www.darkreading.com Open in urlscan Pro
104.16.222.171 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u33254697.ct.sendgrid.net/ls/click?upn=u001.rfmZKoSIQF-2FqHrRaNSBoLyZyudywnusJBn8MtOW7L5q3U9Y3ZmDdEnvZOHzikjJxiOc9-2BMehV0...
Effective URL:
https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Submission: On September 07 via api (September 7th 2024, 6:35:59 pm UTC) from IL — Scanned from IL

Summary HTTP 187 Redirects Links 39 Behaviour Indicators

Summary

This website contacted 44 IPs in 5 countries across 30 domains to perform 187 HTTP transactions. The main IP is 104.16.222.171, located in and belongs to CLOUDFLARENET, US. The main domain is www.darkreading.com. The Cisco Umbrella rank of the primary domain is 160544.
TLS certificate: Issued by WE1 on August 15th 2024. Valid for: 3 months.

This is the only time www.darkreading.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.118.106 167.89.118.106	11377 (SENDGRID) (SENDGRID)
60	104.16.222.171 104.16.222.171	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1	142.250.186.170 142.250.186.170	15169 (GOOGLE) (GOOGLE)
2	34.111.115.90 34.111.115.90	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	104.18.86.42 104.18.86.42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2	157.240.251.9 157.240.251.9	32934 (FACEBOOK) (FACEBOOK)
1	157.240.251.174 157.240.251.174	32934 (FACEBOOK) (FACEBOOK)
1	104.16.79.73 104.16.79.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.217.23.115 172.217.23.115	15169 (GOOGLE) (GOOGLE)
1	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	104.18.32.137 104.18.32.137	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	142.250.186.40 142.250.186.40	15169 (GOOGLE) (GOOGLE)
1 1	142.250.186.110 142.250.186.110	15169 (GOOGLE) (GOOGLE)
1	142.250.186.174 142.250.186.174	15169 (GOOGLE) (GOOGLE)
4	108.138.36.72 108.138.36.72	16509 (AMAZON-02) (AMAZON-02)
10	142.250.186.78 142.250.186.78	15169 (GOOGLE) (GOOGLE)
1	142.250.74.193 142.250.74.193	15169 (GOOGLE) (GOOGLE)
2	99.81.203.230 99.81.203.230	16509 (AMAZON-02) (AMAZON-02)
2	54.77.181.128 54.77.181.128	16509 (AMAZON-02) (AMAZON-02)
4	142.250.181.225 142.250.181.225	15169 (GOOGLE) (GOOGLE)
5	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
7	23.35.237.151 23.35.237.151	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.18.37.149 104.18.37.149	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.85.65.109 52.85.65.109	16509 (AMAZON-02) (AMAZON-02)
2	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	130.162.160.243 130.162.160.243	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
6	18.210.65.35 18.210.65.35	14618 (AMAZON-AES) (AMAZON-AES)
1	52.85.94.151 52.85.94.151	16509 (AMAZON-02) (AMAZON-02)
1	104.18.39.181 104.18.39.181	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.239.94.35 18.239.94.35	16509 (AMAZON-02) (AMAZON-02)
1	142.250.74.206 142.250.74.206	15169 (GOOGLE) (GOOGLE)
1	74.125.71.155 74.125.71.155	15169 (GOOGLE) (GOOGLE)
1	142.250.184.195 142.250.184.195	15169 (GOOGLE) (GOOGLE)
1	52.85.65.13 52.85.65.13	16509 (AMAZON-02) (AMAZON-02)
1	18.173.187.64 18.173.187.64	16509 (AMAZON-02) (AMAZON-02)
2	13.227.219.71 13.227.219.71	16509 (AMAZON-02) (AMAZON-02)
1	54.81.180.79 54.81.180.79	14618 (AMAZON-AES) (AMAZON-AES)
2	104.16.224.171 104.16.224.171	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.158.12.58 18.158.12.58	16509 (AMAZON-02) (AMAZON-02)
1	18.66.112.79 18.66.112.79	16509 (AMAZON-02) (AMAZON-02)
1	162.247.243.39 162.247.243.39	54113 (FASTLY) (FASTLY)
1	142.250.185.100 142.250.185.100	15169 (GOOGLE) (GOOGLE)
2	185.221.87.23 185.221.87.23	54113 (FASTLY) (FASTLY)
187	44

1 167.89.118.106 (Las Vegas, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789118x106.outbound-mail.sendgrid.net

u33254697.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

60 104.16.222.171 (None, )

ASN13335 (CLOUDFLARENET, US)

www.darkreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.66.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

eu-images.contentstack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.115.90 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 90.115.111.34.bc.googleusercontent.com

loader.bridged.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.18.86.42 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.251.9 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.251.174 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: instagram-p42-shv-01-fra5.fbcdn.net

www.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.79.73 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.23.115 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f19.1e100.net

gateway.bridged.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.32.137 (None, )

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.40 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.110 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f14.1e100.net

www3.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f14.1e100.net

marketingplatform.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 108.138.36.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-36-72.muc50.r.cloudfront.net

static.iris.informa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.186.78 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.193 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f1.1e100.net

52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.81.203.230 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-203-230.eu-west-1.compute.amazonaws.com

cognito-identity.eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.77.181.128 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-181-128.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.181.225 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.35.237.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-151.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.37.149 (None, )

ASN13335 (CLOUDFLARENET, US)

api.iiris.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.85.65.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-65-109.muc50.r.cloudfront.net

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.162.160.243 (Slough, United Kingdom)

ASN31898 (ORACLE-BMC-31898, US)

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.210.65.35 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-210-65-35.compute-1.amazonaws.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.94.151 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-94-151.muc50.r.cloudfront.net

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.39.181 (None, )

ASN13335 (CLOUDFLARENET, US)

6600d6d98e534115970f9529a45f3195.js.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.94.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-94-35.ams1.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.206 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.71.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wn-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net

www.google.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.65.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-65-13.muc50.r.cloudfront.net

cdn.treasuredata.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.187.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-64.muc50.r.cloudfront.net

assets.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.227.219.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-71.ams54.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.81.180.79 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-180-79.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.224.171 (None, )

ASN13335 (CLOUDFLARENET, US)

c.darkreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.158.12.58 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-12-58.eu-central-1.compute.amazonaws.com

eu01.in.treasuredata.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-79.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.243.39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.221.87.23 (Ireland)

ASN54113 (FASTLY, US)

bam.eu01.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	darkreading.com www.darkreading.com — Cisco Umbrella Rank: 160544 c.darkreading.com	710 KB
16	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 280 www3.doubleclick.net — Cisco Umbrella Rank: 19709 stats.g.doubleclick.net — Cisco Umbrella Rank: 252	203 KB
13	google.com marketingplatform.google.com — Cisco Umbrella Rank: 12212 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 662 www.google.com — Cisco Umbrella Rank: 10 Failed analytics.google.com — Cisco Umbrella Rank: 238	77 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 554	292 KB
10	adsafeprotected.com pixel.adsafeprotected.com — Cisco Umbrella Rank: 1139 static.adsafeprotected.com — Cisco Umbrella Rank: 1040 dt.adsafeprotected.com — Cisco Umbrella Rank: 974	109 KB
10	googlesyndication.com 52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 203 pagead2.googlesyndication.com — Cisco Umbrella Rank: 157	194 KB
10	contentstack.com eu-images.contentstack.com — Cisco Umbrella Rank: 55547	356 KB
8	moatads.com z.moatads.com — Cisco Umbrella Rank: 1247 mb.moatads.com — Cisco Umbrella Rank: 1987 px.moatads.com — Cisco Umbrella Rank: 1015	116 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	295 KB
5	bridged.media loader.bridged.media — Cisco Umbrella Rank: 690332 gateway.bridged.media — Cisco Umbrella Rank: 519360	211 KB
4	informa.com static.iris.informa.com — Cisco Umbrella Rank: 162926	2 MB
3	treasuredata.com cdn.treasuredata.com — Cisco Umbrella Rank: 19054 eu01.in.treasuredata.com — Cisco Umbrella Rank: 53304	20 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 1335 script.hotjar.com — Cisco Umbrella Rank: 2017	65 KB
2	nr-data.net bam.eu01.nr-data.net — Cisco Umbrella Rank: 11782	992 B
2	ubembed.com 6600d6d98e534115970f9529a45f3195.js.ubembed.com — Cisco Umbrella Rank: 740539 assets.ubembed.com — Cisco Umbrella Rank: 26103	50 KB
2	ml314.com ml314.com — Cisco Umbrella Rank: 3108 in.ml314.com Failed	13 KB
2	iiris.com api.iiris.com — Cisco Umbrella Rank: 385150	2 KB
2	amazonaws.com cognito-identity.eu-west-1.amazonaws.com — Cisco Umbrella Rank: 6547	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	89 KB
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 1453	32 KB
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 4716	231 B
1	chartbeat.net ping.chartbeat.net — Cisco Umbrella Rank: 1859	201 B
1	google.co.il www.google.co.il — Cisco Umbrella Rank: 18481	408 B
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 2461	15 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 1019	316 B
1	gstatic.com fonts.gstatic.com	48 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1223	7 KB
1	instagram.com www.instagram.com — Cisco Umbrella Rank: 1555	22 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
1	sendgrid.net 1 redirects u33254697.ct.sendgrid.net	303 B
187	30

	Domain	Requested by
60	www.darkreading.com	www.darkreading.com
14	securepubads.g.doubleclick.net	www.darkreading.com pagead2.googlesyndication.com
12	cdn.cookielaw.org	www.darkreading.com
10	fundingchoicesmessages.google.com	www.darkreading.com
10	eu-images.contentstack.com	www.darkreading.com
6	dt.adsafeprotected.com	www.darkreading.com
6	px.moatads.com	www.darkreading.com
5	pagead2.googlesyndication.com	securepubads.g.doubleclick.net www.darkreading.com pagead2.googlesyndication.com
5	www.googletagmanager.com	www.darkreading.com
4	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.darkreading.com
4	static.iris.informa.com	www.darkreading.com
3	gateway.bridged.media	www.darkreading.com
2	bam.eu01.nr-data.net	www.darkreading.com
2	eu01.in.treasuredata.com	www.darkreading.com
2	c.darkreading.com	static.iris.informa.com
2	script.hotjar.com	www.darkreading.com
2	ml314.com	z.moatads.com ml314.com
2	static.adsafeprotected.com	pixel.adsafeprotected.com www.darkreading.com
2	api.iiris.com	www.darkreading.com
2	pixel.adsafeprotected.com	www.darkreading.com
2	cognito-identity.eu-west-1.amazonaws.com	www.darkreading.com
2	connect.facebook.net	www.darkreading.com
2	loader.bridged.media	www.darkreading.com
1	js-agent.newrelic.com	www.darkreading.com
1	vc.hotjar.io	www.darkreading.com
1	ping.chartbeat.net	www.darkreading.com
1	assets.ubembed.com	www.darkreading.com
1	cdn.treasuredata.com	www.darkreading.com
1	www.google.co.il	www.darkreading.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.darkreading.com
1	static.hotjar.com	www.darkreading.com
1	6600d6d98e534115970f9529a45f3195.js.ubembed.com	www.darkreading.com
1	static.chartbeat.com	www.darkreading.com
1	mb.moatads.com	z.moatads.com
1	www.google.com	securepubads.g.doubleclick.net www.darkreading.com
1	z.moatads.com	securepubads.g.doubleclick.net
1	52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com	www.darkreading.com
1	marketingplatform.google.com	www.darkreading.com
1	www3.doubleclick.net	1 redirects
1	geolocation.onetrust.com	www.darkreading.com
1	fonts.gstatic.com	fonts.googleapis.com
1	static.cloudflareinsights.com	www.darkreading.com
1	www.instagram.com	www.darkreading.com
1	fonts.googleapis.com	www.darkreading.com
1	u33254697.ct.sendgrid.net	1 redirects
0	in.ml314.com Failed	ml314.com
187	47

This site contains links to these domains. Also see Links.

Domain
www.informa.com
reg.darkreading.com
dr-resources.darkreading.com
twitter.com
www.linkedin.com
www.facebook.com
www.youtube.com
news.google.com
www.twitter.com
www.reddit.com
en.wikipedia.org
blog.morphisec.com
darkreadingve.tradepub.com
iw-resources.informationweek.com
www.blackhat.com
www.informationweek.com
informationweek.com
info.wrightsmedia.com
www.informatech.com
www.onetrust.com

Subject Issuer	Validity	Valid
www.darkreading.com WE1	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.contentstack.com Gandi RSA Domain Validation Secure Server CA 3	`2024-07-11` - `2025-07-22`	a year	crt.sh
upload.video.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
loader.bridged.media WR3	`2024-07-18` - `2024-10-16`	3 months	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-17` - `2024-09-15`	3 months	crt.sh
*.www.instagram.com DigiCert SHA2 High Assurance Server CA	`2024-06-17` - `2024-09-15`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
gateway.bridged.media WR3	`2024-08-26` - `2024-11-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
static.iris.informa.com Amazon RSA 2048 M03	`2024-06-03` - `2025-07-01`	a year	crt.sh
*.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
cognito-identity.eu-west-1.amazonaws.com Amazon RSA 2048 M02	`2024-04-07` - `2025-05-06`	a year	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2024-02-28` - `2025-03-29`	a year	crt.sh
tpc.googlesyndication.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-25` - `2024-10-24`	a year	crt.sh
api.iiris.com WE1	`2024-08-15` - `2024-11-13`	3 months	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2024-04-25` - `2025-05-24`	a year	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-08-21` - `2024-11-19`	3 months	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2024-06-20` - `2025-07-21`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M03	`2024-04-25` - `2025-05-23`	a year	crt.sh
*.chartbeat.com Thawte TLS RSA CA G1	`2024-05-15` - `2025-06-06`	a year	crt.sh
*.js.ubembed.com E6	`2024-08-09` - `2024-11-07`	3 months	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
*.google.co.il WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.treasuredata.com Amazon RSA 2048 M03	`2024-06-18` - `2025-07-17`	a year	crt.sh
assets.ubembed.com Amazon RSA 2048 M03	`2023-12-06` - `2025-01-03`	a year	crt.sh
*.chartbeat.net Thawte TLS RSA CA G1	`2023-11-20` - `2024-12-20`	a year	crt.sh
c.darkreading.com WE1	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.in.treasuredata.com Amazon RSA 2048 M02	`2024-04-24` - `2025-05-23`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-02-07` - `2025-03-08`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
*.eu01.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2024-07-12` - `2025-07-11`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Frame ID: B3860449AB96D03EB37806571EA15C8F
Requests: 160 HTTP requests in this frame

Frame: https://www.darkreading.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Frame ID: 9F810F9713D08562DC430DDA99565771
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/ns.html?id=GTM-5523ZCM
Frame ID: 551CD51B7F6870207AB7C3350603DEC9
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/ns.html?id=GTM-WB8Q7XR
Frame ID: C9339973A66526F5969B865EE1AF9814
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: FC79EE42CDFF01D4DD9F52C1A48E7495
Requests: 1 HTTP requests in this frame

Frame: https://52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 094AABAF6E23BB2B4D2DEEB04C949000
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=931618&campId=728x90&pubId=4754661352&chanId=22339890152&placementId=6774527496&pubCreative=138487886804&pubOrder=3581601967&cb=2107924365&adsafe_par&impId=
Frame ID: A7A072EDA031D3FADB1BC65EBCF02418
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLDNh4fZBnw1AYxRGbw7AUPm0CAoWZ4BE02mOQgmTUXg3iFP1eTYowMgFS-dENvtqknmj-mMtgg2-paG2w_kESghIsR7QPAhEhOWjYmCPU_mYBUn_gwGE2PRmBpt5KSKzCmP35rzfpFKgoltZ6kHq8PdAjO3wSj-eYV7SHZR7N-r6ebVm0RVH80LEftLLgLMQ7ARWNgrgT_X1Av1YbqnEnL2dAEDh3AXwSvLMPUQTJ8wj44VNoqkIe82lw86PKoQABZUSESCxAEyAI87g-Vk6LdEGW1yF8ZIJcQWyPtdVVE2JUYKaMZv3uQF1nOulfVrGR2yTrtvB7dfr7s2ikBDhPitW_enelLSQaYtlaFWMRX4MzG7YonsCM7UGXlY1Q1Eu4oJqOLzcv3z2vsf7R-Ps8hmnaSQ&sai=AMfl-YRwTaWBAZuzC3_6R9P37YM2Xnoe6CF2Q6p292sGX6NrqL7UAxlKafZy9ZCrL6UGbvhsoccceX047cyvg-RLZ0zeR8jVvdAIAqltfRRw6IQKovirv8DX8NaD6XLN&sig=Cg0ArKJSzP1QZ3MWT4isEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: D33FA59B1B36F66CFCF556D771C3AC51
Requests: 13 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.4.js
Frame ID: A1400B7091C7C0B14402D8835A9AAB2C
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 76499F13A503FFC57F2C4555F1CD97AE
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0E5BA6E2969E91AF0647DF0755F69AE3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BlackCat Spin-off 'Cicada3301' Uses Stolen Creds on the Fly, Skirts EDR

Page URL History Show full URLs

https://u33254697.ct.sendgrid.net/ls/click?upn=u001.rfmZKoSIQF-2FqHrRaNSBoLyZyudywnusJBn8MtOW7L5q3U9Y3ZmDdEnvZ... HTTP 302
https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr Page URL

Detected technologies

Unbounce (Editors) Expand

Overall confidence: 100%
Detected patterns

ubembed\.com

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

chartbeat\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

187
Requests

97 %
HTTPS

0 %
IPv6

30
Domains

47
Subdomains

44
IPs

5
Countries

4574 kB
Transfer

10713 kB
Size

23
Cookies

39 Outgoing links

These are links going to different origins than the main page.

