkFNWKBG46iLrMbiKAmh%2BqzEPjIuxEJgFYOk3A87KJVzWIMSYq9NE09ydhsOrK0Bjg8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:16 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: image/svg+xml
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 8, 98, 0, 0
x-served-by: cache-chi-klot8100143-CHI, cache-lcy-eglc8600062-LCY, cache-lcy-eglc8600094-LCY, cache-lcy-eglc8600094-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248041.373390,VS0,VE7
x-styx-req-id: eb7029e9-8ceb-11ef-9bc4-7e5f30ed31b8
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e984c995413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 295
server: cloudflare

GET
H2 200 navigation-arrow-down-light.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 663 B
925 B 120ms
120ms Image
image/svg+xml 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-down-light.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-l45c8
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6711b1e8-297"
age: 5
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2BCxZbfsuCa2EBl18rICxA8XnxX9h46cQlZON4j2t1rv3rTlDsoaVMPMFECet%2Bu3nmesI3o%2B4%2BwywQb5cNZxnytUTAt4TSm2jK%2BtVdj9G1AGAyOrfZRTN205qBZ9uOStfZZZ55A%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:16 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: image/svg+xml
last-modified: Fri, 18 Oct 2024 00:55:04 GMT
vary: Accept-Encoding
x-cache-hits: 7, 123, 0, 0
x-served-by: cache-chi-klot8100084-CHI, cache-lcy-eglc8600032-LCY, cache-lcy-eglc8600059-LCY, cache-lcy-eglc8600059-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248041.449366,VS0,VE7
x-styx-req-id: eb30287d-8ceb-11ef-bb16-c2826556d9e4
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e984c99c413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 347
server: cloudflare

GET
H2 200 search-icon-white.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 681 B
937 B 88ms
87ms Image
image/svg+xml 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-default.min.css?ver=1729212904

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-rbtlq
content-encoding: gzip
cf-cache-status: EXPIRED
etag: W/"6711b1ea-2a9"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VBw%2FEaRNpS97Va4w8bWKWMDmNd6y%2BGmP7mKSlPG9tgXsZjG5d4goC4%2BiSvXZIivnhuKdtLCmJPFH0DOVqD4%2FDeSqgvk3ub3gtzMyKkp7NInqJeHUui3zimgMj4r5Qo9G6YRVf%2FQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:36 GMT
x-cache: MISS, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: image/svg+xml
last-modified: Fri, 18 Oct 2024 00:55:06 GMT
vary: Accept-Encoding
x-cache-hits: 0, 38, 0, 0
x-served-by: cache-chi-kigq8000141-CHI, cache-lcy-eglc8600038-LCY, cache-lcy-eglc8600092-LCY, cache-lcy-eglc8600092-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248047.943590,VS0,VE7
x-styx-req-id: f70666ea-8ceb-11ef-a0f6-5212f2c0b361
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e9853a32413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 385
server: cloudflare

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/ 457 KB
111 KB 60ms
60ms Script
application/javascript 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: Mq8sWt7aN99kE/VZ97+T8Q==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C88D357E6
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 40085
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:47 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 02:45:02 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ecb31dc5-801e-0052-7f23-208e78000000
cf-ray: 8d47e989cc73776e-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 113760
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 search-icon.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 681 B
936 B 81ms
80ms Image
image/svg+xml 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-5znzn
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6711b1e9-2a9"
age: 4
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nyJadnwWxEM5Lu1stpLrS8y41lpCdW3SpiAmJH2dCPvxHgkyMPWKCy09lgax0jSTQKMNV5vKprhh2cxWRLXXH1dKzMJ5lMQVzj09C2hfFpSuAmvXqSLwnrhOZ68XrOGGrytHPeQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:19 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:47 GMT
content-type: image/svg+xml
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 37, 63, 0, 0
x-served-by: cache-chi-klot8100146-CHI, cache-lcy-eglc8600093-LCY, cache-lcy-eglc8600059-LCY, cache-lcy-eglc8600059-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248043.368282,VS0,VE7
x-styx-req-id: ed0471b4-8ceb-11ef-a181-bea7daf8a07b
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e98a4943413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 385
server: cloudflare

GET
H2 200 header-logo-dark.svg
www.sentinelone.com/wp-content/themes/sentinelone/assets/svg/ 7 KB
3 KB 60ms
60ms Image
image/svg+xml 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/assets/svg/header-logo-dark.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19661b2f8ca108e51a5adafd6d4658cc410934e96162dbe5c41e80d1892606d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5955f47cc7-l45c8
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6711b1e8-1b4b"
age: 4
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2y1vVDsuZK0LV6tioMqJyUwQqEZtx2m75ZMUru1ZILjru1KhQK5QE%2BjswfyLDhwKclxFcV%2F0g821nUwApwkMIcqk8ykjTjtrl3dac%2BV%2BdPk7AhDyfcIgQv6NN5ylzOEG5w2JDzo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:22 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:47 GMT
content-type: image/svg+xml
last-modified: Fri, 18 Oct 2024 00:55:04 GMT
vary: Accept-Encoding
x-cache-hits: 9, 100, 0, 0
x-served-by: cache-chi-kigq8000087-CHI, cache-lcy-eglc8600036-LCY, cache-lcy-eglc8600078-LCY, cache-lcy-eglc8600078-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248043.366845,VS0,VE6
x-styx-req-id: eeb4b3cc-8ceb-11ef-bb16-c2826556d9e4
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e98a494c413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2616
server: cloudflare

GET
H2 200 Threat-Actors-Actively-Exploiting-Progress-WS_FTP-via-Multiple-Attack-Chains-1.jpg
www.sentinelone.com/wp-content/uploads/2023/10/ 75 KB
76 KB 94ms
93ms Image
image/jpeg 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sentinelone.com/wp-content/uploads/2023/10/Threat-Actors-Actively-Exploiting-Progress-WS_FTP-via-Multiple-Attack-Chains-1.jpg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56842851d652201634fe09807384fef1b3855d073f30437f587c8e65808e140b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-b-5b56695d4d-9cdv9
fastly-io-info: ifsz=79835 idim=1200x628 ifmt=jpeg ofsz=79835 odim=1200x628 ofmt=jpeg
cf-cache-status: REVALIDATED
etag: "ki5JPxwvYCsgCcDabeiKryxu6VQq0NRJNzFWdrYvyeU"
cf-bgj: imgq:100,h2pri
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r%2FImmO4YtyY8x%2B3pmud%2Be4IYd32jWZydt6isdwbv8zSMQPvrXAjRsvj7J%2B%2Fv5oEjIjQrEqYJ2x%2Bxq78yIjyEO0ufgY4lrkznRti3WecH7pAAR6Ia4EuohICLplHHkNhxbUlS6cY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 11 Oct 2025 05:22:19 GMT
cf-polished: origSize=79835, status=vary_header_present
x-cache: MISS, MISS, HIT, MISS
date: Fri, 18 Oct 2024 10:40:47 GMT
content-type: image/jpeg
vary: Accept, Accept-Encoding
x-cache-hits: 0, 0, 0, 0
x-served-by: cache-ams21059-AMS, cache-ams2100093-AMS, cache-lcy-eglc8600095-LCY, cache-lcy-eglc8600095-LCY
strict-transport-security: max-age=31536000; includeSubDomains; preload
fastly-stats: io=1
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
fastly-io-warning: Failed to shrink image
x-timer: S1729227803.380581,VS0,VE4
x-styx-req-id: 9ef6a25c-86c7-11ef-9c65-324c479d206c
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e98a494e413c-LHR
accept-ranges: bytes
content-length: 76740
fastly-io-served-by: vpop-etou8240193
server: cloudflare

GET
H2 200 uid Show response
ca.knock-ai.com/client/an/v1/ 50 B
369 B 1708ms
175ms Fetch
text/html 2a00:1450:4001:80f::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ca.knock-ai.com/client/an/v1/uid