URL: https://www.informa.com/
Title: Informa PLC

Search URL Search Domain Scan URL

URL: https://www.informa.com/about-us/
Title: ABOUT US

Search URL Search Domain Scan URL

URL: https://www.informa.com/investors/
Title: INVESTOR RELATIONS

Search URL Search Domain Scan URL

URL: https://www.informa.com/talent/
Title: TALENT

Search URL Search Domain Scan URL

URL: https://reg.darkreading.com/media-kit?kcode=drsitehd
Title: Advertise

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/free/w_defa3135/prgm.cgi
Title: Newsletter Sign-Up

Search URL Search Domain Scan URL

URL: https://twitter.com/DarkReading

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dark-reading/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/darkreadingcom/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@DarkReadingOfficialYT

Search URL Search Domain Scan URL

URL: https://news.google.com/publications/CAAqBwgKMKmknwswtq63Aw?ceid=US:en&oc=3&hl=en-US&gl=US

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer/sharer.php?u=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Search URL Search Domain Scan URL

URL: http://www.twitter.com/intent/tweet?url=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr&title=BlackCat%20Spin-off%20%27Cicada3301%27%20Uses%20Stolen%20Creds%20on%20the%20Fly%2C%20Skirts%20EDR

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Cicada_3301
Title: 4chan puzzle project

Search URL Search Domain Scan URL

URL: https://blog.morphisec.com/cicada3301-ransomware-threat-analysis
Title: published a report

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_tufi05&ch=SBX&cid=_upcoming_webinars_8.500001471&_mc=_upcoming_webinars_8.500001471
Title: How to Evaluate Hybrid-Cloud Network Policies and Enhance Security

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa6923&ch=SBX&cid=_upcoming_webinars_8.500001477&_mc=_upcoming_webinars_8.500001477
Title: DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_autp86&ch=SBX&cid=_upcoming_webinars_8.500001472&_mc=_upcoming_webinars_8.500001472
Title: Harnessing the Power of Automation to Boost Enterprise Cybersecurity

Search URL Search Domain Scan URL

URL: https://darkreadingve.tradepub.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa6891&ch=SBX&cid=_session_16.500324&_mc=_session_16.500324
Title: State of AI in Cybersecurity: Beyond the Hype

Search URL Search Domain Scan URL

URL: https://iw-resources.informationweek.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa6833&ch=iwkSBX&cid=_session_16.500323&_mc=_session_16.500323
Title: [Virtual Event] The Essential Guide to Cloud Management

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/upcoming.html#europe?cid=_session_16.500321&_mc=_session_16.500321
Title: Black Hat Europe - December 9-12 - Learn More

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/sector/2024/?cid=_session_16.500320&_mc=_session_16.500320
Title: SecTor - Canada's IT Security Conference Oct 22-24 - Learn More

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_cybo171&ch=&cid=_analytics_7.300006016&_mc=_analytics_7.300006016
Title: Managing Third-Party Risk Through Situational Awareness

Search URL Search Domain Scan URL

URL: https://iw-resources.informationweek.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_ingg253&ch=sbx&cid=_analytics_7.300006014&_mc=_analytics_7.300006014
Title: 2024 InformationWeek US IT Salary Report

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/risk-management-security/forrester-total-economic-impact%E2%84%A2-study-team-cymru-pure-signal%E2%84%A2-recon/429373?cid=_analytics_7.300005909&_mc=_analytics_7.300005909
Title: Forrester Total Economic Impact Study: Team Cymru Pure Signal Recon

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/endpoint-security/defending-against-critical-threats/429033?cid=_analytics_7.300005906&_mc=_analytics_7.300005906
Title: Defending Against Critical Threats

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/cloud-security/security-management-and-analytics/sans-institute-survey-the-state-of-cloud-security/427033?cid=_analytics_7.300005899&_mc=_analytics_7.300005899
Title: SANS Institute Survey: The State of Cloud Security

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa6911&ch=SBX&cid=_whitepaper_14.500005782&_mc=_whitepaper_14.500005782
Title: The Anatomy of a Ransomware Attack

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_senu26&ch=SBX&cid=_whitepaper_14.500005772&_mc=_whitepaper_14.500005772
Title: 5 Essential Insights into Generative AI for Security Leaders

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_dels12&ch=SBX&cid=_whitepaper_14.500005745&_mc=_whitepaper_14.500005745
Title: The Future of Passwords and the Passwordless Evolution

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa6742&ch=SBX&cid=_whitepaper_14.500005736&_mc=_whitepaper_14.500005736
Title: Ten Elements of Insider Risk in Highly Regulated Industries

Search URL Search Domain Scan URL

URL: https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_audb61&ch=SBX&cid=_whitepaper_14.500005707&_mc=_whitepaper_14.500005707
Title: The Future of Audit, Risk, and Compliance: Exploring AI's Transformative Impact, Use Cases, and Risks

Search URL Search Domain Scan URL

URL: https://info.wrightsmedia.com/informa-licensing-reprints-request
Title: Reprints

Search URL Search Domain Scan URL

URL: https://www.informatech.com/

Search URL Search Domain Scan URL

URL: https://www.informa.com/privacy-policy/
Title: Privacy|

Search URL Search Domain Scan URL

URL: https://www.informatech.com/terms-and-conditions/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u33254697.ct.sendgrid.net/ls/click?upn=u001.rfmZKoSIQF-2FqHrRaNSBoLyZyudywnusJBn8MtOW7L5q3U9Y3ZmDdEnvZOHzikjJxiOc9-2BMehV0P6Fn307FGnHCMXeGF9u7MJUeJfMwZpq-2BD-2FB54kABWRS3eGT9fkyESAepmS9uKeHvs-2B1XgLY1qaYQ-3D-3D7d9w_xe6fOXjz6id-2FgGyhTJI-2FmntAo0gAdry6sqehMjQCGvDAFtMnlaUWzisPqLcW4KF7wDRDoRuZoUyP0CEv58t6kbvs6pRZgsFW3fOmnqypY7gFI8GMh6-2B-2BbZivtFQXwsPaFf5ZNsAPYLgBT5pJeRxXlZtJft5k7bNNrUsQOmDblXbsE-2FniZuiTqBOdU9ZdZkZckp0nTt5HiuF70YTu8QIY3K4mCPUj46GjvWCosoUUTfU-3D HTTP 302
https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 86

https://www3.doubleclick.net/ HTTP 301
https://marketingplatform.google.com/about/enterprise/

187 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request blackcat-spinoff-cicada3301-stolen-creds-skirts-edr Show response
www.darkreading.com/threat-intelligence/
Redirect Chain

https://u33254697.ct.sendgrid.net/ls/click?upn=u001.rfmZKoSIQF-2FqHrRaNSBoLyZyudywnusJBn8MtOW7L5q3U9Y3ZmDdEnvZOHzikjJxiOc9-2BMehV0P6Fn307FGnHCMXeGF9u7MJUeJfMwZpq-2BD-2FB54kABWRS3eGT9fkyESAepmS9uKeH...
https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

268 KB
52 KB

2324ms
2093ms

Document
text/html

104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

720438a0254f48dd91b936773f96bacff54d181369ea8a8122419c6ca4a70947

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control: public, max-age=300, s-maxage=300, stale-while-revalidate=1500, stale-if-error=3600
cf-cache-status: EXPIRED
cf-ray: 8bf8cd043adcbb3d-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 07 Sep 2024 18:35:51 GMT
last-modified: Sat, 07 Sep 2024 18:35:51 GMT
server: cloudflare
strict-transport-security: max-age=3153600000
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8
Date: Sat, 07 Sep 2024 18:35:49 GMT
Location: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Server: nginx
X-Robots-Tag: noindex, nofollow

GET
H2 200 Cicada-Judith_Bicking-Alamy.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt373d0ecf770a90c9/66d1eb58f580f0a8f2e12fa8/ 4 KB
4 KB 310ms
98ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt373d0ecf770a90c9/66d1eb58f580f0a8f2e12fa8/Cicada-Judith_Bicking-Alamy.jpg?width=1280&auto=webp&quality=10&format=jpg&disable=upscale&blur=40

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

dbdeae2ab0342b9c8c48cb6d50d7ce04e63952dae045a25c2f07e121916b9075

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: img01-europe-west3
x-cache: HIT, HIT
fastly-io-info: ifsz=773569 idim=3072x1728 ifmt=jpeg ofsz=3736 odim=1280x720 ofmt=webp
filename1: custom
content-disposition: inline; filename=Cicada-Judith_Bicking-Alamy.webp
fastly-stats: io=1
content-length: 3736
x-request-id: 2dcfb461c9e1b582f650e9a74f2f1159
x-served-by: cache-ams2100136-AMS, cache-mrs10537-MRS
x-runtime: 123ms
server: contentstack
x-timer: S1725734152.101686,VS0,VE2
x-contentstack-organization: blt5948195ac13977b0
etag: "fj1bhjCPpgpuu1A2aZZ36TSODvbjTwk1+faxcx2SDY8"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 58, 0

GET
H2 200 styles.generated-IVZR5GKI.css
www.darkreading.com/build/_assets/ 9 KB
3 KB 140ms
138ms Stylesheet
text/css 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_assets/styles.generated-IVZR5GKI.css

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00907159439e9ef97101ea78b51d2eb301b245edcd7ecaa75f8e59f76c587794

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708284
etag: W/"22b7-191a27158d8"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd11feb3bb3d-FRA

GET
H2 200 brand.generated-3SPZYPYZ.css
www.darkreading.com/build/_assets/ 481 KB
60 KB 218ms
217ms Stylesheet
text/css 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_assets/brand.generated-3SPZYPYZ.css

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31fb68e4d7b0b92cc6b747869f05294ac0e08fb61c192065d2002be05c1633db

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449355
cf-polished: origSize=494267
etag: W/"78abb-191b2327568"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd11feb6bb3d-FRA

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
1 KB 356ms
120ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

fb121c45f498cba0f88de6e2235d95cf3307bb9ed5376f6a793b8253a520592f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 07 Sep 2024 17:48:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 07 Sep 2024 18:35:52 GMT

GET
H2 200 bridged-agent.js Show response
loader.bridged.media/ 6 KB
6 KB 189ms
63ms Script
text/javascript 34.111.115.90
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://loader.bridged.media/bridged-agent.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.115.90 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 90.115.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b69d75ae81862f19c174d696d8f11743be7c54d92e2a97ede7c4c9c7c352ae79

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:32 GMT
age: 20
x-guploader-uploadid: AD-8ljulJRum1Zgzy1STqxBdcUdwQNFo5Lubv1pn3oKmK3z5zzJEtI_DAPS669BuUEZiBvZwe3I
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5931
last-modified: Fri, 09 Aug 2024 14:10:43 GMT
server: UploadServer
etag: "6d159f76d53b842b4eb505a2a1f642e3"
x-goog-generation: 1723212643368221
x-goog-hash: crc32c=jCYNPA==, md5=bRWfdtU7hCtOtQWiofZC4w==
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public,max-age=60
x-goog-stored-content-length: 5931
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/ 698 KB
127 KB 377ms
145ms Script
application/x-javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/OtAutoBlock.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5bef8c9e1cd6bba25a5e7115d3b7a61a6ce406eaae651a82963069b98f7d39f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 46403
content-md5: 6CFV9VgY0bTzBc3YT/3fgw==
content-length: 129426
x-ms-lease-status: unlocked
last-modified: Wed, 15 May 2024 14:54:00 GMT
server: cloudflare
etag: 0x8DC74EEDACCD490
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 0ceae01a-301e-00a2-12d7-a68cf5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd13691918e2-FRA
expires: Sun, 08 Sep 2024 18:35:52 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 355ms
124ms Script
application/javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50377d1d3e7dcb2c8298feb8d2505099df1957e3700a358b993b4cf443fd36e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: p+39a+/XEcZfNKybQjgXjA==
age: 39158
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Thu, 05 Sep 2024 06:33:12 GMT
server: cloudflare
etag: 0x8DCCD749DA8FD23
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 771b698c-901e-00ec-41c4-ff9bf3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd13691718e2-FRA
expires: Sat, 07 Sep 2024 07:43:13 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 101 KB
31 KB 351ms
128ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

dcb0792224f3d5745ab113919cb43eeb55646033f6f176ece806409ce47bdefd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32173
x-xss-protection: 0
server: cafe
etag: 582 / 19973 / 31086850 / config-hash: 7506296934730633707
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 07 Sep 2024 18:35:52 GMT

GET
H2 200 informaLogoWhite-RZAE7EJI.png
www.darkreading.com/build/_assets/ 2 KB
2 KB 130ms
129ms Image
image/png 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/informaLogoWhite-RZAE7EJI.png

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8b5050c00e65112ae30afa040177c7af59fafecf502c995f29073cc00d06666

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
cf-cache-status: HIT
cf-bgj: imgq:100,h2pri
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=4020
etag: W/"fb4-191a27158d8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
cf-ray: 8bf8cd11feb8bb3d-FRA
content-length: 2114

GET
H2 200 Cicada-Judith_Bicking-Alamy.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt373d0ecf770a90c9/66d1eb58f580f0a8f2e12fa8/ 225 KB
225 KB 217ms
103ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

3d3373fce495fde24561ffd856116f62ac7d42d619a3acffb6556967698bf448

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: img01-europe-west3
x-cache: HIT, HIT
fastly-io-info: ifsz=773569 idim=3072x1728 ifmt=jpeg ofsz=230062 odim=1280x720 ofmt=webp
filename1: custom
content-disposition: inline; filename=Cicada-Judith_Bicking-Alamy.webp
fastly-stats: io=1
content-length: 230062
x-request-id: 2dcfb461c9e1b582f650e9a74f2f1159
x-served-by: cache-ams2100136-AMS, cache-mrs10537-MRS
x-runtime: 123ms
server: contentstack
x-timer: S1725734152.101617,VS0,VE6
x-contentstack-organization: blt5948195ac13977b0
etag: "JhgHxZz/hGwisrngSW4j3yt6oA1v/GLqbcWjd05yO4k"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 60, 0

GET
H2 200 email-decode.min.js Show response
www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
852 B 187ms
187ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 04 Sep 2024 18:15:33 GMT
server: cloudflare
etag: W/"66d8a3c5-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 8bf8cd12cfa1bb3d-FRA
expires: Mon, 09 Sep 2024 18:35:52 GMT

GET
H2 200 manifest-0BD9959E.js Show response
www.darkreading.com/build/ 32 KB
3 KB 141ms
132ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/manifest-0BD9959E.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00d0d315f77b1647d4ee46edbc52e428f5bd6c1c43c9c006ee47f55bc6a83abf

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449340
etag: W/"815d-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ecebb3d-FRA

GET
H2 200 entry.client-VXPJFK4D.js Show response
www.darkreading.com/build/ 462 B
342 B 236ms
227ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/entry.client-VXPJFK4D.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eae0cd3b8a59b8e0a2a8494c2b6cad5abef8647b9e52064c11802a2f8eb959de

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=463
etag: W/"1cf-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ecfbb3d-FRA

GET
H2 200 chunk-XWIFJKM6.js Show response
www.darkreading.com/build/_shared/ 40 KB
13 KB 144ms
135ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-XWIFJKM6.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c99753a9a0b95a19d14edb17048794e536ab0ac8782f0953e208b6a567dcb4d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=41413
etag: W/"a1c5-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ed1bb3d-FRA

GET
H2 200 chunk-2MCAGYUB.js Show response
www.darkreading.com/build/_shared/ 214 KB
69 KB 150ms
141ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-2MCAGYUB.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eec75e095590cdb68f03a5bae61904050fd1a4763c1c3be62e3b92c406a3c42f

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=219386
etag: W/"358fa-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ed5bb3d-FRA

GET
H2 200 chunk-63EVRDSK.js Show response
www.darkreading.com/build/_shared/ 7 KB
3 KB 141ms
132ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-63EVRDSK.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbd7ba9c2af7dabc67644196dacd718139ba839fb3d1c232169c48929dac551a

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=6881
etag: W/"1ae1-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ed6bb3d-FRA

GET
H2 200 chunk-ADMCF34Z.js Show response
www.darkreading.com/build/_shared/ 953 B
634 B 138ms
130ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-ADMCF34Z.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79611d23ecaa67700bdea21cd1c64be8f870003ce33517e2a3b8be885823982d

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707874
cf-polished: origSize=954
etag: W/"3ba-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ed7bb3d-FRA

GET
H2 200 chunk-EU6TSQJG.js Show response
www.darkreading.com/build/_shared/ 2 KB
870 B 202ms
193ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-EU6TSQJG.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20cbb68c751096ffcc7228c8264d233c80ef2a40a2a25acbcbeb53a3c7b0d524

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707874
cf-polished: origSize=1765
etag: W/"6e5-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd121ed8bb3d-FRA

GET
H2 200 chunk-RZRUW7QG.js Show response
www.darkreading.com/build/_shared/ 99 B
181 B 235ms
227ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-RZRUW7QG.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f0ebb3d-FRA

GET
H2 200 chunk-CZQQJKCG.js Show response
www.darkreading.com/build/_shared/ 99 B
155 B 235ms
227ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-CZQQJKCG.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f13bb3d-FRA

GET
H2 200 chunk-B7M2L5OV.js Show response
www.darkreading.com/build/_shared/ 99 B
155 B 235ms
227ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-B7M2L5OV.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f15bb3d-FRA

GET
H2 200 chunk-M7CDCU4D.js Show response
www.darkreading.com/build/_shared/ 11 KB
3 KB 236ms
228ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-M7CDCU4D.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c9fcde0c447d7b2157aaed5d5357a229701b1c039c8db2c29a177ab4cbc54e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 448671
cf-polished: origSize=10983
etag: W/"2ae7-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f16bb3d-FRA

GET
H2 200 chunk-KJV55BTC.js Show response
www.darkreading.com/build/_shared/ 1 KB
780 B 242ms
234ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-KJV55BTC.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1fefe3e1740472b885c24e10d9565282a72fb5246200d912dc7d58b235e90b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449255
cf-polished: origSize=1387
etag: W/"56b-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f17bb3d-FRA

GET
H2 200 chunk-R6EIBCBL.js Show response
www.darkreading.com/build/_shared/ 99 B
161 B 235ms
228ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-R6EIBCBL.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708277
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f18bb3d-FRA

GET
H2 200 chunk-VZQVWFLO.js Show response
www.darkreading.com/build/_shared/ 99 B
175 B 237ms
230ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-VZQVWFLO.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707174
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f19bb3d-FRA

GET
H2 200 chunk-SQAZXDZA.js Show response
www.darkreading.com/build/_shared/ 99 B
157 B 244ms
237ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-SQAZXDZA.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f1bbb3d-FRA

GET
H2 200 chunk-DA6QKOVK.js Show response
www.darkreading.com/build/_shared/ 99 B
170 B 237ms
231ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-DA6QKOVK.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f1dbb3d-FRA

GET
H2 200 chunk-S5DNVYOS.js Show response
www.darkreading.com/build/_shared/ 3 KB
1 KB 235ms
229ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-S5DNVYOS.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d99c7cd015a2b0f6f2afbc42a0ff4d9a6fb9c9958268f24367aa2794757b17aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449335
cf-polished: origSize=3453
etag: W/"d7d-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f1ebb3d-FRA

GET
H2 200 chunk-QVUW3IXO.js Show response
www.darkreading.com/build/_shared/ 99 B
186 B 241ms
235ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-QVUW3IXO.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f1fbb3d-FRA

GET
H2 200 chunk-SDR4T2CD.js Show response
www.darkreading.com/build/_shared/ 99 B
182 B 247ms
242ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-SDR4T2CD.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f21bb3d-FRA

GET
H2 200 chunk-JUNOZNL4.js Show response
www.darkreading.com/build/_shared/ 3 KB
1 KB 281ms
275ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-JUNOZNL4.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b28623c3480c73b59c37a94a307f3e37f22852adde2f7bc4fe83f6b53a152d23

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449336
cf-polished: origSize=3056
etag: W/"bf0-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f23bb3d-FRA

GET
H2 200 chunk-LNKKOLIM.js Show response
www.darkreading.com/build/_shared/ 2 MB
440 KB 248ms
243ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-LNKKOLIM.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