Requested by

Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend / Express

Resource Hash

9cac88b67d1b3afa01e752210ac090d4f6d27026c5aac1e4f2e2e17f5f8761c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-request-id: d2b441ec-523f-4f2e-bb06-b231d15aef7c
cache-control: private, max-age=31536000, immutable
etag: a0562808a8e03ad3eadd5ccbb707d768
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 50
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
server: Google Frontend
x-cloud-trace-context: 8cbc2025c7821a907e6aa62006acb04f
x-frame-options: SAMEORIGIN

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 56ms
55ms Script
application/javascript 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"7e91359b46e1da637080a03b759164fa"
age: 559
expires: Mon, 21 Oct 2024 10:40:48 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: application/javascript
vary: Accept-Encoding
access-control-allow-headers: OneSignal-Subscription-Id
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=259200
via: 1.1 google
cf-ray: 8d47e98c3ea279ae-LHR
server: cloudflare

GET
H2 200 forms2.css
go.sentinelone.com/js/forms2/css/ 13 KB
3 KB 55ms
54ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/css/forms2.css

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "15208a8-3437-62370c030d900"
age: 1336
x-content-type-options: nosniff
cf-ray: 8d47e98ecf4a634d-LHR
expires: Fri, 18 Oct 2024 14:40:48 GMT
accept-ranges: bytes
content-length: 2623
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/ 828 B
336 B 111ms
110ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "5c01d7-33c-62370c030d900"
age: 3078
x-content-type-options: nosniff
cf-ray: 8d47e98eff8b634d-LHR
expires: Fri, 18 Oct 2024 14:40:48 GMT
accept-ranges: bytes
content-length: 246
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/e627e516/www-widgetapi.vflset/ 31 KB
10 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/e627e516/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
age: 767
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 10:28:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:28:01 GMT
last-modified: Wed, 16 Oct 2024 04:17:19 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10417
x-xss-protection: 0
server: sffe

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 278 KB
95 KB 67ms
66ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

09130f25567ce37c83f96e186c3301d90baf199cc24003bdfd59eb1d2d44e07a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Fri, 18 Oct 2024 10:40:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 97335
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 1025ms
47ms Script
application/javascript 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B574C3358F5A4092BC54DFF5DD2A2193 Ref B: LON212050719023 Ref C: 2024-10-18T10:40:49Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 d6076494.min.js Show response
scripts.demandbase.com/ 60 KB
17 KB 969ms
49ms Script
application/javascript 18.239.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/d6076494.min.js

Requested by

Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-239-50-10.ams58.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: gzip
x-amz-version-id: zh5pZEN9OJvnC2CgAf9fhsfPsCZz99sW
etag: W/"f1722349926863d8d1925a6aa07f85ce"
age: 241
x-cache: Hit from cloudfront
x-amz-cf-id: B3l71Rc_yLEIn5VhUqVBJS3alrTqGaq_u87qCYXGgjhgTQGj3qcnAQ==
date: Fri, 18 Oct 2024 10:37:08 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 08 Dec 2020 23:26:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 1d14130822f7563ef82bba830d521f72.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: AMS58-P3
server: AmazonS3

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 1020ms
109ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Content-Encoding: gzip
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 729
Date: Fri, 18 Oct 2024 10:40:49 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 974ms
64ms Script
application/javascript 2a02:26f0:3500:10::210:a99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: max-age=55894
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Fri, 18 Oct 2024 10:40:49 GMT
last-modified: Thu, 22 Aug 2024 10:43:55 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 qevents.js Show response
a.quora.com/ 41 KB
15 KB 966ms
61ms Script
text/plain 162.159.153.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.159.153.247 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"87b5ecaafd0e88097cbbb1bbb7695fe9"
x-amz-version-id: jrgqQn59BHyNBJEhUqaibHl1Lk06.AzO
age: 129796
expires: Fri, 18 Oct 2024 14:40:49 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/plain
last-modified: Thu, 28 Mar 2024 17:33:19 GMT
vary: Accept-Encoding
x-amz-id-2: V1KqiLEqgavTxZxeOhRwxks/e9Bwov1/UFMqsrtEEzLmoDSbUpr5Gq/SrBc09Cr251D8a88zvXjr2380vgygWiCKDQGX6cFQNHy8wkgu4h4=
cache-control: public, max-age=14400
x-amz-meta-s3cmd-attrs: md5:87b5ecaafd0e88097cbbb1bbb7695fe9
x-amz-request-id: CHBWA4MHHEB4ZTF0
cf-ray: 8d47e996be84a62a-LHR
server: cloudflare
x-amz-server-side-encryption: AES256

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 870ms
71ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je4ah0v889850326za200&_p=1729248046728&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101686685~101836706&cid=1177186213.1729248049&ul=en-gb&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1729248048&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&dr=https%3A%2F%2Fcvsoci.al%2F&dt=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3701
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.sentinelone.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
557 B 869ms
72ms Ping
text/plain 2a00:1450:400c:c1d::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KJPGLC9EVP&cid=1177186213.1729248049&gtm=45je4ah0v889850326za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533422~101686685~101836706
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.sentinelone.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 114B 0
0 409ms
102ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-KJPGLC9EVP&gacid=1177186213.1729248049&gtm=45je4ah0v889850326za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101836706&z=989166301

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET client.js
cdn.abrankings.com/js/ 0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
80 KB 61ms
60ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-13115870

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d69ca47893b26f772e30164769510f520d5dcd417101216d1df2767bf1ef4c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 10:40:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 10:40:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 81685
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 838ms
73ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Fri, 18 Oct 2024 10:40:49 GMT
x-tw-cdn: FT
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000168-IAD, cache-muc13923-MUC
x-amz-server-side-encryption: AES256

GET
H2 200 a.js Show response
cdn.calibermind.com/ 213 KB
61 KB 819ms
55ms Script
application/javascript 2606:4700:3037::6815:2d74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.calibermind.com/a.js

Requested by

Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"668efd6c-354c2"
age: 66803
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=quFd1HpymEBuAb07hP%2Bq9%2BYiOyxLpqfMqHx8CKz4jZug7JlCkmKPq7o%2BFswN6I8k0gQt1nzbs854w99ph9APmuvLABRPghOQw%2FGB1lU6rxQtl7rkNrvUgtUPaA4l98emXGApc0orfLwNUdYh2ls5DcXy"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/javascript
last-modified: Wed, 10 Jul 2024 21:30:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self'
cache-control: public, max-age=86400, stale-if-error=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d47e996b8708891-LHR
server: cloudflare

GET
H2 200 identifyEmail.latest.js Show response
cdn.calibermind.com/js/ 838 B
1 KB 817ms
55ms Script
application/javascript 2606:4700:3037::6815:2d74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.calibermind.com/js/identifyEmail.latest.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"668efdda-346"
age: 55795
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GXKYtmDFU6m%2F6d%2BPZj2KtlvewjXKFdq6jrbNxt%2BJAnGkFz%2BcVOFpLqkmNR7QVvmvUMD36SXuN9h13RaULsnIsDBgFrUIPkscUCr41DaUFXQxudAn2mpJVEE1zCvCPI0pqsDXCe%2B8%2F3s0B2l4n%2FU9Pbtq"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/javascript
last-modified: Wed, 10 Jul 2024 21:32:10 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self'
cache-control: public, max-age=86400, stale-if-error=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d47e996b86e8891-LHR
server: cloudflare

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
8 KB 193ms
192ms Script
text/javascript 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 53d753ab6a34ff8e9443349b44033b8e116ba3d9815c049f4220f2ac220c5b36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/javascript

GET
H2 200 d16b1fea0b2ed64f.min.js Show response
tag.demandbase.com/ 61 KB
18 KB 410ms
67ms Script
application/javascript 18.245.46.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/d16b1fea0b2ed64f.min.js

Requested by

Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.22 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-22.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: gzip
x-amz-version-id: N2rb5lMV51RwbNUWzMvxWNf3Nzc5EPqh
etag: W/"1745d7ef3444455a72a3f86e4fb2ad07"
age: 2007
x-cache: Hit from cloudfront
x-amz-cf-id: tbMOzjMCuOlketk1iPcDnHHoXXgP2bIAccJNpVrBdKyuTdm18YnRxA==
date: Fri, 18 Oct 2024 10:08:52 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 13:53:58 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 77e414816706879c16a3707f261f0b5a.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 o0e2bgdhqr Show response
www.clarity.ms/tag/ 689 B
1 KB 617ms
279ms Script
application/x-javascript 2620:1ec:29:1::72
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Requested by: Host: cvsoci.al
URL: https://cvsoci.al/h1NNd04O
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::72 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: c973e560f381f97d448c8e8adc173843f60f1922192a1eaaf81a57fd7a5099e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 689
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: application/x-javascript
x-azure-ref: 20241018T104050Z-1844b484f6b8245nbnbx0rpufn00000001wg000000007nsy

GET
H3 200 ga-audiences
www.google.co.uk/ads/ 42 B
63 B 335ms
168ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KJPGLC9EVP&cid=1177186213.1729248049&gtm=45je4ah0v889850326za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101533422~101686685~101836706&tag_exp=101533422~101686685~101836706&z=304985478

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 10:40:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6437770863881823437

4 B
279 B

675ms
248ms

Image
application/json

2600:9000:206f:b800:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6437770863881823437
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Server: 2600:9000:206f:b800:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

via: 1.1 58b39782bf40f627ace295c1c6f59840.cloudfront.net (CloudFront)
apigw-requestid: f14wKhRLoAMEPHw=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 4
x-amz-cf-id: vQ-b6n2VaBeAKgjvNNoVSJcii5y1jAcPehZ-j_0mwTjNobn9ujrzdg==
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: application/json
x-amz-cf-pop: FRA56-C1

Redirect headers

cache-control: no-store, no-cache, private
location: https://attr.ml-api.io/?domain=www.sentinelone.com&pId=6437770863881823437
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 194.74.212.99; 194.74.212.99; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: c54ee7b2-dda7-415f-ac99-c110d7100581
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 10:40:51 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 rt
tags.srv.stackadapt.com/ 43 B
933 B 896ms
150ms Image
image/gif 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.srv.stackadapt.com/rt?sid=DIQlrAikIjHHohfyFxzIrn
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: image/gif
content-length: 43

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-71bc-8379-e1b1c1e8f3f3/ 172 KB
30 KB 86ms
85ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/01922fce-8fbf-71bc-8379-e1b1c1e8f3f3/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89fe196f6c521041a812cb0d53fa6406a67e93cc8510708b6bfbdbf73b31ab58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: PQfn3rRDLeafx6WPiziqsA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCDF0131E0A3C1
age: 70623
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Sat, 19 Oct 2024 10:40:49 GMT
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/json
last-modified: Fri, 27 Sep 2024 14:32:20 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: fb05e969-601e-009f-21ea-10eb30000000
cf-ray: 8d47e992fafd60fe-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30166
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 XDFrame Show response
go.sentinelone.com/index.php/form/ Frame 798F 2 KB
888 B 188ms
185ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/index.php/form/XDFrame

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8d47e9954acc634d-LHR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 18 Oct 2024 10:40:49 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 otFloatingFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 10 KB
3 KB 78ms
78ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otFloatingFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad8caeb7b64eea0fb1ab370dfd8bebfbfccd7bef986abd415f7a495a09a8e1f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: Kv0CD1LDdaN4tdf60mtXgA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C85824169
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 70623
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:57 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ab0d2596-301e-00c3-30dc-1f1ac9000000
cf-ray: 8d47e995cf4360fe-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2675
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/ 64 KB
13 KB 94ms
94ms Fetch
application/json 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: woYZp0HVhx8yo641nhyLrw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCED8C868E8C65
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 49310
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/json
last-modified: Wed, 16 Oct 2024 02:44:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f6e6cd61-e01e-0042-7a0e-20b89e000000
cf-ray: 8d47e995ef7a60fe-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.1.0/assets/ 24 KB
4 KB 93ms
92ms Fetch
text/css 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: HyPJ72TNHxdfOI82cqKVqA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 71847
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/css
last-modified: Wed, 16 Oct 2024 02:45:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ccd14207-201e-00ba-19d9-1f7383000000
cf-ray: 8d47e995ef7e60fe-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 web Show response
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/ 3 KB
2 KB 218ms
68ms Script
text/javascript 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2572ce860bc399cdf40d09addb485fc718d87c7366e324a46d1e543e7fa0f9b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-request-id: 1f5ee504-232b-4622-aff3-1dbe21abc16e
content-encoding: br
cf-bgj: minify
etag: W/"a25ad7241544dd8f6161c9af33dbad52"
age: 633
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 11:40:49 GMT
cf-polished: origSize=3446
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: text/javascript; charset=utf-8
vary: Origin, Accept-Encoding
x-runtime: 0.034609
x-frame-options: SAMEORIGIN
access-control-allow-headers: SDK-Version
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=3600
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
x-download-options: noopen
cf-ray: 8d47e9981f8593e1-LHR
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/ 6 KB
2 KB 356ms
89ms Script
text/javascript 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1729248049707&cv=11&fst=1729248049707&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abf31ba16b325faa040f59a8be64bb8f12aaadfb7dc6a8b8f40d9f136878426d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2433
date: Fri, 18 Oct 2024 10:40:50 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 970186784
td.doubleclick.net/td/rul/ Frame 428D 0
0 94ms
64ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/970186784?random=1729248049707&cv=11&fst=1729248049707&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 forms2.min.js Show response
go.sentinelone.com/js/forms2/js/ Frame 798F 199 KB
0 0ms
0ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/js/forms2.min.js

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://go.sentinelone.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "5c01fe-31b91-62370c030d900"
age: 1817
x-content-type-options: nosniff
cf-ray: 8d47e981d948634d-LHR
expires: Fri, 18 Oct 2024 14:40:46 GMT
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: application/x-javascript
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 v1
ca.knock-ai.com/client/an/ 0
0 365ms
288ms Fetch
text/html 2a00:1450:4001:80f::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ca.knock-ai.com/client/an/v1?clientId=97ee7348-9176-4a4b-9af2-40711264546b&version=1.1.1&revisionNumber=10&userId=c6ef16f5-a864-4a9a-8e0d-0028a22fe493.1729248049649&sessionId=41ec66d8-6ba5-4cfb-911d-d9ea1c1d8418&prevSessionStartTime=null&sessionStartTime=1729248049991&browser=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36&device=pc&os=Linux&pageNumber=1&pageVisit=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&prevPageVisitStartTime=null&pageVisitStartTime=1729248049991&prevPageVisitEndTime=null&pageVisitEndTime=null&timestamp=1729248049992&utmSource=&utmMedium=&utmCampaign=&utmTerm=&utmContent=&referrerDomain=cvsoci.al&referrerPath=%2F&referrerUrl=https%3A%2F%2Fcvsoci.al%2F
Requested by: Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

GET
H2 401 ip.json Show response
api.company-target.com/api/v2/ 12 B
512 B 507ms
122ms XHR
text/plain 18.66.102.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v2/ip.json?referrer=https%3A%2F%2Fcvsoci.al%2F&page=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&page_title=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba

Requested by

Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/d6076494.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.127 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-127.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-max-age: 7200
access-control-expose-headers
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
request-id: d2d6478f-20fb-4b94-ab98-d1704a1c4878
x-cache: Error from cloudfront
x-amz-cf-id: D_VjwTUFk0Hhuj8vC6cwSxQQ10oXO_mZmM1DRSb0G3zsbHlJn0DrKw==
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: text/plain;charset=utf-8
vary: Origin
www-authenticate: DemandBase API
access-control-allow-credentials: true
via: 1.1 1f0db25765b79d244ad1fa2184395c12.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.sentinelone.com
content-length: 12
x-amz-cf-pop: FRA56-P2
server: nginx

GET
H/1.1

400
Bad Request

demandbase
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1

27 B
27 B

54ms
53ms

Image
text/plain

34.248.126.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

HTTP/1.1

Server

34.248.126.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-248-126-255.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 27
Date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: text/plain
Server: gunicorn
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
Content-Length: 0
Date: Fri, 18 Oct 2024 10:40:50 GMT
Server: gunicorn
Connection: keep-alive