829af6717d377a2b0873b2bf0e58ea1f032c852bc022acf4ca9c17e93681c9c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449341
cf-polished: origSize=1788366
etag: W/"1b49ce-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f25bb3d-FRA

GET
H2 200 chunk-3ALGTY57.js Show response
www.darkreading.com/build/_shared/ 8 KB
4 KB 245ms
240ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-3ALGTY57.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba4e35ef406aaa468df2936fc0472ea6c984bb3df0c4e49d76e3d98e287eac00

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=8196
etag: W/"2004-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f26bb3d-FRA

GET
H2 200 root-BPGHJHKP.js Show response
www.darkreading.com/build/ 35 KB
11 KB 244ms
239ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/root-BPGHJHKP.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7cc8aa97498f881cfe4a6cc5df8ff00c0428e6955dd25f6650fd3982ac5b2456

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449340
cf-polished: origSize=35398
etag: W/"8a46-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f27bb3d-FRA

GET
H2 200 chunk-ED7QE4BI.js Show response
www.darkreading.com/build/_shared/ 142 B
223 B 241ms
237ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-ED7QE4BI.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a41b31d3fc11a54b030a945602bfb18ff6fb5e7dd4272bd93b1494419fc20d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=143
etag: W/"8f-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f28bb3d-FRA

GET
H2 200 chunk-2G2O46IK.js Show response
www.darkreading.com/build/_shared/ 2 KB
928 B 242ms
238ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-2G2O46IK.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe14b8073d94d21cdd7cb1c66e53583a0ea561d9edd39cce8291cb8371086d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449336
cf-polished: origSize=1953
etag: W/"7a1-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f29bb3d-FRA

GET
H2 200 chunk-JSR73AOE.js Show response
www.darkreading.com/build/_shared/ 99 B
157 B 234ms
230ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-JSR73AOE.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f2abb3d-FRA

GET
H2 200 chunk-FIFDB6A4.js Show response
www.darkreading.com/build/_shared/ 1 KB
625 B 242ms
238ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-FIFDB6A4.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a49e1d9c398771a9e944c3c920933a6791a83bd4943766504c71c0acc6ece8e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 448671
cf-polished: origSize=1105
etag: W/"451-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f2bbb3d-FRA

GET
H2 200 chunk-COPCHEM7.js Show response
www.darkreading.com/build/_shared/ 9 KB
3 KB 235ms
231ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-COPCHEM7.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4ffef72a63fe8bf8e68873d8ec01dfaaca5d58846d07ea6db2fdcd207d350e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449339
cf-polished: origSize=8950
etag: W/"22f6-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f2cbb3d-FRA

GET
H2 200 chunk-QPUO7ORA.js Show response
www.darkreading.com/build/_shared/ 4 KB
2 KB 240ms
236ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-QPUO7ORA.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3772fa8fe35f266712e4ccf5ad06bc31947eb2387a59fe2b33f76aff24135acd

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 448671
cf-polished: origSize=4095
etag: W/"fff-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f2ebb3d-FRA

GET
H2 200 chunk-XEAQFNTY.js Show response
www.darkreading.com/build/_shared/ 3 KB
1 KB 237ms
234ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-XEAQFNTY.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36d100d1554b961d54f7af19c2ce10fd92e4480a3481d339e5e3ce20a970d276

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449254
cf-polished: origSize=3232
etag: W/"ca0-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f31bb3d-FRA

GET
H2 200 chunk-XSIMHDNJ.js Show response
www.darkreading.com/build/_shared/ 962 B
644 B 240ms
236ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-XSIMHDNJ.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

272da51ef5fce973cda220f688487b7585e2fc2aefad2d34508d20a4a493e0c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 448848
cf-polished: origSize=963
etag: W/"3c3-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f32bb3d-FRA

GET
H2 200 chunk-7WX3BG7O.js Show response
www.darkreading.com/build/_shared/ 594 B
433 B 238ms
235ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-7WX3BG7O.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2aa218236f7f4a84cf7078e8b3015b981a39802358c465c520329dfe3a93c6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707931
cf-polished: origSize=595
etag: W/"253-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f33bb3d-FRA

GET
H2 200 chunk-FX3MPRDA.js Show response
www.darkreading.com/build/_shared/ 955 B
549 B 240ms
237ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-FX3MPRDA.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d6e76e1083bfb34b269e2975a61eff471414ee974fef8f8700cac19fe334804

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 449255
cf-polished: origSize=956
etag: W/"3bc-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f36bb3d-FRA

GET
H2 200 chunk-IJ353W5V.js Show response
www.darkreading.com/build/_shared/ 99 B
157 B 245ms
242ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-IJ353W5V.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f37bb3d-FRA

GET
H2 200 chunk-O5OSGOEN.js Show response
www.darkreading.com/build/_shared/ 99 B
157 B 245ms
242ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_shared/chunk-O5OSGOEN.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708308
cf-polished: origSize=100
etag: W/"64-191a27158d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f39bb3d-FRA

GET
H2 200 $topic.$slug._index-CDENFDH4.js Show response
www.darkreading.com/build/routes/ 63 KB
21 KB 235ms
232ms Script
application/javascript 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/routes/$topic.$slug._index-CDENFDH4.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42c5ee092bc5589dc18cc56a407d52a37869b35dc9bbe5195fe503e31ce617d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 10:05:37 GMT
server: cloudflare
age: 448467
cf-polished: origSize=64219
etag: W/"fadb-191b2327568"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd124f3bbb3d-FRA

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 224ms
109ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

9de5761fc6870deefd28dc5df2f67f6eacbc99bb2a04a8e3f6eaee3620bcdba0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 07 Sep 2024 18:35:52 GMT
content-md5: jLH3lZwhLrX4tFh8gctioA==
document-policy: force-load-at-top
x-fb-server-load: 38
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1685
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=107, rtx=0, c=24, mss=1232, tbw=8033, tp=13, tpl=0, uplat=0, ullat=-1
x-fb-debug: 2ClzUDykAPMzzRDf9DAnbEqOuCdaTqGSJIz4eYieOw8ByxMzr+weVEZDbujhEL18O5IB/IAbpTmp/3/umowZcQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 3e9cf7e9a65bfd0a0f1297d711782a31
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "2a77e6e43bc630143f30907c2657cbf3"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Sat, 07 Sep 2024 18:46:17 GMT

GET
H2 200 embed.js Show response
www.instagram.com/ 57 KB
22 KB 474ms
228ms Script
application/x-javascript 157.240.251.174
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.instagram.com/embed.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.174 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

instagram-p42-shv-01-fra5.fbcdn.net

Software

Resource Hash

13835ce83acea684f7bb4105ff87e1fb52e6be755d3cffb75bf50457654e3778

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: zstd
x-content-type-options: nosniff
date: Sat, 07 Sep 2024 18:35:52 GMT
content-md5: 4XuVfYAzlxqoiDqNQoea2g==
document-policy: force-load-at-top
edge-control: cache-maxage=1200s
x-fb-server-load: 66
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 20627
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.instagram.com/error/ig_web_error_reports/?device_level=unknown", permissions_policy="https://www.instagram.com/error/ig_web_error_reports/"
x-fb-debug: bkOrISVgcds15J1pQDMhwyH+jO+QitHvPafyqvBR7m5Az/OvVT7nVYm0Jw4IfuLQL8aE+A9X/lpwIIk6olr2fQ==
x-fb-content-md5: 75fb0852919331c479b1eedd14c455cc
x-stack: www
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "188ff5651ea5471a9b17e0a81d171327"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?1
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(self), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(self), gyroscope=(self), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Sat, 07 Sep 2024 18:55:52 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 399ms
164ms Script
text/javascript 104.16.79.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.79.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://www.darkreading.com/
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8bf8cd16d85a9bfb-FRA

GET
H2 200 BridgedAgentVersion Show response
gateway.bridged.media/Configurations/ 105 B
295 B 693ms
445ms Fetch
application/json 172.217.23.115
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.bridged.media/Configurations/BridgedAgentVersion?hostname=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.115 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s45-in-f19.1e100.net
Software: Google Frontend / Express
Resource Hash: 42760af362a128e1b6f67f00960576edc43f3891410d7084e6c96dba8dfd2a6d

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
server: Google Frontend
x-powered-by: Express
etag: W/"69-LbRj7xwby+3WV6lHP5nMkAnpUd8"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 05fe73b6f643af7df7b1690c1052f456
content-length: 105

GET
H2 200 4b083961-e2ac-4755-8801-f7c83a5fb187.json Show response
cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/ 6 KB
3 KB 359ms
139ms XHR
application/x-javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/4b083961-e2ac-4755-8801-f7c83a5fb187.json

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30ac95fbea6ac28a43d8b4a46f7a694d4f52bf97e7e910e548f29b8376393cf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 37736
content-md5: hC36EuFyPoi+34xrtwLkcQ==
content-length: 1995
x-ms-lease-status: unlocked
last-modified: Wed, 15 May 2024 14:53:59 GMT
server: cloudflare
etag: 0x8DC74EEDA46A11C
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 6fc27e9d-c01e-0052-22d7-a65c9b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd16b911bbe5-FRA
expires: Sun, 08 Sep 2024 18:35:52 GMT

GET
H2 200 Bars-F4G2A5NO.svg
www.darkreading.com/build/_assets/ 554 B
342 B 129ms
129ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Bars-F4G2A5NO.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e4d00cfee02d472b0c80124f87c00a8cb8ea5610201ebbf922d894d2fea4db1

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"22a-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599cbbb3d-FRA

GET
H2 200 Search-T2ANYVG5.svg
www.darkreading.com/build/_assets/ 493 B
368 B 129ms
129ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Search-T2ANYVG5.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

592356a6c52e99185da7862c1bc4929308efd3618e8f1c8e1dd665abf205ee62

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"1ed-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599ccbb3d-FRA

GET
H2 200 ChevronDown-PF4EH6J6.svg
www.darkreading.com/build/_assets/ 449 B
346 B 132ms
132ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/ChevronDown-PF4EH6J6.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

882c0ef9f4096af29e037f9ba9dcbc71a46605828ae12a77002c0fa5e00c309a

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"1c1-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599cdbb3d-FRA

GET
H2 200 Clock-MSX4SBCD.svg
www.darkreading.com/build/_assets/ 471 B
400 B 126ms
126ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Clock-MSX4SBCD.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae59b218ab2a4bdc90c9da5d696d7c14eb10c26ddfe9882dc74f4e4e0deb7255

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 706973
etag: W/"1d7-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599d0bb3d-FRA

GET
H2 200 Linkedin-VQUF3EEQ.svg
www.darkreading.com/build/_assets/ 400 B
418 B 125ms
124ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Linkedin-VQUF3EEQ.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fe6411146e7aabcda85d71ec42eabe4fe5fb199f0e9ad759bfa78a42a853535

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"190-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599d2bb3d-FRA

GET
H2 200 Facebook-CJB5G2HY.svg
www.darkreading.com/build/_assets/ 272 B
276 B 127ms
126ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Facebook-CJB5G2HY.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58016ccef8b151b18ba8a751a7666689dcb78facc25a8710434d2e8629a83142

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707874
etag: W/"110-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599d4bb3d-FRA

GET
H2 200 Twitter-WD5AOEQ7.svg
www.darkreading.com/build/_assets/ 404 B
343 B 133ms
132ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Twitter-WD5AOEQ7.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f35a67f2129d433d9a690160ea7f637686033f5055199a7788f1bb500fe0e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707874
etag: W/"194-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd1599d6bb3d-FRA

GET
H2 200 Email-47H7P533.svg
www.darkreading.com/build/_assets/ 777 B
520 B 132ms
131ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Email-47H7P533.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ef59df86d3826ee2048c7707b14be9a819ffe3ce87ca7e989511ac24e447812

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707910
etag: W/"309-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15a9d9bb3d-FRA

GET
H2 200 Reddit-5TRN6TDE.svg
www.darkreading.com/build/_assets/ 1 KB
678 B 127ms
127ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Reddit-5TRN6TDE.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7dd61f31dd9d4d1b9e2b24e139ddcaef62287a13664cdb50544ea421f1a1899

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"471-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15a9dcbb3d-FRA

GET
H2 200 Printer-U5RDBVFZ.svg
www.darkreading.com/build/_assets/ 741 B
532 B 135ms
135ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Printer-U5RDBVFZ.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b75529201e97f7566ae404c0bd803c64ce29092a13c8e1893369ef3c32c6337

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708283
etag: W/"2e5-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15a9ddbb3d-FRA

GET
H2 200 ChalkBoard-7VYJPH3F.svg
www.darkreading.com/build/_assets/ 752 B
477 B 138ms
137ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/ChalkBoard-7VYJPH3F.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62eee22f7f92913689361d7cad70e166c1f0fe52937c1269996cffaa712e60f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"2f0-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15a9e0bb3d-FRA

GET
H2 200 ChevronRight-W5LPP5NG.svg
www.darkreading.com/build/_assets/ 305 B
281 B 178ms
177ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/ChevronRight-W5LPP5NG.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8a03522223cf64474a1f91e02c8069ea5560a23266b37b476d7602a621f0c38

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707974
etag: W/"131-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa28bb3d-FRA

GET
H2 200 Date-KJRS72FO.svg
www.darkreading.com/build/_assets/ 1 KB
504 B 177ms
177ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Date-KJRS72FO.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed870769c4fd967977ef0930a14927ac6035d0a9fcd9db0bcef385da69bea2eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 707974
etag: W/"54d-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa2bbb3d-FRA

GET
H2 200 Document-NG4YMZFA.svg
www.darkreading.com/build/_assets/ 801 B
427 B 182ms
181ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Document-NG4YMZFA.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b475b63a797144d91a4b2e34499ab7321bdf6d298d5f1177ec1fa3f5d3b4e0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"321-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa2dbb3d-FRA

GET
H2 200 Youtube-S4PSC4UA.svg
www.darkreading.com/build/_assets/ 570 B
390 B 176ms
175ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/Youtube-S4PSC4UA.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b21643da63b2c4ecc10d42f29531dd1830ea86dc7fa876cf0e0d570b76bbb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"23a-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa2fbb3d-FRA

GET
H2 200 RSS-3XFHIVCK.svg
www.darkreading.com/build/_assets/ 632 B
421 B 174ms
173ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/RSS-3XFHIVCK.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff5c6ccd23219200d1ba0f66c328e5c014b436bc783b6ce18873dd9d6ac216c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708307
etag: W/"278-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa30bb3d-FRA

GET
H2 200 GoogleNews-6O72APW7.svg
www.darkreading.com/build/_assets/ 897 B
559 B 170ms
170ms Image
image/svg+xml 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.darkreading.com/build/_assets/GoogleNews-6O72APW7.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62a683fb450f7fa9845bc05412211a15a4b09b406db0c7fcb6fe2fe18acff1ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
strict-transport-security: max-age=3153600000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708078
etag: W/"381-191a27158d8"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd15fa31bb3d-FRA

GET
H2 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v18/ 47 KB
48 KB 348ms
112ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 05 Sep 2024 17:55:04 GMT
x-content-type-options: nosniff
age: 175248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48444
x-xss-protection: 0
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 05 Sep 2025 17:55:04 GMT

GET
H2 200 Logo_-_Dark_Reading.svg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte9ead971f13c662e/65437029846d7c040a6e588d/ 3 KB
2 KB 111ms
109ms Image
image/svg+xml 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte9ead971f13c662e/65437029846d7c040a6e588d/Logo_-_Dark_Reading.svg?width=476&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

c3c2e2538dd857e04bb340d6230c8eeedca607d219bceba19897333cbd74b4f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-error: not a supported image format
strict-transport-security: max-age=31557600
content-encoding: gzip
fastly-io-served-by: vpop-etou8240194
x-cache: HIT, HIT
filename1: custom
content-disposition: inline; filename=Logo_-_Dark_Reading.svg+xml
fastly-stats: io=1
content-length: 1435
x-request-id: c52d0c3a848e5f0931d90bd47f7b338f
x-served-by: cache-ams2100138-AMS, cache-mrs10537-MRS
x-runtime: 71ms
server: contentstack
x-timer: S1725734153.607161,VS0,VE2
x-contentstack-organization: blt5948195ac13977b0
vary: Accept
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 4163, 0

GET
H2 200 Nate-Nelson_(1).jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt00df7fa701809c8c/64f15c901c6887515143a4d1/ 3 KB
4 KB 98ms
97ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt00df7fa701809c8c/64f15c901c6887515143a4d1/Nate-Nelson_(1).jpg?width=100&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

0f155ecc49cf3427c761b27ef11fcc6d210fb27a9355d70fd5a30e5f1893452a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240194
x-cache: HIT, HIT
fastly-io-info: ifsz=234689 idim=881x923 ifmt=jpeg ofsz=3376 odim=100x105 ofmt=webp
filename1: custom
content-disposition: inline; filename=Nate-Nelson_(1).webp
fastly-stats: io=1
content-length: 3376
x-request-id: 30725167aeba56e69a61b6cb679cc88b
x-served-by: cache-ams2100133-AMS, cache-mrs10537-MRS
x-runtime: 112ms
server: contentstack
x-timer: S1725734153.607103,VS0,VE1
x-contentstack-organization: blt5948195ac13977b0
etag: "qPc4Ej0Icam3tgfIlB+gqtt4GyFe8VrlHnMKfkTmDM4"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 298, 0

GET
H2 200 windows1800_Ascannio_alamy.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt50fbd557ab0a64d9/66ce3a28f61a5f20fbfe2a71/ 25 KB
26 KB 108ms
107ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt50fbd557ab0a64d9/66ce3a28f61a5f20fbfe2a71/windows1800_Ascannio_alamy.jpg?width=700&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

9c648f364816fc44d54ba553e59eebfec6f956cbe9c221a2a9bfacb3565b8944

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240199
x-cache: HIT, HIT
fastly-io-info: ifsz=1823604 idim=6240x3510 ifmt=jpeg ofsz=25858 odim=700x394 ofmt=webp
filename1: custom
content-disposition: inline; filename=windows1800_Ascannio_alamy.webp
fastly-stats: io=1
content-length: 25858
x-request-id: 1c40123b658820c1733ddfc09169e34b
x-served-by: cache-ams2100091-AMS, cache-mrs10537-MRS
x-runtime: 67ms
server: contentstack
x-timer: S1725734153.607650,VS0,VE2
x-contentstack-organization: blt5948195ac13977b0
etag: "HQhPvnTsNM9+LAn4PlEHEz/8P4TV55XdB5oGKTG3sdg"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 47, 0

GET
H2 200 Cellphone(1800)_Tero_Vesalainen_Alamy.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt18a50ff6b6a52cf0/66d079541f48af80ae24730e/ 9 KB
9 KB 99ms
98ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt18a50ff6b6a52cf0/66d079541f48af80ae24730e/Cellphone(1800)_Tero_Vesalainen_Alamy.jpg?width=700&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