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 456ms
80ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 18 Oct 2024 10:40:50 GMT

GET
H2 200 pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/ 43 B
296 B 214ms
151ms Image
image/gif 162.159.153.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&tag=ViewContent&ts=1729248050023

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.153.247 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-q-stat: ,3c74e98dc018920400d6d8ac42fa0737,10.0.0.172,11792,194.74.212.99,,295293676258,1,1729248050.160,0.002,,.,0,0,0.000,0.004,-,0,0,203,169,84,10,34729,,,,,,-,
cf-ray: 8d47e9992ac7a62a-LHR
alt-svc: h3=":443"; ma=86400
content-length: 43
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 adsct
t.co/1/i/ 43 B
630 B 605ms
248ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=34b1fbd9-d079-482b-815b-447cfed25f00&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=94c3dd74-4b0e-4998-b6df-cee2418c0f75&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 9baadd975ef167d2
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 43b67b5ed89ffa07401f613bf16f6d0385594dc9d6dd145c0ed1601abb3a2660
cf-cache-status: DYNAMIC
cf-ray: 8d47e99b0a38cd1a-LHR
x-response-time: 189
content-length: 43
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_f

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
722 B 522ms
222ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=34b1fbd9-d079-482b-815b-447cfed25f00&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=94c3dd74-4b0e-4998-b6df-cee2418c0f75&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.30

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 1079c32eb6c03cc6
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 8679ec9721465938f42367d2fb7bca780f9f3f8a68855bf8fe974000ddbb0ea1
x-response-time: 187
content-length: 43
date: Fri, 18 Oct 2024 10:40:49 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_f

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
816 B 524ms
185ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.sentinelone.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 000624bdefc6f84dc0ce0d79a36f139f
x-msedge-ref: Ref A: 147604E4FDE04A008033B50F3DF08EA5 Ref B: LON04EDGE0712 Ref C: 2024-10-18T10:40:50Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYkve/G+E3Azg15o28Tnw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 10:40:49 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology...

0
265 B

540ms
173ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&e_ipv6=AQLTi9g4bu4BaQAAAZKfNzyLDg-f7SBK_BTKmhezM1LqOpdDmoF9DjlcMC9zxkAPs5LsJtBlnw
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 4CAA930A70654DC283082E7110EFD42C Ref B: LON04EDGE0719 Ref C: 2024-10-18T10:40:51Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkve/R1wAbNmiR3xaDWw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890%2C5427652%2C5500618&time=1729248050033&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&e_ipv6=AQLTi9g4bu4BaQAAAZKfNzyLDg-f7SBK_BTKmhezM1LqOpdDmoF9DjlcMC9zxkAPs5LsJtBlnw
x-msedge-ref: Ref A: 4CB5FDABC1B34B1399DAF542D102E58A Ref B: LTSEDGE1522 Ref C: 2024-10-18T10:40:50Z
x-li-fabric: prod-lva1
x-li-uuid: AAYkve/EYGjEXU6X6e4/GQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 10:40:49 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
620 B 485ms
151ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: CA1479B2FA9947A891671746EA3BDB19 Ref B: LTSEDGE1522 Ref C: 2024-10-18T10:40:50Z
x-li-fabric: prod-ltx1
access-control-allow-credentials: true
x-li-uuid: AAYkve/EsJnCPYpwd0XDtw==
x-li-proto: http/2
access-control-allow-origin: https://www.sentinelone.com
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 10:40:49 GMT
vary: Origin

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 174ms
168ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Sun, 26 Jan 2025 10:40:50 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Fri, 18 Oct 2024 10:40:50 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 ABCWhytePlusVariable.woff2
www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ 242 KB
0 77ms
77ms Font
font/woff2 104.26.2.18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.18 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.sentinelone.com
Referer: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Response headers

x-pantheon-styx-hostname: styx-fe2-a-5466c7c5b8-qdkph
cf-cache-status: REVALIDATED
etag: "6711b1e9-3c6a4"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pWZ%2BYivzsMdbANjIo0Jkh6bwHJxQfaau2I3RNSWoGMi0Lsa2k12cePAtbR52C7iHQkneHDma82CLJBIc7twNGHoUk%2Fr38BAvufp5ySYZH8cHsXWG7SoCkbMmT5YS8awsyjl8N%2F0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 19 Oct 2025 00:57:15 GMT
x-cache: HIT, HIT, MISS, MISS
date: Fri, 18 Oct 2024 10:40:46 GMT
content-type: font/woff2
last-modified: Fri, 18 Oct 2024 00:55:05 GMT
vary: Accept-Encoding
x-cache-hits: 6, 0, 0, 0
x-served-by: cache-chi-klot8100054-CHI, cache-lcy-eglc8600090-LCY, cache-lcy-eglc8600065-LCY, cache-lcy-eglc8600065-LCY
cache-control: max-age=60
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1729248041.567641,VS0,VE8
x-styx-req-id: eaff3cf6-8ceb-11ef-a176-5a8882821802
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8d47e980dc89413c-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 247460
server: cloudflare

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 62ms
51ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 41626
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 06:37:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 20d40cee-801e-0016-0520-205214000000
cf-ray: 8d47e99b2db7776e-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
518 B 57ms
55ms Fetch
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 60071
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 06:37:42 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d9dd2877-d01e-0027-6ff5-1f09c3000000
cf-ray: 8d47e99cf8a860fe-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 header-logo-dark.png
cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920559-7123-786b-94d9-223b07b7fd18/ebe74a6b-975b-4d07-a190-a63e5f3c1b77/ 17 KB
17 KB 52ms
52ms Image
mage/png 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920559-7123-786b-94d9-223b07b7fd18/ebe74a6b-975b-4d07-a190-a63e5f3c1b77/header-logo-dark.png

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: zP9vNoac0WWOsoM5qHSlqQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DCD7E6EDBBE58A
age: 72662
cf-cache-status: HIT
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: mage/png
last-modified: Wed, 18 Sep 2024 13:36:41 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 027f2527-f01e-0056-65d1-097bfa000000
cf-ray: 8d47e99d1930776e-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17475
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 78ms
77ms Image
image/svg+xml 2606:4700::6812:562a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 42619
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 06:37:43 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ca52a3ea-601e-00f9-5b1d-20596a000000
cf-ray: 8d47e99d3964776e-LHR
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 134618848.js Show response
bat.bing.com/p/action/ 371 B
418 B 51ms
50ms Script
application/javascript 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/134618848.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8a9c46f4371f29ded6f345238dd688515240c3da12b3a220f4f734e7066bb284

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3851A8C85A55442BA2421A536A2EDD5B Ref B: LON212050719023 Ref C: 2024-10-18T10:40:51Z
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 10:40:50 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 165ms
154ms Stylesheet
text/css 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6c00ca2b9de4420ae387bfe9b7850bbfffc754e5f3e79dfe043eca2e1e08f190

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 320ms
135ms Fetch
image/jpeg 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: image/jpeg

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
0 317ms
317ms Fetch
image/jpeg 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: image/jpeg

GET
H2 200 rt
tags.srv.stackadapt.com/ 43 B
108 B 204ms
181ms Image
image/gif 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.srv.stackadapt.com/rt?sid=uQM497B9yR1fPnLLwZZDtK&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&t=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&tip=N496h9fuP9Tj7Kuj1BFb6Bg_57xR9sOdglDWGNzSwfM&l_src=cvsoci.al&l_src_d=2024-10-18T10%3A40%3A51.389Z&u_src=&u_src_d=&shop=false
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: image/gif
content-length: 43

POST
H3 200 p Show response
e.calibermind.com/v1/ 16 B
625 B 477ms
140ms Fetch
application/json 2606:4700:3031::ac43:d595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://e.calibermind.com/v1/p

Requested by

Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.sentinelone.com/

Response headers

access-control-max-age: 900
x-request-id: 39e2b9e4-649d-4ab6-9afa-519106d1b13e
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ixrDMhDhQtP5cVZ25LnoLo%2Fajlr637mU1%2F10wCgwRhNBGVdEq0QGE2UeSd%2BDOlfeJl91UFY7w06LnUmNF97O1svKyCIOduKEwMuLD2PNZHD0LINCNqHw%2FNHFzkAeDQglRqsfeYJY8XJu0eJcAOBbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: application/json; charset=utf-8
priority: u=1,i
access-control-allow-headers: Content-Type,Authorization
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d47e9a41f2c93da-LHR
access-control-allow-origin: *
content-length: 16
server: cloudflare

GET
H3 200 /
www.google.com/pagead/1p-user-list/970186784/ 42 B
64 B 429ms
70ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970186784/?random=1729248049707&cv=11&fst=1729245600000&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfxaglIbzM-oYkjKJmr4_MFWjppljvUA&random=2474666604&rmt_tld=0&ipr=y

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 10:40:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.co.uk/pagead/1p-user-list/970186784/ 42 B
64 B 65ms
62ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/pagead/1p-user-list/970186784/?random=1729248049707&cv=11&fst=1729245600000&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfxaglIbzM-oYkjKJmr4_MFWjppljvUA&random=2474666604&rmt_tld=1&ipr=y

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 10:40:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.48/ 64 KB
27 KB 46ms
46ms Script
application/javascript 2620:1ec:29:1::72
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.48/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::72 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-azure-ref: 20241018T104051Z-1844b484f6b8245nbnbx0rpufn00000001wg000000007nt5
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DCEE2357C4857E"
x-fd-int-roxy-purgeid: 51562430
x-ms-request-id: 03ce392a-601e-0050-3094-20ec8b000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Fri, 18 Oct 2024 10:40:51 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 16 Oct 2024 20:44:34 GMT

POST
H/1.1 200
OK visitWebPage
327-mnm-087.mktoresp.com/webevents/ 2 B
318 B 622ms
110ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1729248051541&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1729248051537-28593&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fcvsoci.al%2F&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: c98bafcb-784a-4e72-8fb4-05c2432edbe8
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Fri, 18 Oct 2024 10:40:52 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 204 0
bat.bing.com/action/ 0
289 B 46ms
46ms Image
text/plain 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=7411c047-68af-4b52-bbef-7935903f9bfe&bo=1&sid=71ecf6b08d3d11ef802b61a5cae2df2b&vid=71ed65108d3d11efbd246f6a382e997e&vids=1&msclkid=N&pi=918639831&lg=en-GB&sw=1600&sh=1200&sc=24&tl=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&p=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&r=https%3A%2F%2Fcvsoci.al%2F&lt=3443&evt=pageLoad&sv=1&cdb=AQET&rn=769388

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 42CD24C9609341F0BA04A5AA5F8C94DB Ref B: LON212050719023 Ref C: 2024-10-18T10:40:51Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 10:40:50 GMT

GET
H2 200 messenger
app.qualified.com/w/1/ZQoyHXFTqngPcfcB/ Frame F7E6 0
0 338ms
176ms Document
text/html 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/ZQoyHXFTqngPcfcB/messenger?uuid=7c82d8ec-b481-4c8c-8c5a-398fc6d10aed

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=ZQoyHXFTqngPcfcB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8d47e9a54dbdbeb4-LHR
content-encoding: gzip
content-security-policy
content-type: text/html; charset=utf-8
date: Fri, 18 Oct 2024 10:40:52 GMT
link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
x-cache: miss
x-content-type-options: nosniff
x-download-options: noopen
x-envoy-upstream-service-time: 32
x-permitted-cross-domain-policies: none
x-request-id: a6db5c1a-79aa-4859-b52c-c17e095fbc54
x-runtime: 0.029414
x-xss-protection: 1; mode=block

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 213 B
410 B 145ms
144ms XHR
text/plain 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&t=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&tip=N496h9fuP9Tj7Kuj1BFb6Bg_57xR9sOdglDWGNzSwfM&host=https%3A%2F%2Fwww.sentinelone.com&l_src=cvsoci.al&l_src_d=2024-10-18T10%3A40%3A51.389Z&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIN28kqw_WgyEh02_sZr-e_2GyYma-KgbPvIeL4dsaqEDEAEYAyCx9si4BjABOgRA3giLQgTV6JW1.JHYtcOEzxorEGIskY96hh9fSWZf%252FTQkS6dsyI%252BxsA2k&sa-user-id-v2=s%253AY62KNbdAXMpzCM_abCiP1cJK1GM.uzttHlEOH4e53EHowZw3li9METlkPYeTFpZXXNlSaAE&sa-user-id=s%253A0-63ad8a35-b740-5cca-7308-cfda6c288fd5.6sWOyvJr2WHva%252F%252BtC0%252Fgkcv1XbiROAtFPHr%252BitbsCJw
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.sentinelone.com
content-length: 213
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 213 B
410 B 149ms
147ms XHR
text/plain 3.127.102.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=_Cv1ULrV9dssq6yGX6-Dzw&is_js=true&landing_url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&t=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&tip=N496h9fuP9Tj7Kuj1BFb6Bg_57xR9sOdglDWGNzSwfM&host=https%3A%2F%2Fwww.sentinelone.com&sa_conv_data_Event%20Name=mkto.form.success&l_src=cvsoci.al&l_src_d=2024-10-18T10%3A40%3A51.389Z&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIN28kqw_WgyEh02_sZr-e_2GyYma-KgbPvIeL4dsaqEDEAEYAyCx9si4BjABOgRA3giLQgTV6JW1.JHYtcOEzxorEGIskY96hh9fSWZf%252FTQkS6dsyI%252BxsA2k&sa-user-id-v2=s%253AY62KNbdAXMpzCM_abCiP1cJK1GM.uzttHlEOH4e53EHowZw3li9METlkPYeTFpZXXNlSaAE&sa-user-id=s%253A0-63ad8a35-b740-5cca-7308-cfda6c288fd5.6sWOyvJr2WHva%252F%252BtC0%252Fgkcv1XbiROAtFPHr%252BitbsCJw
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.102.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-102-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.sentinelone.com
content-length: 213
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
283 B 487ms
178ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.sentinelone.com/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://www.sentinelone.com
Date: Fri, 18 Oct 2024 10:40:52 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 52ms
51ms Stylesheet
text/css 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
age: 1772
expires: Sun, 17 Nov 2024 10:40:52 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: text/css
vary: Accept-Encoding
access-control-allow-headers: OneSignal-Subscription-Id
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=2592000
via: 1.1 google
cf-ray: 8d47e9a5bf5d93e1-LHR
server: cloudflare

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/ 240 B
811 B 223ms
102ms Fetch
application/json 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-request-id: df6765b5-a61c-45d8-96d3-1f69e36a1d58
content-encoding: br
cf-cache-status: REVALIDATED
etag: W/"c30dc39ff7449779c568ff4e90c170f0"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: application/json; charset=utf-8
vary: Accept, Origin, Accept-Encoding
x-runtime: 0.013684
access-control-allow-headers: SDK-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
via: 1.1 google
cf-ray: 8d47e9a71f06beda-LHR
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 wINUGMVQyKNdKtMTH4Wt_s1.png
img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/ 6 KB
7 KB 64ms
54ms Image
image/png 2606:4700::6810:a091
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/wINUGMVQyKNdKtMTH4Wt_s1.png

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/dark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:a091 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=1QkUUA==, md5=Dj+SUoicGnX7oiG7n37+GQ==
cf-bgj: imgq:85,h2pri
etag: "-CPLdwrW3woQDEAE="
age: 2515
cf-cache-status: HIT
x-goog-stored-content-encoding: identity
expires: Mon, 18 Nov 2024 10:40:52 GMT
cf-polished: origSize=11143, status=vary_header_present
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 11143
server-timing: cfExtPri
date: Fri, 18 Oct 2024 10:40:52 GMT
content-type: image/png
last-modified: Fri, 23 Feb 2024 21:44:25 GMT
vary: Origin, Accept-Encoding
x-guploader-uploadid: ACJd0Nq5oRvjlC-MBLMe6VsjWZuTk1pfy72k7mF8HKK88zkycuilpblg180NJ1-U57Pnv8D13-KPZNqgwA
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=2678400
pragma: no-cache
x-goog-storage-class: STANDARD
cf-ray: 8d47e9a7c84079ae-LHR
x-goog-encryption-kms-key-name: projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
accept-ranges: bytes
x-goog-generation: 1708724665233138
content-length: 6492
server: cloudflare