73dd8352c22f6c1894b5141e464cf6d3eca974cae966e88b7ec490a061f99538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240196
x-cache: HIT, HIT
fastly-io-info: ifsz=80068 idim=1800x1013 ifmt=jpeg ofsz=8762 odim=700x394 ofmt=webp
filename1: custom
content-disposition: inline; filename=Cellphone(1800)_Tero_Vesalainen_Alamy.webp
fastly-stats: io=1
content-length: 8762
x-request-id: fd8cd679b839ff360dcdcfdd1bb32245
x-served-by: cache-ams2100117-AMS, cache-mrs10537-MRS
x-runtime: 55ms
server: contentstack
x-timer: S1725734153.607675,VS0,VE1
x-contentstack-organization: blt5948195ac13977b0
etag: "u3Wixfwv4upEMX+bvgZnRfMgzFv4aBOPS+YZcH26Ecw"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 16, 0

GET
H2 200 CCTV_control_room_David_Warren_Alamy.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc429850d24d83b73/66cf7a17cdb22185dcad251c/ 47 KB
47 KB 100ms
100ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc429850d24d83b73/66cf7a17cdb22185dcad251c/CCTV_control_room_David_Warren_Alamy.png?width=700&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

7bedfa40d9b703c758256071c557b3939123059342735f66c8a23ac6b63444cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:52 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240197
x-cache: HIT, HIT
fastly-io-info: ifsz=3526366 idim=2342x1316 ifmt=png ofsz=48144 odim=700x393 ofmt=webp
filename1: custom
content-disposition: inline; filename=CCTV_control_room_David_Warren_Alamy.webp
fastly-stats: io=1
content-length: 48144
x-request-id: cebb9b39d24d2b4023d016e574acdca0
x-served-by: cache-ams2100086-AMS, cache-mrs10537-MRS
x-runtime: 52ms
server: contentstack
x-timer: S1725734153.607696,VS0,VE1
x-contentstack-organization: blt5948195ac13977b0
etag: "DdQNtfsnhkTsy2Dj/hDv9i2zIBT7aSBXM0yJ85cMIVc"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 47, 0

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
316 B 383ms
146ms XHR
application/json 104.18.32.137
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.32.137 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff10c1fe39489bf9f57c9dc9e8ccc064dfdfd4dec949636d5deeba2a8f2da2f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 8bf8cd19497b4dcd-FRA
access-control-allow-headers: Content-Type

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 305 KB
87 KB 238ms
119ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=9429e3d3eae3e5d2511fdd6d77ffe09c

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

93e85be27eea7299d8af517f64e6bb38425373b848ffb3dae3c13806ee67f5e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 07 Sep 2024 18:35:53 GMT
content-md5: tVwCkcdNGjEdJ4nSDlC4Pg==
document-policy: force-load-at-top
x-fb-server-load: 58
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 89217
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=116, rtx=0, c=24, mss=1232, tbw=8034, tp=13, tpl=0, uplat=0, ullat=-1
x-fb-debug: 9xGXa+s+ISe71SuaCj/NnX+9FXCn671d0up893YbqRSKXTXFnRAF6oRCvxZscaectk4Kimc/AmclkLkjc0aAXg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 5d763b8ef5d0a9d35028b6ddfb8116d1
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "4aeef640d63d0705df56703cac8f7ffd"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Sun, 07 Sep 2025 16:16:22 GMT

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/ 477 KB
149 KB 114ms
113ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/pubads_impl.js?cb=31086850

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

425a554d2e5e61aa00622f973658f00e847bb629ab1968c464b8a78dbb6e4bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 15:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12813
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 152196
x-xss-protection: 0
server: cafe
etag: 16641026690796185551
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sun, 07 Sep 2025 15:02:19 GMT

GET main.js
www.darkreading.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame 9F81 0
0

GET
H2 200 Nate-Nelson_(1).jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt00df7fa701809c8c/64f15c901c6887515143a4d1/ 34 KB
34 KB 97ms
96ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt00df7fa701809c8c/64f15c901c6887515143a4d1/Nate-Nelson_(1).jpg?width=400&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/build/_shared/chunk-2MCAGYUB.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

2deefa30437796b66867cb9f98f24cb81a0c86c217efc3fe1878e99d05aa7fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240194
x-cache: HIT, HIT
fastly-io-info: ifsz=234689 idim=881x923 ifmt=jpeg ofsz=34424 odim=400x419 ofmt=webp
filename1: custom
content-disposition: inline; filename=Nate-Nelson_(1).webp
fastly-stats: io=1
content-length: 34424
x-request-id: 7674af22ac670905066f125096e98896
x-served-by: cache-ams2100133-AMS, cache-mrs10537-MRS
x-runtime: 125ms
server: contentstack
x-timer: S1725734153.052988,VS0,VE1
x-contentstack-organization: blt5948195ac13977b0
etag: "pIRvw9z7DNHi5RzuiQAsbHWcaGZRQn0S0LNPfjz9vso"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 162, 0

GET
H2 200 Logo_-_Dark_Reading.svg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6aed714e279eeb34/6542104467527c040a9b2014/ 3 KB
2 KB 97ms
97ms Image
image/svg+xml 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6aed714e279eeb34/6542104467527c040a9b2014/Logo_-_Dark_Reading.svg?width=700&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/build/_shared/chunk-2MCAGYUB.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

c3c2e2538dd857e04bb340d6230c8eeedca607d219bceba19897333cbd74b4f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
via: 1.1 varnish, 1.1 varnish
fastly-io-error: not a supported image format
strict-transport-security: max-age=31557600
content-encoding: gzip
fastly-io-served-by: img01-europe-west3
x-cache: HIT, HIT
filename1: custom
content-disposition: inline; filename=Logo_-_Dark_Reading.svg+xml
fastly-stats: io=1
content-length: 1435
x-request-id: a5d8e1cfd0296f366530307427ea01b0
x-served-by: cache-ams2100132-AMS, cache-mrs10537-MRS
x-runtime: 66ms
server: contentstack
x-timer: S1725734153.073332,VS0,VE2
x-contentstack-organization: blt5948195ac13977b0
vary: Accept
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 39, 0

GET
H2 200 InformaTechBTYB_240x60.webp
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte88e1a0b459f2cef/6500460020e2ed10ea731cb1/ 3 KB
4 KB 97ms
97ms Image
image/webp 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte88e1a0b459f2cef/6500460020e2ed10ea731cb1/InformaTechBTYB_240x60.webp?width=700&auto=webp&quality=80&disable=upscale

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/build/_shared/chunk-2MCAGYUB.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

contentstack /

Resource Hash

1e4cf50411cbc9b156d5c372320c2c8b01a8d441958e4b271ad78215529218bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=31557600
fastly-io-served-by: vpop-etou8240196
x-cache: HIT, HIT
fastly-io-info: ifsz=3188 idim=240x60 ifmt=webp ofsz=3188 odim=240x60 ofmt=webp
filename1: custom
content-disposition: inline; filename=InformaTechBTYB_240x60.webp
fastly-stats: io=1
content-length: 3188
fastly-io-warning: Failed to shrink image
x-served-by: cache-ams21031-AMS, cache-mrs10537-MRS
x-runtime: 70ms
x-request-id: 64ed0edfda98c42ce7efa0b7899f0741
server: contentstack
x-timer: S1725734153.075749,VS0,VE2
x-contentstack-organization: blt5948195ac13977b0
etag: "pkD6a0Rma21em3P5Mv4CkA4qBMXy9RPt+bBYq5Z3qQo"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: content-disposition, content-type, cache-control, status, content-length
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 7417, 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 398 KB
117 KB 491ms
255ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5523ZCM

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

daf9b7be98c1057d539b7222ab50700ed2ba9550ef72c2cfb9b5e7ab283056ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119772
x-xss-protection: 0
last-modified: Sat, 07 Sep 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 07 Sep 2024 18:35:53 GMT

GET
H2 200 ns.html
www.googletagmanager.com/ Frame 551C 0
0 362ms
129ms Document
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/ns.html?id=GTM-5523ZCM

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
content-length: 92
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 18:35:53 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
vary: *
x-xss-protection: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 236 KB
80 KB 363ms
129ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WB8Q7XR

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4c55d392bdb65697ff55914eec8ef5ded828bfa114328546fae2032e73ded866

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81947
x-xss-protection: 0
last-modified: Sat, 07 Sep 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 07 Sep 2024 18:35:53 GMT

GET
H2 200 ns.html
www.googletagmanager.com/ Frame C933 0
0 350ms
120ms Document
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/ns.html?id=GTM-WB8Q7XR

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
content-length: 92
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 18:35:53 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
vary: *
x-xss-protection: 0

HEAD
H2

200

/
marketingplatform.google.com/about/enterprise/
Redirect Chain

https://www3.doubleclick.net/
https://marketingplatform.google.com/about/enterprise/

0
0

360ms
121ms

Fetch
text/html

142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://marketingplatform.google.com/about/enterprise/
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Server: 142.250.186.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f14.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Redirect headers

date: Sat, 07 Sep 2024 18:15:57 GMT
x-content-type-options: nosniff
server: sffe
age: 1196
content-type: text/html; charset=UTF-8
location: https://marketingplatform.google.com/about/enterprise/
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 251
x-xss-protection: 0
expires: Sat, 07 Sep 2024 18:45:57 GMT

GET
H2 200 iris-recommend.js Show response
static.iris.informa.com/widgets/v3/ 1 MB
1 MB 526ms
278ms Script
application/javascript 108.138.36.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.iris.informa.com/widgets/v3/iris-recommend.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-72.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e56bb0d75fa46f23163c334f4ec6675e9a9ad2784ea5ead53d7ceb05eb4b366b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
x-amz-version-id: BLu_4EL7s2BnJnIDD_tjWsvN9a4lpwKO
via: 1.1 f52fb277cecd3d7de14d996c1f683de2.cloudfront.net (CloudFront)
last-modified: Mon, 15 Jul 2024 12:06:25 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
etag: "5553b13bebc131b16ba395c1ea5fe299"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 1518697
x-amz-cf-id: NPLY9NsJqdc76faSn7i-hraFrZ0VjRSpF-FquvJdcWCTG9QXMcNzsQ==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202404.1.0/ 448 KB
109 KB 122ms
122ms Script
application/javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05c58c759cab8d50d5e7f9d3b2faedcc0dd45fa3fb50899a224363a1dea93605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: OwLk2N0IZ0eq8ykUTltEhw==
age: 74079
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 111077
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:54:14 GMT
server: cloudflare
etag: 0x8DCA5E1D524AD71
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 4785b082-901e-0046-71cb-d74d1c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd1a296118e2-FRA

GET
H2 200 3834 Show response
fundingchoicesmessages.google.com/i/ 206 KB
68 KB 377ms
141ms Script
application/javascript 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/3834?ers=3

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

8ca1e264e9d970f404cff959829ce838d535d2026544fdee48bb17af600a1c2c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-nTldVaapT16WMypBA-em0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-nTldVaapT16WMypBA-em0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjitDikmJw1pBiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMT3111ifQ7Eez9eYj0KxEI8HJ27Pm1jE5ix-t1iJiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyMTA0sDUz0D4_gCAwBZBzuk"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/018e79f4-7697-7cda-87bd-d0d91bc43d15/ 82 KB
21 KB 167ms
166ms Fetch
application/x-javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/4b083961-e2ac-4755-8801-f7c83a5fb187/018e79f4-7697-7cda-87bd-d0d91bc43d15/en.json

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d540c85801b5de9689fce95411faef96a619a804977579078a576ce0911926d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 12670
content-md5: 1gn3LZzkukOr0CrGmImGeQ==
content-length: 20994
x-ms-lease-status: unlocked
last-modified: Wed, 15 May 2024 14:54:10 GMT
server: cloudflare
etag: 0x8DC74EEE0AF3C68
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 21688851-901e-0086-2ed7-a615bb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd1b2e98bbe5-FRA
expires: Sun, 08 Sep 2024 18:35:53 GMT

GET
H2 200 bridged-loader.js Show response
loader.bridged.media/v1.60.9/ 204 KB
205 KB 62ms
61ms Script
text/javascript 34.111.115.90
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://loader.bridged.media/v1.60.9/bridged-loader.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.115.90 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 90.115.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 1c65520ea75c36a59b1960495950b83368b63b2b4a543ef604540a241ec54238

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:24:01 GMT
age: 712
x-guploader-uploadid: AD-8lju_T14LX_m9lSHV-UE2ihsTp5aE5pBcO9oOd5xqtTGBIn1_KSwwqaGw5gOCF7VujfrHSg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 209095
last-modified: Thu, 05 Sep 2024 13:17:42 GMT
server: UploadServer
etag: "9a266e9b575d32dde40663ed6b91c821"
x-goog-generation: 1725542262085680
x-goog-hash: crc32c=8gMA1Q==, md5=miZum1ddMt3kBmPta5HIIQ==
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public,max-age=3600
x-goog-stored-content-length: 209095
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 otFloatingRoundedIcon.json Show response
cdn.cookielaw.org/scripttemplates/202404.1.0/assets/ 16 KB
4 KB 146ms
146ms Fetch
application/json 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/otFloatingRoundedIcon.json

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31556181b378d1e27d769a0c4bd113d5957786a8381b08a214b4d949fef5face

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: WZ+o9E7yd9fHl8KJxq40hg==
age: 42002
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3828
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:54:08 GMT
server: cloudflare
etag: 0x8DCA5E1D177D547
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9d2de344-401e-0088-41c9-e92b53000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd1c7fccbbe5-FRA

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202404.1.0/assets/v2/ 64 KB
13 KB 125ms
124ms Fetch
application/json 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/v2/otPcPanel.json

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14a1fa4b518b9bcff7664518a2f8cd4d91205d82d58c87a9bf5553da729e3ea2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 9fUyEwIYwWMBHnNwB9fqDA==
age: 42002
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12886
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:54:09 GMT
server: cloudflare
etag: 0x8DCA5E1D24E5859
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: c1697ae3-201e-0093-125b-d805c1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd1c7fcebbe5-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202404.1.0/assets/ 24 KB
4 KB 139ms
139ms Fetch
text/css 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/otCommonStyles.css

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: 4ErYmXXFNbMLrnc9DrDTsg==
age: 37736
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:54:20 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 2bb59586-a01e-0023-0ae7-d7fc41000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8bf8cd1c7fcfbbe5-FRA

OPTIONS
H2 204 LoaderJSConfigurations
gateway.bridged.media/Campaign/ Frame 0
0 132ms
131ms Preflight
text/html 172.217.23.115
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.bridged.media/Campaign/LoaderJSConfigurations
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.115 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s45-in-f19.1e100.net
Software: Google Frontend / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.darkreading.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
content-length: 0
content-type: text/html
date: Sat, 07 Sep 2024 18:35:53 GMT
server: Google Frontend
vary: Access-Control-Request-Headers
x-cloud-trace-context: e996479eff5e7eda937dca4798341d24
x-powered-by: Express

POST
H2 201 LoaderJSConfigurations Show response
gateway.bridged.media/Campaign/ 74 B
195 B 565ms
562ms Fetch
application/json 172.217.23.115
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.bridged.media/Campaign/LoaderJSConfigurations
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.115 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s45-in-f19.1e100.net
Software: Google Frontend / Express
Resource Hash: f5265b1ee7810702404d81885a6310959e7ff538e0396f0eea68259faed75212

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
server: Google Frontend
x-powered-by: Express
etag: W/"4a-pVA7X6++z5gugCTUTDURlpm9No0"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: b27b1d9fa2bbb49abdf891267f17fbe0
content-length: 74

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 123ms
123ms Image
image/svg+xml 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 10785
x-ms-lease-status: unlocked
last-modified: Thu, 05 Sep 2024 06:33:14 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: edb13b1b-901e-00a8-0598-ff479f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8bf8cd1d7df918e2-FRA

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
489 B 124ms
124ms Fetch
image/svg+xml 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 37736
x-ms-lease-status: unlocked
last-modified: Thu, 05 Sep 2024 06:33:13 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: bc36efe4-701e-004c-5c6d-ff5495000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8bf8cd1d88f4bbe5-FRA

GET
H2 200 Informa_Logo_1Line_Indigo_Grad_RGB_(1)_(1).jpg
cdn.cookielaw.org/logos/c1f53e84-9f05-4169-a854-85052b63c50b/2ffb64fa-e393-483d-84e2-2a331bb9122e/6e7e0837-5d54-4f8b-ad38-2515147bf672/ 896 B
1 KB 128ms
128ms Image
image/jpeg 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/c1f53e84-9f05-4169-a854-85052b63c50b/2ffb64fa-e393-483d-84e2-2a331bb9122e/6e7e0837-5d54-4f8b-ad38-2515147bf672/Informa_Logo_1Line_Indigo_Grad_RGB_(1)_(1).jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3969804522a0b32cd9dbe609047076c5a239cf16e0c0ebe4b8c71c812c53b9f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Hi//myLOtJxrHC7ESjrzhQ==
age: 35138
content-length: 896
x-ms-lease-status: unlocked
cf-bgj: h2pri
last-modified: Wed, 06 Dec 2023 23:27:26 GMT
server: cloudflare
etag: 0x8DBF6B2E896EF40
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 9a8a0762-f01e-0092-4ccb-71bd55000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8bf8cd1d8e1818e2-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 126ms
126ms Image
image/svg+xml 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 07 Sep 2024 18:35:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 65763
x-ms-lease-status: unlocked
last-modified: Thu, 05 Sep 2024 06:33:14 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: f2de5db3-801e-001d-04ce-ff4a60000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8bf8cd1d9e1a18e2-FRA

GET
H2 200 AGSKWxXQkVaHCIqEW9fiyresAWy8foyCjv_4JE8D38HZ1dU6G4Ewnky2aSN568-XeCKx7_RUcMfMH80QFFVMLl8KCqdUNIqTboovCzwB3kO2hU9c-6PdXmy55r8k71zLr3LODAcTz-HSxQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 132ms
131ms Script
application/javascript 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXQkVaHCIqEW9fiyresAWy8foyCjv_4JE8D38HZ1dU6G4Ewnky2aSN568-XeCKx7_RUcMfMH80QFFVMLl8KCqdUNIqTboovCzwB3kO2hU9c-6PdXmy55r8k71zLr3LODAcTz-HSxQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI1NzM0MTUzLDkwNzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tL3RocmVhdC1pbnRlbGxpZ2VuY2UvYmxhY2tjYXQtc3Bpbm9mZi1jaWNhZGEzMzAxLXN0b2xlbi1jcmVkcy1za2lydHMtZWRyIixudWxsLFtbOCwiN2stajRVQnQwTk0iXSxbOSwiaXciXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

d506df4ecb2a61c6c0a1a8c9bdcb94cb6032a7f4aafeac15235d3c0622031629

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oM8xELzS4WKUElxlDAQckA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:53 GMT
content-security-policy: script-src 'report-sample' 'nonce-oM8xELzS4WKUElxlDAQckA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjitDikmII1pBiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMT3111ifQ7Eez9eYj0KxEI8HJ27Pm1jE5hx-9BlZiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyMTA0sDUz0D4_gCAwBrFjvp"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame FC79 0
0 330ms
112ms Document
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 320
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29367
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 18:30:34 GMT
expires: Sat, 07 Sep 2024 19:20:34 GMT
last-modified: Mon, 26 Aug 2024 19:48:13 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 967 B
518 B 156ms
156ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734153974&lmt=1725734151&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1600x5968&msz=1600x0&fws=0&ohw=0&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e55&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dbigsky_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don&adks=2064109412&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

cffd69c68b4284aeb7920d9f1d7a6faf12bf93b52774fc7f688aeae1be422314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 488
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 787 B
367 B 151ms
151ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=2&sfv=1-0-40&ists=1&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734153985&lmt=1725734151&adxs=800&adys=299&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1036x5301&msz=1036x0&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e56&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dwallpaper_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=3568718387&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

dd95975e29f2e629c0fdcc68e7a0a68229c0f0ef081a634cccb8705a7ad2c6df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 337
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 787 B
371 B 166ms
166ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=3&sfv=1-0-40&ists=1&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734153990&lmt=1725734151&adxs=800&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1036x5301&msz=1036x1&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e57&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Doop_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=4281914279&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