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
283 B 321ms
296ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.sentinelone.com/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://www.sentinelone.com
Date: Fri, 18 Oct 2024 10:40:53 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/970186784/ 5 KB
3 KB 532ms
69ms Script
text/javascript 142.250.186.162

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/970186784/?random=1729248056678&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

00a5ccf5cbd7591e7556243969a5f8e088b14dcd028d6fec2fdcfe5b4b1379d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2768
date: Fri, 18 Oct 2024 10:40:57 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 970186784
td.doubleclick.net/td/rul/ Frame 5C71 0
0 84ms
61ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/970186784?random=1729248056678&cv=11&fst=1729248056678&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&ct_cookie_present=0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-970186784&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:56 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw...
13115870.fls.doubleclick.net/ Frame A135
Redirect Chain

https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;...
https://13115870.fls.doubleclick.net/activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;u...

0
0

127ms
101ms

Document
text/html

142.250.184.230

General

Check archive.org

Show headers Download Go to

Full URL

https://13115870.fls.doubleclick.net/activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 411
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:57 GMT
expires: Fri, 18 Oct 2024 10:40:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:57 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://13115870.fls.doubleclick.net/activityi;dc_pre=CNTYtoHfl4kDFZWzgwcdAekycw;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=...
td.doubleclick.net/td/fls/rul/ Frame CE15 0
0 179ms
166ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.sentinelone.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 10:40:56 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
px4.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQIWEkd5ZgmRqwAAAZKfN1aNf-rKMHPE9l5jW3Fe8krbGMGNuyVYhFEJwLnEcbgECwo1lAiW8g

43 B
246 B

400ms
384ms

Image
image/gif

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQIWEkd5ZgmRqwAAAZKfN1aNf-rKMHPE9l5jW3Fe8krbGMGNuyVYhFEJwLnEcbgECwo1lAiW8g
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-msedge-ref: Ref A: 82C8053E32004AA2BBEB444642EF3108 Ref B: LON04EDGE0719 Ref C: 2024-10-18T10:40:57Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkvfAtXoT2SOe2x273SA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 65
date: Fri, 18 Oct 2024 10:40:56 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif&e_ipv6=AQIWEkd5ZgmRqwAAAZKfN1aNf-rKMHPE9l5jW3Fe8krbGMGNuyVYhFEJwLnEcbgECwo1lAiW8g
x-msedge-ref: Ref A: 0EEF486FF2FF4ABFA7CB23747C5C8C35 Ref B: LTSEDGE1522 Ref C: 2024-10-18T10:40:56Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYkvfAp/XehYc4kP4bvSg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 18 Oct 2024 10:40:56 GMT

GET
H3 200 activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noap...
ad.doubleclick.net/ 0
24 B 435ms
126ms Image
image/png 142.250.184.230

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=386559466.1729248049;ps=1;pcor=258827093;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4ah0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101533422~101686685~101823848;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 18 Oct 2024 10:40:57 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"4653382088267786067"}],"aggregatable_trigger_data":[{"filters":[{"14":["14055451"]}],"key_piece":"0x536f55f5e9b5be7","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x86b56267452bca7","not_filters":{"14":["14055451"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"11763384946861657127","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"4653382088267786067","filters":[{"14":["14055451"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"4653382088267786067","filters":[{"14":["14055451"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"4653382088267786067","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"4653382088267786067","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["13115870"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 204 0
bat.bing.com/action/ 0
238 B 54ms
47ms Image
text/plain 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=7411c047-68af-4b52-bbef-7935903f9bfe&bo=2&sid=71ecf6b08d3d11ef802b61a5cae2df2b&vid=71ed65108d3d11efbd246f6a382e997e&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQET&rn=376060

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9DD3C372FAE844C992A42BC451A09571 Ref B: LON212050719023 Ref C: 2024-10-18T10:40:56Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Fri, 18 Oct 2024 10:40:56 GMT

GET
H3

200

/
www.google.co.uk/pagead/1p-conversion/970186784/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13...
https://www.google.com/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_...
https://www.google.co.uk/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&ta...

42 B
64 B

152ms
150ms

Image
image/gif

2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQJKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIwOu0gd-XiQMVA46DBx1K1DkpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkh1VG9SYjBpZ29samdRTUdSd190STVFQ2lRTGV3cVlUTGlNM1F4UUV5YzUyV05ydkhBcUJJdw&is_vtc=1&cid=CAQSKQDpaXnf247U71v2bdc-fpbfkO3idJBcWVmmhpbgbw0y3-uwQIH12LoQ&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaIQES4G6PQ6qBDTNzzJpa3rmC_wi84bfUw&random=3351001383&ipr=y

Protocol

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.sentinelone.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 10:40:57 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.uk/pagead/1p-conversion/970186784/?random=960166398&cv=11&fst=1729248056678&bg=ffffff&guid=ON&async=1&gtm=45be4ah0v890159661z871208095za201zb71208095&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529665~101533421~101686685&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&ref=https%3A%2F%2Fcvsoci.al%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&value=0&npa=0&pscdl=noapi&auid=386559466.1729248049&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECCOvGsQJKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=IhMIwOu0gd-XiQMVA46DBx1K1DkpMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhxodHRwczovL3d3dy5zZW50aW5lbG9uZS5jb20vQlZDaEFJOEk3SXVBWVF0dmFVNnFUOG9yd2xFaXdBN3lwSkh1VG9SYjBpZ29samdRTUdSd190STVFQ2lRTGV3cVlUTGlNM1F4UUV5YzUyV05ydkhBcUJJdw&is_vtc=1&cid=CAQSKQDpaXnf247U71v2bdc-fpbfkO3idJBcWVmmhpbgbw0y3-uwQIH12LoQ&eitems=ChAI8I7IuAYQxqPU-rOnhsZAEh0AXDDmaIQES4G6PQ6qBDTNzzJpa3rmC_wi84bfUw&random=3351001383&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 10:40:57 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H/1.1 204
No Content collect
q.clarity.ms/ 0
283 B 468ms
165ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.48/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.sentinelone.com/

Response headers

Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
Access-Control-Allow-Origin: https://www.sentinelone.com
Date: Fri, 18 Oct 2024 10:40:59 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: idx.liadm.com
URL: https://idx.liadm.com/idex/unknown/any?gdpr=0

Domain: cdn.abrankings.com
URL: https://cdn.abrankings.com/js/client.js

Verdicts & Comments Add Verdict or Comment

109 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cvsoci.al/	1970-01-21 09:56:48	Name: intellidirect Value: undefined
.go.sentinelone.com/	1970-01-21 00:20:49	Name: __cf_bm Value: BMeiHXRbjSruxIX2RVw_3r.a04h3vfvTgWsnSnna59s-1729248046-1.0.1.1-j669UnkTm3xbhtVGtbnBUEIftWT4pojRzQDGPoLg9CbcJ1CCGtgZ0.Z7Xz8kRQTmiE5FhI9FAmYwZpEA6dgp2Q
.onesignal.com/	1970-01-21 00:20:49	Name: __cf_bm Value: fSF9zLsyF0ZDXUQQE82S4OThH9.gyvIJ8CM7Ki06E9Q-1729248046-1.0.1.1-qKpoj1pZW_70xJp30SMP2DVX0NHoOfPFHnKTxGA5mJ1Jg7yIHDfH0GEIZzRprBQ0d8TyTHOZ6l6MnBVXTlGT6Q
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: _yxqclifH-I
.youtube.com/	1970-01-21 04:40:00	Name: VISITOR_INFO1_LIVE Value: 9TiMyVp4NC8
.youtube.com/	1970-01-21 04:40:00	Name: VISITOR_PRIVACY_METADATA Value: CgJHQhIEGgAgPg%3D%3D
.sentinelone.com/	1970-01-21 09:56:48	Name: __q_state_ZQoyHXFTqngPcfcB Value: eyJ1dWlkIjoiN2M4MmQ4ZWMtYjQ4MS00YzhjLThjNWEtMzk4ZmM2ZDEwYWVkIiwiY29va2llRG9tYWluIjoic2VudGluZWxvbmUuY29tIn0=
.sentinelone.com/	1970-01-21 02:30:24	Name: _gcl_au Value: 1.1.386559466.1729248049
.sentinelone.com/	1970-01-21 09:56:48	Name: _ga_KJPGLC9EVP Value: GS1.1.1729248048.1.0.1729248048.60.0.0
.sentinelone.com/	1970-01-21 09:56:48	Name: _ga Value: GA1.1.1177186213.1729248049
go.sentinelone.com/	1969-12-31 23:59:59	Name: BIGipServerab14web-nginx-app_https Value: !eA5hYUCreYmllaKwZJ6CmE6tjLF6//2SwLoLkJvHCOfskiyYR9K0lITvaEyNINSwJFg0DsZ5DOnSS2Y=
tags.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id Value: s%3A0-63ad8a35-b740-5cca-7308-cfda6c288fd5.6sWOyvJr2WHva%2F%2BtC0%2Fgkcv1XbiROAtFPHr%2BitbsCJw
.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id Value: s%3A0-63ad8a35-b740-5cca-7308-cfda6c288fd5.6sWOyvJr2WHva%2F%2BtC0%2Fgkcv1XbiROAtFPHr%2BitbsCJw
tags.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id-v2 Value: s%3AY62KNbdAXMpzCM_abCiP1cJK1GM.uzttHlEOH4e53EHowZw3li9METlkPYeTFpZXXNlSaAE
.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id-v2 Value: s%3AY62KNbdAXMpzCM_abCiP1cJK1GM.uzttHlEOH4e53EHowZw3li9METlkPYeTFpZXXNlSaAE
.doubleclick.net/	1970-01-21 00:20:48	Name: test_cookie Value: CheckForPermission
tags.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id-v3 Value: s%3AAQAKIN28kqw_WgyEh02_sZr-e_2GyYma-KgbPvIeL4dsaqEDEAEYAyCx9si4BjABOgRA3giLQgTV6JW1.JHYtcOEzxorEGIskY96hh9fSWZf%2FTQkS6dsyI%2BxsA2k
.srv.stackadapt.com/	1970-01-21 09:06:24	Name: sa-user-id-v3 Value: s%3AAQAKIN28kqw_WgyEh02_sZr-e_2GyYma-KgbPvIeL4dsaqEDEAEYAyCx9si4BjABOgRA3giLQgTV6JW1.JHYtcOEzxorEGIskY96hh9fSWZf%2FTQkS6dsyI%2BxsA2k
.sentinelone.com/	1970-01-21 09:06:24	Name: ajs_anonymous_id Value: a8934017-a0a5-4a0d-8e4d-0b21c1235b56
www.clarity.ms/	1970-01-21 09:06:24	Name: CLID Value: f35eee8de8d643edbb6fa2287f6819dc.20241018.20251018
.linkedin.com/	1970-01-21 09:06:24	Name: bcookie Value: "v=2&1617b92e-0109-4ad1-8ce7-f29b73d889a4"
.linkedin.com/	1970-01-21 04:40:00	Name: li_gc Value: MTswOzE3MjkyNDgwNTA7MjswMjGj+yDRHo18CH4gdXHAoJse2xCNGPfMV9ea7OgLZVQPGA==
.linkedin.com/	1970-01-21 00:22:14	Name: lidc Value: "b=TGST00:s=T:r=T:a=T:p=T:g=3515:u=1:x=1:i=1729248050:t=1729334450:v=2:sig=AQHLkihE_wOrTtqf_053llSfo5-gxQdC"
.twitter.com/	1970-01-21 09:56:48	Name: guest_id_marketing Value: v1%3A172924805046410101
.twitter.com/	1970-01-21 09:56:48	Name: guest_id_ads Value: v1%3A172924805046410101
.twitter.com/	1970-01-21 09:56:48	Name: personalization_id Value: "v1_ZKarlIF7yLeBwNyI6F1LRw=="
.twitter.com/	1970-01-21 09:56:48	Name: guest_id Value: v1%3A172924805046410101
.t.co/	1970-01-21 09:56:48	Name: muc_ads Value: 781c7edc-1f14-4789-a14f-1ac773c1198f
.t.co/	1970-01-21 00:20:49	Name: __cf_bm Value: 70Nz6yba3PxkwJaSTwcBw4UITgYwHyXbDoch8gntk7Q-1729248050-1.0.1.1-ytZKDXE_zZI4MOpFPhWazV4Ojia1frREBNOiBfiQNJUX5fFA9woJVj_RFjQQd9PC_hFXm6tibzLg48qLJozyOQ
.sentinelone.com/	1970-01-21 09:06:24	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Oct+18+2024+11%3A40%3A50+GMT%2B0100+(British+Summer+Time)&version=202409.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.bidr.io/	1970-01-21 09:49:21	Name: bito Value: AAD7cE7OJHYAABWwOl9qzA
.bidr.io/	1970-01-21 09:49:21	Name: bitoIsSecure Value: ok
.adnxs.com/	1970-01-21 02:30:24	Name: XANDR_PANID Value: XX-SZlaySB1JiLBiVBvuen_TY897_tfKrU5s3VUNZOfpgf6EiUHri-Pi8WzOrPKqQEyXWsOQ3LGs1-7aiXWoRRhE5CLSutQRuNKmEa5phpo.
.adnxs.com/	1970-01-21 09:56:48	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 02:30:24	Name: uuid2 Value: 6437770863881823437
www.sentinelone.com/	1970-01-21 01:04:00	Name: sa-r-source Value: cvsoci.al
www.sentinelone.com/	1970-01-21 01:04:00	Name: sa-r-date Value: 2024-10-18T10:40:51.389Z
www.sentinelone.com/	1970-01-21 09:06:24	Name: sa-user-id Value: s%253A0-63ad8a35-b740-5cca-7308-cfda6c288fd5.6sWOyvJr2WHva%252F%252BtC0%252Fgkcv1XbiROAtFPHr%252BitbsCJw
www.sentinelone.com/	1970-01-21 09:06:24	Name: sa-user-id-v2 Value: s%253AY62KNbdAXMpzCM_abCiP1cJK1GM.uzttHlEOH4e53EHowZw3li9METlkPYeTFpZXXNlSaAE
www.sentinelone.com/	1970-01-21 09:06:24	Name: sa-user-id-v3 Value: s%253AAQAKIN28kqw_WgyEh02_sZr-e_2GyYma-KgbPvIeL4dsaqEDEAEYAyCx9si4BjABOgRA3giLQgTV6JW1.JHYtcOEzxorEGIskY96hh9fSWZf%252FTQkS6dsyI%252BxsA2k
.sentinelone.com/	1970-01-21 09:56:48	Name: _mkto_trk Value: id:327-MNM-087&token:_mch-sentinelone.com-1729248051537-28593
.sentinelone.com/	1970-01-21 00:22:14	Name: _uetsid Value: 71ecf6b08d3d11ef802b61a5cae2df2b
.sentinelone.com/	1970-01-21 09:42:24	Name: _uetvid Value: 71ed65108d3d11efbd246f6a382e997e
.bing.com/	1970-01-21 09:42:24	Name: MUID Value: 1E2FD9AEFEE56CB3208FCCB2FFE36D5E
.sentinelone.com/	1970-01-21 09:06:24	Name: _clck Value: 1opn0h2%7C2%7Cfq4%7C0%7C1752
.sentinelone.com/	1970-01-21 00:22:14	Name: _clsk Value: 1r7d9l7%7C1729248052560%7C1%7C1%7Cq.clarity.ms%2Fcollect