8ec46b18a40650b7b852d08e95cbc81c59e677bc4ccaf3db7514fd4226c54f5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 341
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 787 B
372 B 151ms
151ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=4&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734153993&lmt=1725734151&adxs=800&adys=301&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1036x5301&msz=1036x1&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e58&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dfloor_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=1131225635&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

51946d8864a58143d85de6496bc55ff5eda3e23b2894ff7bde5c1721038d58bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 342
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 787 B
370 B 158ms
157ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=5&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734153996&lmt=1725734151&adxs=800&adys=5550&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1036x5301&msz=1036x1&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e59&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dadhesion_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=3728273033&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

90e8c4d16b6b7fd68df8c6cea5be4f076cf83487ad9f7bfb5bef51c54d8ca4e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 340
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 094A 0
0 366ms
119ms Document
text/html 142.250.74.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.193 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 18:35:54 GMT
expires: Sat, 07 Sep 2024 18:35:54 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 84 KB
19 KB 159ms
159ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=6&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734154312&lmt=1725734151&adxs=436&adys=274&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=1036x5303&msz=1036x50&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e5a&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3D728_1v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=206257688&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

b8ab512c10de26c64fa61cc6ff621848274c4ee09578d2bf1f90ed1c53e325b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19345
x-xss-protection: 0
google-lineitem-id: 6774527496
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138487886804
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 787 B
375 B 148ms
147ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=5x5&ifi=7&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734154314&lmt=1725734151&adxs=1154&adys=588&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=324x37&msz=324x5&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e5b&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dresource_v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=630980475&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

67c3a76057046e3ea92ec65308fdba7f6782f2f77088192818f95e9d6fb3cda9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 790 B
371 B 157ms
156ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x100%7C300x250%7C300x600&ifi=8&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734154317&lmt=1725734151&adxs=1006&adys=672&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=324x4820&msz=324x100&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e5c&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3D300_1v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=2192439130&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

7f5c967f662151c1967ec3baa5f62ad5b6f92c9d52f41066f9cdd547ceed5f54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 340
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 790 B
372 B 157ms
157ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2427910690890232&correlator=3962402779670131&eid=31086850%2C95341333&output=ldjh&gdfp_req=1&vrg=202409040101&ptt=17&impl=fif&gdpr=0&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cthreat-intelligence&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=320x50&fluid=height&ifi=9&sfv=1-0-40&eri=32&sc=1&cookie_enabled=1&abxe=1&dt=1725734154319&lmt=1725734151&adxs=1156&adys=1144&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=180&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&vis=1&psz=324x1044&msz=324x0&fws=4&ohw=1600&td=1&egid=53706&tan=eef87a80-e7b5-42a2-864a-deeb8d260e5d&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1725734151840&idt=1421&prev_scp=pos%3Dnative_vertical_1v%26ptype%3Darticle%26nid%3Dbltd149f755c194dee9%26aid%3D160967%26reg%3Danonymous&cust_params=welcad%3Doff%26gdpr_banner%3Don%26pterm%3Dthreat-intelligence%26sterm%3Dendpoint-security%252C%2520cyber-risk%252C%2520cyberattacks-data-breaches%26contentFormat%3Dnews%26contributor%3Dnate-nelson-contributing-writer%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse&adks=921769895&frm=20&eoidce=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

0b5487a17501f9238d230de63f56070b70592f67e9f14c844605d4600a0446e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 341
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 /
cognito-identity.eu-west-1.amazonaws.com/ Frame 0
0 379ms
123ms Preflight 99.81.203.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cognito-identity.eu-west-1.amazonaws.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.81.203.230 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-99-81-203-230.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-amz-target
Access-Control-Request-Method: POST
Origin: https://www.darkreading.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-amz-target
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
access-control-max-age: 172800
content-length: 0
date: Sat, 07 Sep 2024 18:35:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amzn-requestid: 6001c790-9fba-4035-b5d2-2a16347a31e7

POST
H2 200 / Show response
cognito-identity.eu-west-1.amazonaws.com/ 2 KB
2 KB 150ms
149ms XHR
application/x-amz-json-1.1 99.81.203.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cognito-identity.eu-west-1.amazonaws.com/

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.81.203.230 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-99-81-203-230.eu-west-1.compute.amazonaws.com

Software

Resource Hash

74bb46c1b88ad27186911e3fc25fbbef3bdeb12e6cc85699bd58a538eb09cd13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.darkreading.com/
X-Amz-Target: AWSCognitoIdentityService.GetCredentialsForIdentity
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-amz-json-1.1

Response headers

access-control-allow-origin: *
date: Sat, 07 Sep 2024 18:35:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
x-amzn-requestid: efb2fef0-aaed-4548-a0de-fb54b434c092
content-length: 1780
content-type: application/x-amz-json-1.1

GET
H3 200 AGSKWxVjwMaTvQ1Cyq417hwTiPdGbDDefmClfNJAqc-EZsOF_ib1Y34cENQZsxruKICcidBMbDlBGvhVigszaSVmH8rbMpnH998bUZDSZoAM3Mny_-uytEkHwh-tq62u_eZeqshWEfhapQ== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 137ms
136ms Script
application/javascript 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVjwMaTvQ1Cyq417hwTiPdGbDDefmClfNJAqc-EZsOF_ib1Y34cENQZsxruKICcidBMbDlBGvhVigszaSVmH8rbMpnH998bUZDSZoAM3Mny_-uytEkHwh-tq62u_eZeqshWEfhapQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI1NzM0MTU0LDM4OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vd3d3LmRhcmtyZWFkaW5nLmNvbS90aHJlYXQtaW50ZWxsaWdlbmNlL2JsYWNrY2F0LXNwaW5vZmYtY2ljYWRhMzMwMS1zdG9sZW4tY3JlZHMtc2tpcnRzLWVkciIsbnVsbCxbWzgsIjdrLWo0VUJ0ME5NIl0sWzksIml3Il0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

6c9307ad52e158ea2906d2835fa885687a96e814af27ea75f9fb7b99cfa27b81

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-fX-tYHn9MuEvVsCQOUTyrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-fX-tYHn9MuEvVsCQOUTyrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStDikmJw0JBiOO90h-k6EEt8fcmkBsRO6TNYA4C49eY51slAnPTvPGsBELtrXWT1B-IlERdZDyReZDVUuMRqD8SqPZdYjYH4_rpLrM-BeO_HS6xHgViIh6Nr16dtbAIP5h-6y6ikkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkYmBpYKpnYBxfYAAAOUk--Q"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame A7A0 61 KB
15 KB 655ms
128ms Script
application/javascript 54.77.181.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=931618&campId=728x90&pubId=4754661352&chanId=22339890152&placementId=6774527496&pubCreative=138487886804&pubOrder=3581601967&cb=2107924365&adsafe_par&impId=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.181.128 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-181-128.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: adb12889b35f0c4429f3d6468469a58378f9b4bcbd088d5c754eb1229edfc597

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:55 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D33F 0
0 145ms
145ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLDNh4fZBnw1AYxRGbw7AUPm0CAoWZ4BE02mOQgmTUXg3iFP1eTYowMgFS-dENvtqknmj-mMtgg2-paG2w_kESghIsR7QPAhEhOWjYmCPU_mYBUn_gwGE2PRmBpt5KSKzCmP35rzfpFKgoltZ6kHq8PdAjO3wSj-eYV7SHZR7N-r6ebVm0RVH80LEftLLgLMQ7ARWNgrgT_X1Av1YbqnEnL2dAEDh3AXwSvLMPUQTJ8wj44VNoqkIe82lw86PKoQABZUSESCxAEyAI87g-Vk6LdEGW1yF8ZIJcQWyPtdVVE2JUYKaMZv3uQF1nOulfVrGR2yTrtvB7dfr7s2ikBDhPitW_enelLSQaYtlaFWMRX4MzG7YonsCM7UGXlY1Q1Eu4oJqOLzcv3z2vsf7R-Ps8hmnaSQ&sai=AMfl-YRwTaWBAZuzC3_6R9P37YM2Xnoe6CF2Q6p292sGX6NrqL7UAxlKafZy9ZCrL6UGbvhsoccceX047cyvg-RLZ0zeR8jVvdAIAqltfRRw6IQKovirv8DX8NaD6XLN&sig=Cg0ArKJSzP1QZ3MWT4isEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240904/r20110914/client/ Frame D33F 3 KB
2 KB 635ms
111ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240904/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/pubads_impl.js?cb=31086850

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f1.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 06 Sep 2024 22:24:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72690
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1229
x-xss-protection: 0
server: cafe
etag: 16544991220582087243
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 20 Sep 2024 22:24:25 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D33F 204 KB
63 KB 632ms
111ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/pubads_impl.js?cb=31086850

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

258daef9a182640e92d363f90b54305e7a38a99655b8117d7bd7658a7fffbfff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 17:44:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3077
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64913
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 07 Sep 2024 18:44:38 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/informagamdisplay218733383007/ Frame D33F 334 KB
114 KB 636ms
113ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://z.moatads.com/informagamdisplay218733383007/moatad.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/pubads_impl.js?cb=31086850

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-237-151.deploy.static.akamaitechnologies.com

Software

Resource Hash

0d34727332063f774893813c408c607378e8bc4fdb149c4240506d68a60e1016

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 07 Sep 2024 18:35:55 GMT
content-md5: QJHNrDBfcXv3UQNbo+QeWQ==
storage-tier: Standard
content-length: 116132
opc-meta-btime: 2024-04-22T05:24:04Z
opc-meta-mtime: 1713763444
last-modified: Mon, 22 Apr 2024 20:15:35 GMT
opc-request-id: iad-1:0ePqpkiK45Yvj5UR2Qr29xNdBalCq2odnuNS3QM0Bev6b-JLQyfqqAN30CBDaa_a
x-api-id: native
etag: 4ce382b0-cbcf-4573-9d8b-73958aee2ed7
vary: Accept-Encoding
access-control-allow-methods: POST,PUT,GET,HEAD,DELETE,OPTIONS
content-type: application/x-javascript
version-id: 4756ac60-173a-40ae-b103-6357ce170256
access-control-allow-origin: *
access-control-expose-headers: accept-ranges,access-control-allow-credentials,access-control-allow-methods,access-control-allow-origin,cache-control,content-encoding,content-length,content-md5,content-type,date,etag,last-modified,opc-client-info,opc-meta-btime,opc-meta-mtime,opc-request-id,storage-tier,strict-transport-security,version-id,x-api-id,x-content-type-options
cache-control: max-age=27401
access-control-allow-credentials: true
accept-ranges: bytes

GET
H2 200 16457152554211595289
tpc.googlesyndication.com/simgad/ Frame D33F 34 KB
35 KB 633ms
112ms Image
image/png 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16457152554211595289

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409040101/pubads_impl.js?cb=31086850

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f1.1e100.net

Software

sffe /

Resource Hash

ca87c74e7427d194095dcdfd1ad4eb62e379c33b217a5cc960c69c57ac24bf56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

allow-fenced-frame-automatic-beacons: true
date: Thu, 05 Sep 2024 04:30:53 GMT
x-content-type-options: nosniff
age: 223502
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35229
x-xss-protection: 0
last-modified: Tue, 03 Sep 2024 15:02:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 05 Sep 2025 04:30:53 GMT

GET l
www.google.com/ads/measurement/ Frame D33F 0
0

GET
DATA 200
OK truncated
/ Frame D33F 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe8b177a639b4cb49be45b148f5919c3e62466a03e101268148ae50fe257e35c

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 darkreading Show response
api.iiris.com/v3/recommend/public/content/similar-items/it/cybersecurity/ 4 KB
2 KB 285ms
285ms XHR
application/json 104.18.37.149
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.iiris.com/v3/recommend/public/content/similar-items/it/cybersecurity/darkreading?item=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&limit=4&mode=db&item_age=12

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.149 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6827842b59fb54f9200f3560355eb95c7dab3a74542cdb96e65403b1ccbb518d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; base-uri 'self'; block-all-mixed-content; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests; require-trusted-types-for 'script'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY, DENY
X-Xss-Protection	1; mode=block, 0

Request headers

Accept: application/json, text/plain, */*
X-Amz-Security-Token: IQoJb3JpZ2luX2VjEAsaCWV1LXdlc3QtMSJIMEYCIQDgpFTTvW1e7CkBeN0Z3HqKQevqLFDTjn6D7NzgCqVfoAIhALLWGylV4AVKsKl5CAGmAvR+XB9ZBKe7Iw1IwOV5LZd/KskFCDQQAxoMMDU2MDQzMTcwODk5IgzQHyBJxE4fn61Xn0EqpgXEm++biLFMpin9qVSXqOIjjTL8bg+DhHTPM2dmZPIo3+0nEsTBl6sepe3DCTixHh70liDFZrnh9q2ZOpnijy7RzrNT1Z0tlR36r5meRXmiLEA+F8fd6qSizCg6FRQrAiP8vIw10JhjnqAja+XZo/IS8PO29HpQuS4KPO2Ak6YM/px6KyW0hsLa5bhUZBGbhPkXxB+VzCkpxGFUJN9ubyRuHzzzc+JoMjOA2ufI37kQNEW6vdApHvtBFS+Ntga+rgQuQRx7HYv+VaT2KMu/bRbTfz4uDTEmkiWZ0WinEEFdYxxIP3IUjX7/iDZ8zydQ+KNjfbx3rXWPVUm1nX9OswspS+cY2gTJ33Q98cnUwh2UKnnOPspRkULc7agBgsBVRFMM4qXXVkxjvF+mcj94csz/T/GyKVS0yhYu1MdrOtzVmwiYROAxpcE48yxZ13kffSbJ73JsnQWkRWbddxAW7KZKmN95+Rxs9kN7xV2qQCXbBe7smJMLeCbNQp/4NFEaVYZLx8cKK6OGafURihXLnrrVQbt3ued6k+zgy90PewJ4tt4TG9P2VJlD1Er/mFQXmdXDPyQIrkITu7QEtxwSeIMdMaFO7dGhOT18n0Jd4KtVR5QAxo3pRgdNUi6UG7hZfXizMaRH4RD+JNLkMqGl29zdeaDcMjfKGjW8dQjU9LhX7HG/XNHTLhj9oCcXN7YnhlpiAf8OO3uLuNFpWkxyReyFj+pGr47GcYNhdOjrh2FmMplhp9FXdVhmM7ajPRvfi9HQGtfDJHTLUzYALGJ3lFtunQwE6hwdMi0EXEgZSIesWOm2hxEChKzF8EhHKiwiu7jaY2aSO8DFpf6pKbk0WnxndeGjOkI52xa4LnvJGMqs14+zLoSONKjd413QTiT2tzftvvUEk9IwirrytgY63AIreKAEO3OjGi0dAH/+npXaGdrKqCHoCyfEW8FNlEIe91wl4RKKDYJg8OPABn2rnQZqGrqK6ZZmamP2LUiP9hOZoZKyhT2WBOgLS2U8ZpS48S6pO0yMH1fQAlmGliJvIKngdHOi3KEeAyptuC8YnXu5yysClVy6/2OpRoV+IoWMmD31rlFqYr1heu6fNk9I3aBH+CwiCZafU5q9xba73/hiHsxz53XwgZWDnshD+fHkQpan3pmURQMegHAJ6Eia/nAytexo7SwC/cEWKCJE7UC7IYLxSBWcmvIqhU0hNUcG1OQXNm4RBmoLq6Qv+xQmrmyDJJ5H4BmkSzP32su18pr8TpwHVr92ywP5FLb1smXjd7sUAZehUyVLOZsQyoHkwJPaI14A+rwNweb6MJ9rBQA3Ax/GA76vC49DVf3IqYJIwmzVKpPOEMkBLoWM4Nm4+UvE9qGEB/Yho6mo2ys=
Referer: https://www.darkreading.com/
x-amz-date: 20240907T183554Z
Authorization: AWS4-HMAC-SHA256 Credential=ASIAQ2DDO5RJRWMRJCQR/20240907/eu-west-1/execute-api/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=67172db7dbd54878ef64d2895d39fdaf62a413ba1771f1ff76cc758f938254d0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
x-amzn-remapped-content-length: 3957
x-amzn-remapped-server: uvicorn
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self'; base-uri 'self'; block-all-mixed-content; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests; require-trusted-types-for 'script'
content-encoding: gzip
cross-origin-embedder-policy: unsafe-none
x-amzn-requestid: 3756bcd5-c695-4748-98a8-92703ac64746
x-amzn-remapped-connection: keep-alive
x-dns-prefetch-control: off
cf-cache-status: DYNAMIC
x-amz-apigw-id: dv151FgBDoEF1Zw=
x-xss-protection: 1; mode=block, 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
cross-origin-opener-policy: unsafe-none
x-download-options: noopen
x-frame-options: DENY, DENY
content-type: application/json
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: no-cache, no-store, must-revalidate,
cf-ray: 8bf8cd27581e3731-FRA
x-amzn-remapped-date: Sat, 07 Sep 2024 18:35:55 GMT
expires: 0

OPTIONS
H2 200 darkreading
api.iiris.com/v3/recommend/public/content/similar-items/it/cybersecurity/ Frame 0
0 443ms
206ms Preflight
application/json 104.18.37.149
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.149 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-amz-date,x-amz-security-token
Access-Control-Request-Method: GET
Origin: https://www.darkreading.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key,application_id,iris_profile_id,sponsor_id
access-control-allow-methods: DELETE,GET,POST,PUT,OPTIONS
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8bf8cd261e443731-FRA
content-length: 0
content-type: application/json
date: Sat, 07 Sep 2024 18:35:55 GMT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-apigw-id: dv15zFBljoEF8xg=
x-amzn-requestid: 7c5c0f2d-7720-4062-b90d-53933cab04d5
x-content-type-options: nosniff

GET
H3 200 adcalloverride.&adv_keywords= Show response
fundingchoicesmessages.google.com/f/AGSKWxVXYMXuPqd0cTiFXej4xW8GuubSKETWK0ie-kv5LsWdKlo1CXG7_g3KerA6eDodIXDS3SrRxiI8irND1pohRpt5zQ2cBA89aJbAKnvE3HIvSn8h1Nt3suT_OkB9lye4AGnczfXfzS2x-9uExhLLaCFAfCz6R... 54 B
109 B 125ms
124ms Script
application/javascript 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVXYMXuPqd0cTiFXej4xW8GuubSKETWK0ie-kv5LsWdKlo1CXG7_g3KerA6eDodIXDS3SrRxiI8irND1pohRpt5zQ2cBA89aJbAKnvE3HIvSn8h1Nt3suT_OkB9lye4AGnczfXfzS2x-9uExhLLaCFAfCz6RhJDCqzFlvpyAuMQTca1_HIg-GuJrb39/_/adixs._sponsor_banners//adzoneleft./adcalloverride.&adv_keywords=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

5ba5891b54f0c6b68d79a2506a7d6b5289ec69c02f26989f5e049f5d2f6c1a0d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Y46ZmevItGbqa6T0U_9oVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Y46ZmevItGbqa6T0U_9oVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStDikmII1JBiOO90h-k6EEt8fcmkBsRO6TNYA4C49eY51slAnPTvPGsBELtrXWT1B-IlERdZDyReZDVUuMRqD8SqPZdYjYH4_rpLrM-BeO_HS6xHgViIm6N716dtbAIfju1NU9JIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDIxsDQw1TMwji8wAAAHHz7E"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 241 KB
75 KB 168ms
168ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c4e5a213636d5ecfe9262e4d194e334e714fbab93b1495bfb0c08a5193398bf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 17:46:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2946
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77015
x-xss-protection: 0
server: cafe
etag: 15674361801618190220
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Sat, 07 Sep 2024 18:46:49 GMT

POST
H3 204 AGSKWxXsKxtDojBEamdDKdgeNH3xcD7g50C_5DvhstZjCB6bUrt5fbmyxLVJmXV2e8kVSXIwtNgjzEyDfd8FyHBQ3_NchJlU9zFrqNOrnMswZ-hTxO1BcLw_nNHjCwccapRPeNioYl0Z2g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 349ms
124ms XHR
text/html 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXsKxtDojBEamdDKdgeNH3xcD7g50C_5DvhstZjCB6bUrt5fbmyxLVJmXV2e8kVSXIwtNgjzEyDfd8FyHBQ3_NchJlU9zFrqNOrnMswZ-hTxO1BcLw_nNHjCwccapRPeNioYl0Z2g==

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-WBNs2LN59Cu2ZL9-XOXTxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-WBNs2LN59Cu2ZL9-XOXTxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1pBicEqfwRoAxO5aF1n9gXhJxEXWA4kXWfd-vMR6FIiFeDi6d33axibwY2PXRUYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGJgaWCqZ2AeX2AAAGzYLmI"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 main.19.8.531.js Show response
static.adsafeprotected.com/ Frame A7A0 231 KB
70 KB 430ms
153ms Script
application/javascript 52.85.65.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.531.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=931618&campId=728x90&pubId=4754661352&chanId=22339890152&placementId=6774527496&pubCreative=138487886804&pubOrder=3581601967&cb=2107924365&adsafe_par&impId=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.65.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-109.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8b0bfdd5f26914dedc882d8608cb6fdd71dde9f1024ffcb9d240697c7b30cfef

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 06 Sep 2024 16:48:38 GMT
x-amz-version-id: hy3o4Xkz8J3vyUSI2acyYIYLAnvOiLWE
content-encoding: gzip
via: 1.1 2f720540a1a9a4394a2f93dffd5c0e5c.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
age: 92838
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 26 Aug 2024 16:19:40 GMT
server: AmazonS3
etag: W/"36f5589e406d9c81ad2a2a4184944426"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: ntBbC2oUBvSuJEmAREdptXOPo87rlf8jwTWVA8OdyfG4TrNdtlj2MA==

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXsKxtDojBEamdDKdgeNH3xcD7g50C_5DvhstZjCB6bUrt5fbmyxLVJmXV2e8kVSXIwtNgjzEyDfd8FyHBQ3_NchJlU9zFrqNOrnMswZ-hTxO1BcLw_nNHjCwccapRPeNioYl0Z2g==

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-UlAwHyyGvDb-8ZYD9vxJrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-UlAwHyyGvDb-8ZYD9vxJrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1pBicEqfwRoAxO5aF1n9gXhJxEXWA4kXWfd-vMR6FIiFeDi6d33axiYwYWfTJUYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGJgaWCqZ2AeX2AAAE6wLfs"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D33F 0
0 370ms
146ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuk00OwaP-L3FYny-j5T0T6E5OBvBqJozCYcvKpGSFGtbV7qg6XxY83q-WU4DWvGoC9eTG4YuKFfP9OAf8jmFKGtldYADy_-Jbo-UGPA3Hon4XGnm1GrRiPggp4zgeaLLM8CWWcdJcj0ExYncOapwNVLFC0XowH8JNT_t0bmUH7qsJy8cHdCT2xArGHpGOIUav7WI8jWEZ2deJjlTehbEMZftYZuAbT83loe7a_oxM8r568JYkTVs_7sH13weTWLBBTC9sZUr4i0sQMKZI2pUBI1qJ97t5_QiXayWXJRjZdxKM4JZVKgMtOFVlxlCnUfEK9bl16QTAZF7gWuIEqcwNoT-qWwKVbvEF1bP4njCbRd6UHlbrPLiTGOpdg4cTuAXezjr_7y6AqUt1EXXBpB0mf-OeGCUDQ&sai=AMfl-YT_pqco9zmE_TdNgW13UuGyvtTRCXMa7BmiFiY4wpcgyzG5A09pSmEW7AmWLlJ7lTZj6LjgQp187BYz_PATXwInbo5RupugJ-8rUmsZEZ2T_vkbjzC7DQ7U98Dc&sig=Cg0ArKJSzBLHYsbzqoGTEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 07 Sep 2024 18:35:55 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D33F 0
0 367ms
143ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tag.aspx Show response
ml314.com/ Frame D33F 38 KB
13 KB 262ms
61ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?782024
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/informagamdisplay218733383007/moatad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 17:43:06 GMT
via: 1.1 google
content-encoding: br
age: 3169
x-guploader-uploadid: AD-8ljtzfanbicOnrY40zEnhVrw2_KfQPhtXPzHeCk-1MD5DXPm3rvBmpKB6gunHuCwIQh2iEa3ZpnImlA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12522
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1721849450340665
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-type: application/javascript
cache-id: TLV-2fd8756e
cache-control: public,max-age=3600
x-cache-hit: hit
x-goog-stored-content-length: 39162
accept-ranges: bytes

GET
H2 200 n.js Show response
mb.moatads.com/ 84 B
262 B 565ms
180ms Script
text/html 130.162.160.243
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/n.js?e=35&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&i=INFORMA_GAM_DISPLAY1&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1725734155372&de=160936163658&m=0&ar=9cc5b3e58a7-clean&iw=b63ee96&q=2&cb=0&ym=0&cu=1725734155372&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&zMoatPS=728_1v&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&bo=22316126855&bp=22339890152&bd=728_1v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&gw=informagamdisplay218733383007&fd=1&it=500&ti=0&ih=2&pe=1%3A4105%3A4105%3A0%3A4119&fs=208210&na=635439489&cs=0&callback=MoatDataJsonpRequest_1242187
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/informagamdisplay218733383007/moatad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.162.160.243 Slough, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 329a79571f5d41fbc3cbddd576f7d3d9112f963e12f500c16b7a736e9ff97994

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
server: istio-envoy
etag: "e4d4e3bea062813a916eba9e043f5cd0890233b4"
content-type: text/html; charset=UTF-8
cache-control: max-age=900
x-envoy-upstream-service-time: 15
timing-allow-origin: *
content-length: 84

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 126ms
111ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=INFORMA_GAM_DISPLAY1&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1725734155372&de=160936163658&m=0&ar=9cc5b3e58a7-clean&iw=b63ee96&q=3&cb=0&ym=0&cu=1725734155372&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&zMoatPS=728_1v&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&bo=22316126855&bp=22339890152&bd=728_1v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&gw=informagamdisplay218733383007&fd=1&it=500&ti=0&ih=2&pe=1%3A4105%3A4105%3A0%3A4119&fs=208210&na=1375998421&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:55 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:55 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXsKxtDojBEamdDKdgeNH3xcD7g50C_5DvhstZjCB6bUrt5fbmyxLVJmXV2e8kVSXIwtNgjzEyDfd8FyHBQ3_NchJlU9zFrqNOrnMswZ-hTxO1BcLw_nNHjCwccapRPeNioYl0Z2g==

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WmusKcShTXRrWyPQVfMfXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: script-src 'report-sample' 'nonce-WmusKcShTXRrWyPQVfMfXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmII0JBicEqfwRoAxO5aF1n9gXhJxEXWA4kXWfd-vMR6FIiFeDi6d33axiYw4UVzC5OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjGwNDDVMzCPLzAAAEz-Les"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXsKxtDojBEamdDKdgeNH3xcD7g50C_5DvhstZjCB6bUrt5fbmyxLVJmXV2e8kVSXIwtNgjzEyDfd8FyHBQ3_NchJlU9zFrqNOrnMswZ-hTxO1BcLw_nNHjCwccapRPeNioYl0Z2g==

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8scpzHDsnsVUiJvulqalww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: script-src 'report-sample' 'nonce-8scpzHDsnsVUiJvulqalww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw05BicEqfwRoAxO5aF1n9gXhJxEXWA4kXWfd-vMR6FIiFeDi6d33axiaw4PaJViYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGJgaWCqZ2AeX2AAAF0xLio"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxU1zadwlmqYvoeb4YNnbFMSx8cJIL4OYJgKeHXmSTywTTzJOjxGPKbGYNgp7rg_v4SnreJxRUUGJFPQDlGA5XoGNlEv-HbSvn3e_ZF-0ugO4ke40yrGowlJ5Yv_s5Rm5TzSyxClxg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 139ms
138ms Script
application/javascript 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU1zadwlmqYvoeb4YNnbFMSx8cJIL4OYJgKeHXmSTywTTzJOjxGPKbGYNgp7rg_v4SnreJxRUUGJFPQDlGA5XoGNlEv-HbSvn3e_ZF-0ugO4ke40yrGowlJ5Yv_s5Rm5TzSyxClxg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI1NzM0MTU1LDQ4MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tL3RocmVhdC1pbnRlbGxpZ2VuY2UvYmxhY2tjYXQtc3Bpbm9mZi1jaWNhZGEzMzAxLXN0b2xlbi1jcmVkcy1za2lydHMtZWRyIixudWxsLFtbOCwiN2stajRVQnQwTk0iXSxbOSwiaXciXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

b51ced2792af47d3fc5c4af61148fd145e39430f0474eb3ef6ac14224662a331

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-7Y8EIb6rjDmtSdI9ClDH6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-7Y8EIb6rjDmtSdI9ClDH6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjitDikmII0JBiOO90h-k6EEt8fcmkBcRO6TNYQ4C49eY51ulAnPTvPGsJELtrXWT1B-IlERdZjyReZDVUuMTqDMT3111ifQ7Eez9eYj0KxEI8HN27Pm1jE9iwqquHSUkjKb8wPjk_r6QoM6m0JL8oLTkttTi1qCy1KN7IwMjEwNLAVM_AOL7AAABPPztP"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 119ms
118ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F16457152554211595289&i=INFORMA_GAM_DISPLAY1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&bq=0&g=0&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=0&gp=0&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&f=0&j=&t=1725734155372&de=160936163658&cu=1725734155372&m=86&ar=9cc5b3e58a7-clean&iw=b63ee96&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=85&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6058&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A4105%3A4105%3A0%3A4119&as=0&ag=30&an=0&gf=30&gg=0&ix=30&ic=30&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=30&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=60&cd=0&ah=60&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&bo=22316126855&bp=22339890152&bd=728_1v&zMoatPS=728_1v&gw=informagamdisplay218733383007&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatDfpSlotId=728_1v&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=208210&na=1529225075&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:55 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:55 GMT

POST
H3 204 AGSKWxUhpxJZWHwxLoCWlRHCg8CupOiHaC_8AbtnW_gPhuS97zUhUnR1eqku9_pLc2cNdCfVdJRxTjddPD4m_fbFf7oLhEnBe5GJSxEpx4NM-NPrT-zz80M1_XzK1evLBkGE-BkqhiDUKA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 125ms
123ms XHR
text/html 142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUhpxJZWHwxLoCWlRHCg8CupOiHaC_8AbtnW_gPhuS97zUhUnR1eqku9_pLc2cNdCfVdJRxTjddPD4m_fbFf7oLhEnBe5GJSxEpx4NM-NPrT-zz80M1_XzK1evLBkGE-BkqhiDUKA==

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jcRm5obc7E1OCbRplyYbRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:55 GMT
content-security-policy: script-src 'report-sample' 'nonce-jcRm5obc7E1OCbRplyYbRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0ZBicEqfwRoAxO5aF1n9gXhJxEXWA4kXWfd-vMR6FIiFeDi6d33axiawYdKNE0xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTA0sBUz8A8vsAAAGb_Lko"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sca.17.6.4.js Show response
static.adsafeprotected.com/ Frame A140 91 KB
23 KB 127ms
127ms Script
application/javascript 52.85.65.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.4.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.65.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-109.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ac42cf20760d5b0f71be7a0391c76020002aa1dcfc75bae782360bf2761db29f

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 06 Sep 2024 16:48:38 GMT
x-amz-version-id: bOtNsqPibVajaDyuqqyqCrhSRcjcC6sa
content-encoding: gzip
via: 1.1 2f720540a1a9a4394a2f93dffd5c0e5c.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P6
age: 92838
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 13 May 2024 16:44:02 GMT
server: AmazonS3
etag: W/"8fa66f8b94450bd040e7b5a7550c52de"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: B7Cd_IazfL8ZIFOFPxS5C3Z3loApq8C6m9E7jZYhfncG7Q1xFe-FbA==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
197 B 132ms
132ms Image
image/gif 54.77.181.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=931618&campId=728x90&pubId=4754661352&chanId=22339890152&placementId=6774527496&pubCreative=138487886804&pubOrder=3581601967&cb=2107924365&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&adsafe_type=abcedq&adsafe_url=https%3A%2F%2Fwww.darkreading.com%2F&adsafe_type=f&adsafe_jsinfo=,id:9ca5213e-cd9f-b0e3-d737-5197fe3810bc,c:nEOy2h,sl:inView,em:true,fr:true,thd:1,mn:jsserver-experiment-primary-7b6ff85854-nd4h5,rg:ie,pt:1-5-15,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,mu:10000,br:c,bru:c,an:n,oam:0,scm:publ1.grpm1,mtim:548,mot:0,app:0,maw:0,tdt:s,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,pl:CV8L.CV8L.CV8L.CV8L.CV8L,rmeas:1,rend:1,renddet:IMG.qs,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:569,oid:046d9d9d-6d48-11ef-9917-462bdffd0f7c,v:19.8.531,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ff:1,ov:0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.181.128 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-181-128.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

p3p: CP="COM NAV INT STA NID OUR IND NOI"
pragma: no-cache
date: Sat, 07 Sep 2024 18:35:55 GMT
cache-control: no-cache
server: Apache-Coyote/1.1
content-length: 43
content-type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
216 B 604ms
187ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOy2y,pingTime:0,time:585,type:pf,sca:%7Blts:2024-09-07%2021.35.55%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:568%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:585,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:568,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B34~100%5D,as:%5B34~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,rmeas:1,rend:1,renddet:IMG.qs,siq:569%7D&br=c
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt59.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 597ms
187ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOy2G,pingTime:-2,time:593,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:724,beZ:725,mfA:1272,cmA:1274,inA:1274,inZ:1278,prA:1278,prZ:1281,si:1293,poA:1293,poZ:1307,cmZ:1307,mfZ:1307,loA:1311,loZ:1313,ltA:1317,ltZ:1317,mdA:726,mdZ:1251%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:true,gcd2:%7Bappl:0,cnst:na%7D%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:568%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:593,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:568,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~100%5D,as:%5B42~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:1,renddet:IMG.qs,siq:569,slid:%5Bgoogle_ads_iframe_/3834/darkreading.home/article/threat-intelligence_5,google_ads_iframe_/3834/darkreading.home/article/threat-intelligence_5__container__,728_1v%5D,sinceFw:23,readyFired:true%7D&br=c
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt49.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 284 KB
98 KB 131ms
130ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-1X1EHQ3PFR&l=dataLayer&cx=c

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

b417abce04733c5db213a46db68308fe82b5201a348850ff9130f6ab3f132bd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:56 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99773
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 07 Sep 2024 18:35:56 GMT

GET
H2 200 iris-t.js Show response
static.iris.informa.com/widgets/v3.0/ 79 KB
79 KB 276ms
276ms Script
application/javascript 108.138.36.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.iris.informa.com/widgets/v3.0/iris-t.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-72.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 35bbaf39a449ccd5f8187d9ad0c345b234b9e0c011ac23ae181cd1e7d308bdc4

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
x-amz-version-id: dlaJotV_Gz4O7cqm42eVJp8uZLGpWllN
via: 1.1 f52fb277cecd3d7de14d996c1f683de2.cloudfront.net (CloudFront)
last-modified: Tue, 30 Jul 2024 11:59:35 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
etag: "fbc10e2b062735815acd18ff52ac647a"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 80499
x-amz-cf-id: XbptcHnbuqTs_sCO6wpujHIsNnvmteoOI2Glt1jgpQf-AI21E_BCfA==

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 38 KB
15 KB 441ms
174ms Script
application/x-javascript 52.85.94.151
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.94.151 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-94-151.muc50.r.cloudfront.net
Software: nginx /
Resource Hash: 3a1f53a72a4ff3c23812f7a06cc3ef3ea1f188046f2c75d9c0b19e1cb2b652a9

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 16:21:26 GMT
content-encoding: gzip
via: 1.1 e5064f6b1acc98fdddfd88a1c074df3e.cloudfront.net (CloudFront)
last-modified: Wed, 05 Jun 2024 00:13:00 GMT
server: nginx
x-amz-cf-pop: MUC50-P6
age: 8070
etag: W/"665fad8c-9895"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-amz-cf-id: WT1mJuM5zJBpEhKfiGHpPZCd-HKIn5sV0RLzpVNbr7WUcZxtJtyozA==
expires: Sun, 08 Sep 2024 16:21:26 GMT

GET
H2 200 / Show response
6600d6d98e534115970f9529a45f3195.js.ubembed.com/ 427 B
687 B 386ms
137ms Script
application/javascript 104.18.39.181
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.39.181 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0293ba0b711b46fdb1f1bb339e888d07ebe611b44871c0ebbe11622308b08bb

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:56 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 249
etag: W/"2b6495353d7977028fc7c081d3fc76ac5109e2e1"
vary: Accept-Encoding, Referer
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate
cf-ray: 8bf8cd2d7cde5d79-FRA