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 Message: Failed to load resource: the server responded with a status of 400 (Bad Request)
network	error	URL: https://api.company-target.com/api/v2/ip.json?referrer=https%3A%2F%2Fcvsoci.al%2F&page=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fdark-angels-esxi-ransomware-borrows-code-victimology-from-ragnarlocker%2F&page_title=Dark%20Angels%20%7C%20ESXi%20Ransomware%20Borrows%20Code%20%26%20Victimology%20From%20RagnarLocker&src=tag&key=2d6b88616246999ce8cfbfe7f68278ba Message: Failed to load resource: the server responded with a status of 401 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
ad.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
app.qualified.com
attr.ml-api.io
bat.bing.com
ca.knock-ai.com
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.onesignal.com
cvsoci.al
e.calibermind.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
id.rlcdn.com
idx.liadm.com
img.onesignal.com
js.knock-ai.com
js.qualified.com
match.prod.bidr.io
munchkin.marketo.net
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.clarity.ms
q.quora.com
region1.analytics.google.com
s.ml-attr.com
scripts.demandbase.com
secure.adnxs.com
secure.intelligence-enterprise.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tag.demandbase.com
tags.srv.stackadapt.com
td.doubleclick.net
www.clarity.ms
www.google.co.uk
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.sentinelone.com
www.youtube.com
cdn.abrankings.com
idx.liadm.com
104.102.43.106
104.17.70.206
104.18.16.5
104.18.17.5
104.244.42.195
104.26.2.18
13.107.42.14
142.250.184.230
142.250.186.162
162.159.153.247
172.66.0.227
18.239.50.10
18.245.46.22
18.245.46.53
18.66.102.127
185.89.210.141
192.28.144.124
199.232.188.157
20.231.53.73
2001:4860:4802:32::36
2600:9000:206f:b800:5:7a81:86c0:93a1
2606:4700:3031::ac43:d595
2606:4700:3037::6815:2d74
2606:4700:4400::ac40:9b77
2606:4700::6810:a091
2606:4700::6812:562a
2620:1ec:21::14
2620:1ec:29:1::72
2620:1ec:33:3::10
2a00:1450:4001:80b::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2013
2a00:1450:4001:81d::2002
2a00:1450:4001:81d::2008
2a00:1450:4001:82b::200a
2a00:1450:4001:830::2003
2a00:1450:4001:830::200e
2a00:1450:400c:c1d::9b
2a02:26f0:3500:10::210:a99
3.127.102.30
34.248.126.255
34.49.80.229
35.244.174.68
51.11.20.152
68.67.153.60
00a5ccf5cbd7591e7556243969a5f8e088b14dcd028d6fec2fdcfe5b4b1379d7
0602c4fb1597b7e6e111fe79777e195cacbc73774fcaf233a7835b33372dceae
08d80a196fd16e446bb1d5c7e94adf0b719406286686ab3606e0e49a1dc122d9
09130f25567ce37c83f96e186c3301d90baf199cc24003bdfd59eb1d2d44e07a
0a0b4e344aff3f641aad12b4df8e0964ac745739e99a6cfe7eddcd1b97f607d3
0c3cea978a84b6745af467e270fefbe0436fabfb700cdf2d546f034753e20990
13eaa3045195fe11283090773f6c401eaa7345eba2054cb76b86ad3fca0c1e5d
187392c32fe1b13fb5ff82fb3a06fecc9cb0403ce52c85285840880c55fdd745
19661b2f8ca108e51a5adafd6d4658cc410934e96162dbe5c41e80d1892606d8
1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701
1fcce91080e0c58b41ddc4bb6e9dad66c72e78802dc59622d8b0a42e5458d3af
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2572ce860bc399cdf40d09addb485fc718d87c7366e324a46d1e543e7fa0f9b4
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26e34b9fbbd2ecafe25af980f19ddc63342ffad01477b0fe851ac8c35bfea847
36b4b4c6757a5d380d22a491759f8a72f54b16791387c3826e69d2546208d4f4
36cb859be5a639c678f317d76c5c589da1b5e08820fcce41d67c38b517efa959
3744cdf7226ef40a651e4054a8589854e62cb4da5e5812c9013f23c11700813d
3a2aa135193fef82afd48f26d5aefcbb09ffb183629526b9181cdf064d8b9b11
3d088e735e1df1e3e110bced2732b0ec4be974ae0a72fadfc8be82f726f7c0a6
3fc7239c1df36760b9944d11c0c72096fa3d4cedadab12c885bc606577ebeb6b
400b1bd0090434d34677fe377b9f8936edf5c5a8a38088949d4f6a12d723d930
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
525a80420c078ff1e15f2d844a62b03fef28aac31552b072caf2ee25b7924d89
53d753ab6a34ff8e9443349b44033b8e116ba3d9815c049f4220f2ac220c5b36
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56842851d652201634fe09807384fef1b3855d073f30437f587c8e65808e140b
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5af5ee0b37b1f0ef31c42932bbf81424e4bb53e95e87a47e058625c1af2245db
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
636c5d0f0e5121033707d78679623fd0f40b1d4494fcaaedbeb4b80aaff088de
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6c00ca2b9de4420ae387bfe9b7850bbfffc754e5f3e79dfe043eca2e1e08f190
6c4ecef61998c68ed320df94e9f5b581df489b288894dd3769a293e5f0bffca3
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
7c2092048f21074425f3e025db78fb6505f75d6fcf2e121ced055c8d53bcb1b3
81a50b09cb85e4ff68788f763b8dcdc549414cecf42ca228a55ab77c971f1286
86089969fd2991a47d6a7a94ca1241c2ef4855f782829630b5dfea0b5ee64a8a
8878bfedd760d2b890a0c7979d06850f45090fbcf75faa3cfae8f8787479516b
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
89fe196f6c521041a812cb0d53fa6406a67e93cc8510708b6bfbdbf73b31ab58
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8a9c46f4371f29ded6f345238dd688515240c3da12b3a220f4f734e7066bb284
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
9cac88b67d1b3afa01e752210ac090d4f6d27026c5aac1e4f2e2e17f5f8761c4
9d69ca47893b26f772e30164769510f520d5dcd417101216d1df2767bf1ef4c5
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a6bfc62c8e653fb944b2a6937d2822241c304fa49bbe90ede334a582385f47e1
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
abe1d647582e0c5e0a7d415fc21d503b39d8aa64750baa9f6a6caca0c5fb9532
abf31ba16b325faa040f59a8be64bb8f12aaadfb7dc6a8b8f40d9f136878426d
ac52eaa4abea0750cf1cb2adbd1ea79c4aa810ad824d519010934de5f09ac2ef
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad8caeb7b64eea0fb1ab370dfd8bebfbfccd7bef986abd415f7a495a09a8e1f0
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c973e560f381f97d448c8e8adc173843f60f1922192a1eaaf81a57fd7a5099e1
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7db3ac042c15868e3c056ca476b6796182d2a7e752ae60aebf4ba300311777e
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efad755939e511f2bc1feb0d58d6014006e8598a4d431f27a66dd59e14fc19cb
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408
f81a622d5550eb9220a609e964745dca5fa20a4b36594863a916a46af58eeb4b
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f
fe1b5ee4652156a40232c891663c006c57bb16f4a17558f6c8c2fb3f621fcadf

www.sentinelone.com Open in urlscan Pro 104.26.2.18 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

114 Requests

94 %HTTPS

44 %IPv6

36 Domains

51 Subdomains

44 IPs

6 Countries

2025 kBTransfer

6297 kBSize

46 Cookies

30 Outgoing links

Page URL History

Redirected requests

114 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.sentinelone.com Open in urlscan Pro
104.26.2.18 Public Scan

Screenshot
Live screenshot

Full Image

114
Requests

94 %
HTTPS

44 %
IPv6

36
Domains

51
Subdomains

44
IPs

6
Countries

2025 kB
Transfer

6297 kB
Size

46
Cookies

114 HTTP transactions
5 data transactions