GET
H2 200 hotjar-2610568.js Show response
static.hotjar.com/c/ 17 KB
7 KB 427ms
171ms Script
application/javascript 18.239.94.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2610568.js?sv=6

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.94.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-239-94-35.ams1.r.cloudfront.net

Software

Resource Hash

8bd3bdae06abdf03754bc167e98e1e154f035622f125b12e4d80671b392d8af6

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:56 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 2ef9ad1c8e8d306617a72c1e978a7716.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P3
etag: W/a9e8536e0c3378c2105608edef485389
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: Oya-FVEySf5gvjWy4zpSyVqfHh-5kqe2t310lSn6A1pQe3x37ZCeiA==

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 194ms
189ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOy9b,pingTime:-10,time:997,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi40djEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi40dk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTE4MHx8TW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.4v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200222002220222202,asp:1725734156241%7C%7C5390d2c63d70c95d4bdda105e8f48aba%7C%7C9d1d68e5c1dc3c213377efe8cbc2564a%7C%7C26c2d07c62be6037004db9d0df17cca0%7C%7Cc9d102f1899b263dc4c83218c4c16208%7C%7C9a523d204efcaf2f3d56ac7157b69b03%7C%7C750a7ed6105e12945e3618ef7ae7a88e%7C%7C7ff8e9bfe1c38514915923d674509c5a%7C%7C1715618633%7D
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 204 collect
analytics.google.com/g/ 0
0 353ms
118ms Fetch
text/plain 142.250.74.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-1X1EHQ3PFR&gtm=45je4940v873922772z8891172384za200zb891172384&_p=1725734153056&_gaz=1&gcs=G1--&gcd=13l3l3l3l7l1&npa=1&dma=0&tcfd=10000&tag_exp=0&gdid=dYWJhMj&cid=826330821.1725734156&ul=he-il&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dr=&dl=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&dt=BlackCat%20Spin-off%20%27Cicada3301%27%20Uses%20Stolen%20Creds%20on%20the%20Fly%2C%20Skirts%20EDR&sid=1725734156&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_type=article&ep.content_format=News&ep.content_publish_date=Sep%2003%2C%202024&ep.content_sub_brand=value%20not%20set&ep.content_buyer_journey=value%20not%20set&ep.content_id=bltd149f755c194dee9&ep.content_title=BlackCat%20Spin-off%20%27Cicada3301%27%20Uses%20Stolen%20Creds%20on%20the%20Fly%2C%20Skirts%20EDR&ep.content_legacy_path=value%20not%20set&ep.content_contributor=Nate%20Nelson&ep.content_keyword=value%20not%20set&ep.content_series=value%20not%20set&ep.content_sponsor=value%20not%20set&ep.content_main_topic=Threat%20Intelligence&ep.content_additional_topics=Endpoint%20Security%2CCyber%20Risk%2CCyberattacks%20%26%20Data%20Breaches&ep.gtm_container_detail=GTM-5523ZCM%7C117&ep.ad_unit_path_code=3834%2Fdarkreading.home%2Farticle%2Fthreat-intelligence&ep.content_program=value%20not%20set&ep.content_group=Threat%20Intelligence&ep.content_all_topics=cyber%20risk%7Ccyberattacks%20%26%20data%20breaches%7Cendpoint%20security%7Cthreat%20intelligence&tfd=7799
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s02-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
257 B 354ms
117ms Ping
text/plain 74.125.71.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-1X1EHQ3PFR&cid=826330821.1725734156&gtm=45je4940v873922772z8891172384za200zb891172384&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l7l1&npa=1&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1X1EHQ3PFR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
408 B 389ms
145ms Image
image/gif 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1X1EHQ3PFR&cid=826330821.1725734156&gtm=45je4940v873922772z8891172384za200zb891172384&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l7l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=1551775214

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ZGFya3JlYWRpbmcuY29t.json Show response
static.iris.informa.com/widgets/config/cdl/ 24 B
492 B 503ms
262ms Fetch
binary/octet-stream 108.138.36.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.iris.informa.com/widgets/config/cdl/ZGFya3JlYWRpbmcuY29t.json
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-72.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ced6d94498388b24b48c4e2aa311815357ab9489c735aedd7725e0b18a02433e

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-amz-version-id: rR96SWqxdC6RFg.yCtn7XL4AuxoTa4oV
date: Sat, 07 Sep 2024 18:35:57 GMT
via: 1.1 826a64379fff05f157845c418fee53d2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P2
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-length: 24
last-modified: Tue, 28 Feb 2023 08:49:48 GMT
server: AmazonS3
etag: "d14dcd26bd0521dd67cdde302d3ac4a2"
vary: accept-encoding
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: Ik683jnSX8EkOsRaiIHeOat4IiNCMrg2vpmk6-GoA5S7KV50NdlzUw==

GET
H2 200 sp.js Show response
static.iris.informa.com/widgets/v3.0/sp/v3.21.0/ 77 KB
78 KB 265ms
264ms Script
application/javascript 108.138.36.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.iris.informa.com/widgets/v3.0/sp/v3.21.0/sp.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-72.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 297f7c6e2e5141be50a472401472c07dbe025b762bcad89ffaf795fddbd04fd0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
x-amz-version-id: 1ALvrmwUb4TZErpuiV2ML7ptP6fNjRJ_
via: 1.1 f52fb277cecd3d7de14d996c1f683de2.cloudfront.net (CloudFront)
last-modified: Wed, 05 Jun 2024 10:44:59 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
etag: "365e4a519f91d5dbf473dad2feba1288"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 79216
x-amz-cf-id: D-kpIex1IC_Xts7ewbGn6lNIEtFR1SbB5-iEu9xDCPiIpLcbLi6A2A==

GET
H/1.1 200
OK td.min.js Show response
cdn.treasuredata.com/sdk/3.0/ 58 KB
20 KB 392ms
142ms Script
application/javascript 52.85.65.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.treasuredata.com/sdk/3.0/td.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.65.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-65-13.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 262f87d47643975a4633b675fc224c7a178d99e579e5d767f4a43ca7cc0bb9de

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 00:51:35 GMT
Content-Encoding: gzip
Via: 1.1 1f6c8fca2731ca6abec1a6d565d2093e.cloudfront.net (CloudFront)
Age: 3087862
X-Amz-Cf-Pop: MUC50-P6
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Last-Modified: Mon, 05 Jul 2021 08:58:13 GMT
Server: AmazonS3
Etag: W/"4b9abb36767431f05495228eb82edf01"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=315360000
X-Amz-Cf-Id: 7tTnm4QRm5aJMVo5eX9250SJVnxsI1roqlfYzN4rvFkTT98LGSPc-A==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 114ms
114ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=INFORMA_GAM_DISPLAY1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=0&gp=0&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&f=0&j=&t=1725734155372&de=160936163658&cu=1725734155372&m=1073&ar=9cc5b3e58a7-clean&iw=b63ee96&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=85&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6182&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A4105%3A4105%3A0%3A4119&as=1&ag=1025&an=30&gi=1&gf=1025&gg=30&ix=1025&ic=1025&ez=1&ck=1025&kw=854&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1025&bx=30&ci=1025&jz=854&dj=1&aa=0&ad=925&cn=0&gk=925&gl=0&ik=925&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=854&cd=60&ah=854&am=60&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&bo=22316126855&bp=22339890152&bd=728_1v&zMoatPS=728_1v&gw=informagamdisplay218733383007&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatDfpSlotId=728_1v&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=208210&na=1396548773&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:56 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D33F 42 B
65 B 145ms
145ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssOnK39QrasekMpUEUg0kyqfnLVmm_UnovTtZt_yj7VYb49lPF57InLq823Yi7obVTWLVAkd9DYlcC44ZrcO3TldNf2rjDaqkfXrd6KKthSY_guraDUDfZCMdoQLjC0dpt42Dy8LYpSq0kn2j4aQX1B15MkuywT7RmIs9FF&sig=Cg0ArKJSzP3IjmcPX70FEAE&id=lidar2&mcvt=1003&p=249,436,339,1164&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20240828&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=206257688&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2166695500&rst=1725734154510&rpt=844&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bundle.js Show response
assets.ubembed.com/universalscript/releases/v0.183.0/ 183 KB
49 KB 388ms
141ms Script
application/javascript 18.173.187.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ubembed.com/universalscript/releases/v0.183.0/bundle.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.187.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-187-64.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c39fa609f4a9b43e493115c723b102147f9025008bd24841e7732c5f253edd51

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 24 May 2024 17:52:38 GMT
content-encoding: gzip
via: 1.1 0a93e5f50864322b5cd49038d9c83154.cloudfront.net (CloudFront)
last-modified: Fri, 24 May 2024 17:48:37 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P4
age: 9160999
etag: W/"ce1f9daa5bfa548f0417f378eb40974e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: 9CCpuul9MaBmxruVy70bMkDAzUnG8PhPlSiDVWs7J8i_xLEBu4NgQg==

GET
H2 200 modules.8da33a8f469c3b5ffcec.js Show response
script.hotjar.com/ 223 KB
56 KB 380ms
137ms Script
application/javascript 13.227.219.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.8da33a8f469c3b5ffcec.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-71.ams54.r.cloudfront.net

Software

Resource Hash

76f448ec45359e863fb3a6432a2a3cf22c0cc0a52aead6318b57ab38db6f1d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 14:23:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 3384770
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56385
last-modified: Tue, 30 Jul 2024 14:22:40 GMT
etag: "0728625a147ca79276a1790b9cf3175d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: _xsKNKG-PyPrJ74cNm1tNFC0dwbXRD0QAwrhlqqPsTIUn4USYVxd0Q==

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 588ms
194ms Image
image/gif 54.81.180.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=darkreading.com&p=%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&u=6akwjPaf5yB3jRNR&d=darkreading.com&g=53678&g0=Threat%20Intelligence&g1=Nate%20Nelson&g4=article&n=1&f=00001&c=0&x=0&m=0&y=6182&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&b=8062&t=Gd7jVBbvwSf7zNg0BA9zMIBEMfTp&V=147&i=BlackCat%20Spin-off%20%27Cicada3301%27%20Uses%20Stolen%20Creds%20on%20the%20Fly%2C%20Skirts%20EDR&tz=-180&sn=1&sv=C05kH7CSbRd_dcIskDsYwA6pkXgJ&sr=external&sd=1&im=067b2fff&_
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.81.180.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-180-79.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: 0
pragma: no-cache
date: Sat, 07 Sep 2024 18:35:57 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
content-type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 124ms
124ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=INFORMA_GAM_DISPLAY1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=0&gp=0&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&f=0&j=&t=1725734155372&de=160936163658&cu=1725734155372&m=1074&ar=9cc5b3e58a7-clean&iw=b63ee96&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=85&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6182&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A4105%3A4105%3A0%3A4119&as=1&ag=1025&an=1025&gi=1&gf=1025&gg=1025&ix=1025&ic=1025&ez=1&ck=1025&kw=854&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1025&bx=1025&ci=1025&jz=854&dj=1&aa=0&ad=925&cn=925&gk=925&gl=925&ik=925&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=854&cd=854&ah=854&am=854&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&bo=22316126855&bp=22339890152&bd=728_1v&zMoatPS=728_1v&gw=informagamdisplay218733383007&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatDfpSlotId=728_1v&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=208210&na=1000210351&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:56 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 114ms
114ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=INFORMA_GAM_DISPLAY1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=0&gp=0&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&f=0&j=&t=1725734155372&de=160936163658&cu=1725734155372&m=1074&ar=9cc5b3e58a7-clean&iw=b63ee96&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=85&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6182&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A4105%3A4105%3A0%3A4119&as=1&ag=1025&an=1025&gi=1&gf=1025&gg=1025&ix=1025&ic=1025&ez=1&ck=1025&kw=854&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1025&bx=1025&ci=1025&jz=854&dj=1&aa=0&ad=925&cn=925&gk=925&gl=925&ik=925&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=854&cd=854&ah=854&am=854&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&bo=22316126855&bp=22339890152&bd=728_1v&zMoatPS=728_1v&gw=informagamdisplay218733383007&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatDfpSlotId=728_1v&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=208210&na=639455726&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:56 GMT

OPTIONS
H2 200 ed0
c.darkreading.com/com.iiris/ Frame 0
0 477ms
236ms Preflight 104.16.224.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.darkreading.com/com.iiris/ed0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.224.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.darkreading.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://www.darkreading.com
access-control-max-age: 600
cf-cache-status: DYNAMIC
cf-ray: 8bf8cd31ba28d292-FRA
content-length: 0
date: Sat, 07 Sep 2024 18:35:57 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 ed0
c.darkreading.com/com.iiris/ 2 B
296 B 467ms
241ms Ping
text/plain 104.16.224.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.darkreading.com/com.iiris/ed0

Requested by

Host: static.iris.informa.com
URL: https://static.iris.informa.com/widgets/v3.0/sp/v3.21.0/sp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.224.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: https://www.darkreading.com
access-control-allow-credentials: true
cf-ray: 8bf8cd349b798c46-FRA
content-length: 2

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
251 B 124ms
124ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&sst=1&wf=1&ra=1&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=INFORMA_GAM_DISPLAY1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tW%2490vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DQB3%2ByerEd%5E95SpGl)17*7*7UO0%40M%7CQDt%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BQ%5EqmmPgh%2C%7BgeMBC.F%5BNVfBB2%2B%7BLTb%25%24(%3DNqU%60W5u%7Bo(zs1CoK%2Bdr%5BG)%2C3ii)RGL3emgSuRVE&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C5%2C747835005%2C1%2C2%2C0%2Cprobably%2Cprobably&rb=1-k3RASHsclVWQ4vP6QFn7EBQPW0156EeByXc57Q1SGx6aR8yd21jqQxERbTEBDlFeSDk%3D&rs=1-ENQRKbOpzNBk3A%3D%3D&sc=1&os=1-Sw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MwBtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=20&qd=20&qf=1600&qe=1200&qh=1600&qg=1285&qm=-180&qa=1600&qb=1200&qi=1600&qj=1200&to=000&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3F6C(TgPB*e%5D1(rI%24(rj2Iy!pw%40aOS%3DyNX8Y%7BQgPB*e%5D1(rI%24(rj%5EB61%2F%3DSqcMr1%7B%2CJA%24Jz_%255tTL%3Fwbs_T%234%25%60X%3CA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&fy=0&gp=0&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&id=1&ii=4&f=0&j=&t=1725734155372&de=160936163658&cu=1725734155372&m=1276&ar=9cc5b3e58a7-clean&iw=b63ee96&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=85&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6182&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A4105%3A4105%3A0%3A4119&as=1&ag=1229&an=1025&gi=1&gf=1229&gg=1025&ix=1229&ic=1229&ez=1&ck=1025&kw=854&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1229&bx=1025&ci=1025&jz=854&dj=1&aa=1&ad=1129&cn=925&gn=1&gk=1129&gl=925&ik=1129&co=1129&cp=1055&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1055&cd=854&ah=1055&am=854&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4754661352%3A3581601967%3A6774527496%3A138487886804&bo=22316126855&bp=22339890152&bd=728_1v&zMoatPS=728_1v&gw=informagamdisplay218733383007&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22339890152&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22339890152&zMoatSZ=728x90&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&zMoatDev=Desktop&zMoatDfpSlotId=728_1v&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=208210&na=1144896688&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sat, 07 Sep 2024 18:35:56 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 188ms
187ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOyiH,pingTime:1,time:1586,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:568%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1586,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:568,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1035~100%5D,as:%5B1035~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:201,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,rmeas:1,rend:1,renddet:IMG.qs,siq:569,sis:719%7D&br=c
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt27.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 189ms
188ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOyiH,pingTime:1,time:1586,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:568%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1586,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:568,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1035~100%5D,as:%5B1035~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:201,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,rmeas:1,rend:1,renddet:IMG.qs,siq:569,sis:719,metricId:publ1,cmr:t%7D&br=c
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt29.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 188ms
188ms Image
image/gif 18.210.65.35
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=931618&asId=9ca5213e-cd9f-b0e3-d737-5197fe3810bc&tv=%7Bc:nEOyiH,pingTime:1,time:1586,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:568%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1586,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:568,wc:20.20.1600.1200,ac:456.269.728.90,am:i,cc:456.269.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1036~100%5D,as:%5B1036~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:201,fm:unIoE2N+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19*.-%7C191,idMap:19*,rmeas:1,rend:1,renddet:IMG.qs,siq:569,sis:719,metricId:grpm1,cmr:t%7D&br=c
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.65.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-65-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:56 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

OPTIONS
H2 204 js_pageviews_itcyber_darkreading
eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/ Frame 0
0 357ms
112ms Preflight 18.158.12.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/js_pageviews_itcyber_darkreading?modified=1725734156841

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.158.12.58 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-12-58.eu-central-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-td-fetch-api,x-td-write-key
Access-Control-Request-Method: POST
Origin: https://www.darkreading.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-Requested-With, X-TD-Write-Key, X-TD-Fetch-Api, Content-Type
access-control-allow-methods: GET, POST
access-control-allow-origin: https://www.darkreading.com
access-control-max-age: 7200
cache-control: no-store
date: Sat, 07 Sep 2024 18:35:57 GMT
strict-transport-security: max-age=31536000

POST
H2 200 js_pageviews_itcyber_darkreading Show response
eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/ 16 B
496 B 340ms
114ms Fetch
application/json 18.158.12.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/js_pageviews_itcyber_darkreading?modified=1725734156841

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.158.12.58 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-12-58.eu-central-1.compute.amazonaws.com

Software

Resource Hash

56587cffbb30e338497c9114f74803a530a713ebe374b69fcfa8551ad8dad1e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

X-TD-Write-Key: 100/bb9cbe21de3db7a5428506d7528e45b2c801a48c
Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
X-TD-Fetch-Api: true
Content-Type: application/json

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, POST
content-type: application/json
access-control-allow-origin: https://www.darkreading.com
p3p: CP="This is not a P3P policy! See https://docs.treasuredata.com/articles/p3p"
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-Requested-With, X-TD-Write-Key, X-TD-Fetch-Api, Content-Type
content-length: 16

GET
H2 204 2610568 Show response
vc.hotjar.io/sessions/ 0
231 B 404ms
141ms XHR
text/plain 18.66.112.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/2610568?s=0.25&r=0.18030693839300937
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-79.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 07 Sep 2024 18:35:57 GMT
cache-control: no-store
via: 1.1 fc562aab29280948aa0691960bee3d6a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: wjG-xAoRuo3OIrVTAhGD-yWaK3iQ2zw6QwXs-oTCJeabCjR9PmZYQg==
x-cache: Miss from cloudfront

GET
H2 200 browser-perf.8417c6bba72228fa2e29.js Show response
script.hotjar.com/ 5 KB
2 KB 115ms
115ms Script
application/javascript 13.227.219.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-71.ams54.r.cloudfront.net

Software

Resource Hash

70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 14:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 19627430
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1782
last-modified: Wed, 24 Jan 2024 14:31:37 GMT
etag: "b83b61bc5871e9a23a0434e2c539f4f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 6yZWi-DknILBr4eaGKXgPK_Ovo7zHFeLednHRcYPamgnAyjXsdZgIA==

GET
H2 200 nr-spa-1.265.1.min.js Show response
js-agent.newrelic.com/ 109 KB
32 KB 299ms
95ms Script
application/javascript 162.247.243.39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-1.265.1.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.247.243.39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2e5aa81e02f13eb7e2376331a641bc0bdf3dcfbc769872074cc3134c3fc4d0e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://www.darkreading.com/
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 49361
date: Sat, 07 Sep 2024 18:35:57 GMT
content-encoding: br
strict-transport-security: max-age=300
last-modified: Fri, 06 Sep 2024 15:19:57 GMT
etag: "5b9d8baa112d5d1fe1575bc547a2d11c"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 32119
x-served-by: cache-mrs10578-MRS

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 17 KB
13 KB 128ms
128ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202409040101&st=env

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

d89c881f1a32b46c1e81ef7ea8520f8ba06a6d91d48fcfe1f7091dd5d37e18cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13005
x-xss-protection: 0

POST
H2 204 rum Show response
www.darkreading.com/cdn-cgi/ 0
170 B 126ms
125ms XHR
text/plain 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/cdn-cgi/rum?

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
tracestate: 3288925@nr=0-1-3936348-538600199-135cd6b00b4d6a4d----1725734157161
traceparent: 00-ac300284a9e49c1c87d5758bdf3f31b2-135cd6b00b4d6a4d-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiMTM1Y2Q2YjAwYjRkNmE0ZCIsInRyIjoiYWMzMDAyODRhOWU0OWMxYzg3ZDU3NThiZGYzZjMxYjIiLCJ0aSI6MTcyNTczNDE1NzE2MSwidGsiOiIzMjg4OTI1In19
content-type: application/json

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.darkreading.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8bf8cd329bf0bb3d-FRA

GET
H2 200 darkreading-DSJITCUD.ico
www.darkreading.com/build/_assets/ 7 KB
3 KB 133ms
132ms Other
image/x-icon 104.16.222.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/build/_assets/darkreading-DSJITCUD.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.222.171 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4af04cf7a5f045d2a21abb3f93d90f175680f07b9ccecb1d5559864b9716cca

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600000

Request headers

Referer: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
strict-transport-security: max-age=3153600000
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 30 Aug 2024 08:40:23 GMT
server: cloudflare
age: 708284
etag: W/"1cee-191a27158d8"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=31536000, immutable
cf-ray: 8bf8cd32abffbb3d-FRA

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 156ms
154ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 07 Sep 2024 18:35:57 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7649 0
0 336ms
110ms Document
text/html 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 9406
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 15:59:11 GMT
expires: Sun, 07 Sep 2025 15:59:11 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 0E5B 0
0 343ms
124ms Document
text/html 142.250.185.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Db28yY9NasNCrTYYPZm84w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Db28yY9NasNCrTYYPZm84w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Sat, 07 Sep 2024 18:35:57 GMT
expires: Sat, 07 Sep 2024 18:35:57 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200 NRJS-26ae6a3b09493bbcc87 Show response
bam.eu01.nr-data.net/1/ 150 B
653 B 346ms
130ms XHR
text/plain 185.221.87.23
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.eu01.nr-data.net/1/NRJS-26ae6a3b09493bbcc87?a=538600199&sa=1&v=1.265.1&t=Unnamed%20Transaction&rst=9047&ck=0&s=5cd9f75849115ff6&ref=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr&ptid=d8f7288d35adf0ad&af=err,spa,xhr,stn,ins&be=3337&fe=5326&dc=1095&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1725734148494,%22n%22:0,%22f%22:1014,%22dn%22:1015,%22dne%22:1023,%22c%22:1023,%22s%22:1079,%22ce%22:1245,%22rq%22:1245,%22rp%22:3338,%22rpe%22:3485,%22di%22:4119,%22ds%22:4432,%22de%22:4432,%22dc%22:8653,%22l%22:8653,%22le%22:8663%7D,%22navigation%22:%7B%7D%7D&fp=4105&fcp=4105
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.87.23 , Ireland, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 5a5d7866972caabd60df827fd964e18f939ce0cfd0b96b449f5fa9170441f89c

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
server: istio-envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.darkreading.com
access-control-expose-headers: Date
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
cross-origin-resource-policy: cross-origin
Connection: keep-alive
timing-allow-origin: https://www.darkreading.com
Content-Length: 150
x-served-by: cache-mrs10566-MRS

POST
H/1.1 200 blobs Show response
bam.eu01.nr-data.net/browser/ 24 B
339 B 126ms
125ms XHR
image/gif 185.221.87.23
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.eu01.nr-data.net/browser/blobs?browser_monitoring_key=NRJS-26ae6a3b09493bbcc87&type=BrowserSessionChunk&app_id=538600199&protocol_version=0&timestamp=1725734147779&attributes=entityGuid%3DMzkzNjM0OHxCUk9XU0VSfEFQUExJQ0FUSU9OfDUzODYwMDE5OQ%26harvestId%3D5cd9f75849115ff6_d8f7288d35adf0ad_1%26trace.firstTimestamp%3D1725734147779%26trace.lastTimestamp%3D1725734156442%26trace.nodes%3D26%26trace.originTimestamp%3D1725734147779%26agentVersion%3D1.265.1%26firstSessionHarvest%3Dtrue%26ptid%3Dd8f7288d35adf0ad%26session%3D5cd9f75849115ff6
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.87.23 , Ireland, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 07 Sep 2024 18:35:57 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.darkreading.com
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 24
x-served-by: cache-mrs10531-MRS

POST NRJS-26ae6a3b09493bbcc87
bam.eu01.nr-data.net/events/1/ 0
0

GET
H2 200 utsync.ashx Show response
ml314.com/ Frame D33F 62 B
237 B 130ms
129ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=62439&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&pv=1725734155666_po6njhaxu&bl=he-il&cb=4469107&return=&ht=&d=&dc=&si=1725734155666_po6njhaxu&cid=&s=1600x1200&rp=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?782024
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

Referer: https://www.darkreading.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 07 Sep 2024 18:35:58 GMT
via: 1.1 google
server: Google Frontend
content-type: application/javascript
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET ud.ashx
in.ml314.com/ Frame D33F 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.darkreading.com
URL: https://www.darkreading.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTp9t7LRxHIV_BZXdXbip84J6ZiXxtAwxC5HSYtqp4ucLx-5WIlZpNoRjzcm0lUjXn7YGfCiFj7wzWkXeg-BpigXst6Jw

Domain: bam.eu01.nr-data.net
URL: https://bam.eu01.nr-data.net/events/1/NRJS-26ae6a3b09493bbcc87?a=538600199&sa=1&v=1.265.1&t=Unnamed%20Transaction&rst=9451&ck=0&s=5cd9f75849115ff6&ref=https://www.darkreading.com/threat-intelligence/blackcat-spinoff-cicada3301-stolen-creds-skirts-edr&ptid=d8f7288d35adf0ad

Domain: in.ml314.com
URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=782024&v=2.7.4.212

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202409040101&jk=2427910690890232&bg=!b2ylbCPNAAY2Tt88Fk47ADQBe5WfOC7RzKmnzjCp2CioqDwebiysYWUw7Bqh_ki1pvEfykmRd7s9VEiXhA65KEKS8lq0AgAAAKRSAAAAAmgBB34ANsbLjlvp4f1upY-amd55FPOaIWf1SNXIBBclBqmIvXOEpMZw4fncM-AVGiw_R5DtuQgd-fSmvpkCstuGbv7SZBCH9ie0boXALA5zJR-LJiqMCPExZv5vy-pEKDgoA8Z1sQW15vFIeu4_5g9w2ZL_JOQTHN65E1TIrkYwxB_2N-yd3Z1t0mv6_pBE1cjZyAMOTc_uvpazrx3oyMuVOqLgRHf5N8uKbECa9LS68oD1cUO3WlOCYqWyHmbfxG7tO8ixfiuH088vx64G-7nXE_zMqt8_PgLDO5vhXMyQeCe2H9oja2D0hXpjhsfZ91tSNSdK4iN1e44G3cEF9osfz0JxdA5FgPGMeZEBMQEbiH3bISWpM4t-Er5auydwTTQTvdM_Is32oN2pdc8DFM0_UWAAZ64c1WqdLkbgiyfJwqPKHZGXD46b9kP9VbMruaR15h-UrzjPxw-pDfHnG5D_7XI0r9L3lWLh1OLMd20hmZLCcrjv34Qkjo0CryDOahBzAlCYtxiRsPwmNEgODIDLux0ucOzWs4z90izF5MgGiRNr1qyG1PDnPV6U5PWHe4zKQcHfXT2_HD-VgTLuiD3BUA9-HXyb168wRjbmKyjnvkTMmJBrRtRNzcd3ZowKlxI83BwcVlVR1dUMSqLY6J5VlNqQSuUi0L5qyVpeokIPP11ABS3x-JKWjwGHTwnIt3UfOvnuflcxDzxZkEbXWOJp5e1OhDpKnnFYYt6ApBlCwwKK8BhJLmWXWrxHhruNU7v13eUQJ1bzW7o6EYcifj8oDlqC3abxNTxW-7Z6Q3nV4zkRf0sGel_3RdMMAH7oVhubHSMiQ9SmYzttAggzE4yF8Ud0r9PASwZ7urIHqGJTBBMtTOaQJs-BV_ympjr4srDePcrIVavMV7wrcnVSM52PFd5a_RSyVAW3IbWS47Dl5kE3WjxIyYVh5SE9m2lIJNWvUouSOg9XWe58wkQETGHyGtAosIkuJyX6PK7699g4kA

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.darkreading.com/	1970-01-20 23:22:15	Name: __cf_bm Value: KEYCWzfAFt34fi2cghiUTMBHdEt68VBZLNwXltHe6c4-1725734151-1.0.1.1-fs1_mBYiTfIkXs_pRLVV6FBTynGfvxpTSQdPFCcnAD9sV8BfbO7KQ2ZhxQLfCzNq6Fvl7_BGJfZasWNnRveSbg
.darkreading.com/	1970-01-21 08:58:14	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+Sep+07+2024+21%3A35%3A53+GMT%2B0300+(%D7%A9%D7%A2%D7%95%D7%9F+%D7%99%D7%A9%D7%A8%D7%90%D7%9C+(%D7%A7%D7%99%D7%A5))&version=202404.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=b11bf6f6-494a-46f5-8c3f-d1dc011a5f42&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fblackcat-spinoff-cicada3301-stolen-creds-skirts-edr&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.doubleclick.net/	1970-01-21 08:58:14	Name: IDE Value: AHWqTUm3NyhjVBrgHEG5gWmEUnUbIPi5qPB7Z5oIb8NVbnZMja5Y7gELVLW6UwueFNE
.darkreading.com/	1970-01-21 08:43:50	Name: __gads Value: ID=f37d92d5e00237b5:T=1725734154:RT=1725734154:S=ALNI_MbsYSpA5S4EafoJA1jAkmRyYoWIEQ
.darkreading.com/	1970-01-21 08:43:50	Name: __gpi Value: UID=00000ede95b0c31d:T=1725734154:RT=1725734154:S=ALNI_MbUIpiXw_2m6P-RW7AQOH3oEQ7n4g
.darkreading.com/	1970-01-21 03:41:26	Name: __eoi Value: ID=f11dfaf1eb3f041c:T=1725734154:RT=1725734154:S=AA-Afjb7ccKP33a1zzsojeU5z54t
.darkreading.com/	1970-01-21 08:07:50	Name: FCNEC Value: %5B%5B%22AKsRol-3tG9kTumNLGwfuF9ZAzdB40_q0auUES6TcrwO9RTo5g4GjIq6LnDibLO0iAjsCRSBTEX48daVNZA1odc-Fm-C-krmrg4V-48ikKomX3H_sedFPDdnppdw8ydA_Tn-SNQID-A3LBze4340G40IwSvHtoAa0w%3D%3D%22%5D%5D
.darkreading.com/	1970-01-21 01:31:50	Name: _gcl_au Value: 1.1.1347523242.1725734156
.darkreading.com/	1970-01-21 08:58:14	Name: _ga_1X1EHQ3PFR Value: GS1.1.1725734156.1.0.1725734156.60.0.0
.darkreading.com/	1970-01-21 08:58:14	Name: _ga Value: GA1.1.826330821.1725734156
.js.ubembed.com/	1970-01-20 23:22:15	Name: __cf_bm Value: jpTiSRmQZ4Op1.r7mQ7FbexFe40l1L9mIqsovkhxpag-1725734156-1.0.1.1-7h6u3E0C1Vj9qwuDj.qLK73WWLIBmuk6UJva_32sft877AykTrGqzP7.GKYnCrfr6g7TPKksXMPLaisTrrswWg
.darkreading.com/	1970-01-21 08:51:02	Name: _cb Value: 6akwjPaf5yB3jRNR
.darkreading.com/	1970-01-21 08:51:02	Name: _chartbeat2 Value: .1725734156545.1725734156545.1.C05kH7CSbRd_dcIskDsYwA6pkXgJ.1
.darkreading.com/	1970-01-20 23:22:15	Name: _cb_svref Value: external
.darkreading.com/	1970-01-20 23:22:15	Name: _sp_ses.94c4 Value: *
.darkreading.com/	1970-01-21 08:58:14	Name: _sp_id.94c4 Value: f35b1d41-ec2b-4428-937c-8df0f92bca87.1725734157.1.1725734157..8171861b-9504-4cd5-b5dd-a92ea222b28c..b3137197-578f-40da-9aad-891db4c4de81.1725734156775.1
.darkreading.com/	1970-01-21 08:58:14	Name: __td_signed Value: true
.darkreading.com/	1970-01-21 08:58:14	Name: _td Value: d394cf2d-724f-464b-b098-b8766dba7043
www.darkreading.com/	1970-01-20 23:23:40	Name: _iris_cdl Value: Ki50cmFkZXB1Yi5jb20=
.darkreading.com/	1970-01-21 08:07:50	Name: _hjSessionUser_2610568 Value: eyJpZCI6IjU4NTFkOGJkLWM5YmEtNWQ4Ny04ODFhLTIxM2E2N2ZmODQzZiIsImNyZWF0ZWQiOjE3MjU3MzQxNTcwMjQsImV4aXN0aW5nIjpmYWxzZX0=
.darkreading.com/	1970-01-20 23:22:15	Name: _hjSession_2610568 Value: eyJpZCI6IjFhMmYzOTIzLWM3YWMtNGU2ZC1iNzQ3LTljNTliYWMwNjE3NyIsImMiOjE3MjU3MzQxNTcwMjUsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.in.treasuredata.com/	1970-01-21 08:58:14	Name: _td_global Value: 91ef42ec-1181-41a5-a87d-5557b133f42e
.darkreading.com/	1970-01-21 08:07:50	Name: sp Value: ebb45d03-04c0-4db0-b828-18a31728aa6e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=3153600000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

52f2ec19536b314e455ad5426eef3815.safeframe.googlesyndication.com
6600d6d98e534115970f9529a45f3195.js.ubembed.com
analytics.google.com
api.iiris.com
assets.ubembed.com
bam.eu01.nr-data.net
c.darkreading.com
cdn.cookielaw.org
cdn.treasuredata.com
cognito-identity.eu-west-1.amazonaws.com
connect.facebook.net
dt.adsafeprotected.com
eu-images.contentstack.com
eu01.in.treasuredata.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
gateway.bridged.media
geolocation.onetrust.com
in.ml314.com
js-agent.newrelic.com
loader.bridged.media
marketingplatform.google.com
mb.moatads.com
ml314.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.adsafeprotected.com
px.moatads.com
script.hotjar.com
securepubads.g.doubleclick.net
static.adsafeprotected.com
static.chartbeat.com
static.cloudflareinsights.com
static.hotjar.com
static.iris.informa.com
stats.g.doubleclick.net
tpc.googlesyndication.com
u33254697.ct.sendgrid.net
vc.hotjar.io
www.darkreading.com
www.google.co.il
www.google.com
www.googletagmanager.com
www.instagram.com
www3.doubleclick.net
z.moatads.com
bam.eu01.nr-data.net
in.ml314.com
pagead2.googlesyndication.com
www.darkreading.com
www.google.com
104.16.222.171
104.16.224.171
104.16.79.73
104.18.32.137
104.18.37.149
104.18.39.181
104.18.86.42
108.138.36.72
13.227.219.71
130.162.160.243
142.250.181.225
142.250.184.195
142.250.185.100
142.250.186.110
142.250.186.130
142.250.186.170
142.250.186.174
142.250.186.35
142.250.186.40
142.250.186.78
142.250.186.98
142.250.74.193
142.250.74.206
151.101.66.137
157.240.251.174
157.240.251.9
162.247.243.39
167.89.118.106
172.217.23.115
18.158.12.58
18.173.187.64
18.210.65.35
18.239.94.35
18.66.112.79
185.221.87.23
23.35.237.151
34.111.115.90
34.117.77.79
52.85.65.109
52.85.65.13
52.85.94.151
54.77.181.128
54.81.180.79
74.125.71.155
99.81.203.230
00907159439e9ef97101ea78b51d2eb301b245edcd7ecaa75f8e59f76c587794
00d0d315f77b1647d4ee46edbc52e428f5bd6c1c43c9c006ee47f55bc6a83abf
05c58c759cab8d50d5e7f9d3b2faedcc0dd45fa3fb50899a224363a1dea93605
06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992
0b5487a17501f9238d230de63f56070b70592f67e9f14c844605d4600a0446e9
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d34727332063f774893813c408c607378e8bc4fdb149c4240506d68a60e1016
0d540c85801b5de9689fce95411faef96a619a804977579078a576ce0911926d
0f155ecc49cf3427c761b27ef11fcc6d210fb27a9355d70fd5a30e5f1893452a
13835ce83acea684f7bb4105ff87e1fb52e6be755d3cffb75bf50457654e3778
14a1fa4b518b9bcff7664518a2f8cd4d91205d82d58c87a9bf5553da729e3ea2
1c65520ea75c36a59b1960495950b83368b63b2b4a543ef604540a241ec54238
1e4cf50411cbc9b156d5c372320c2c8b01a8d441958e4b271ad78215529218bf
20cbb68c751096ffcc7228c8264d233c80ef2a40a2a25acbcbeb53a3c7b0d524
258daef9a182640e92d363f90b54305e7a38a99655b8117d7bd7658a7fffbfff
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
262f87d47643975a4633b675fc224c7a178d99e579e5d767f4a43ca7cc0bb9de
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
272da51ef5fce973cda220f688487b7585e2fc2aefad2d34508d20a4a493e0c8
297f7c6e2e5141be50a472401472c07dbe025b762bcad89ffaf795fddbd04fd0
2b21643da63b2c4ecc10d42f29531dd1830ea86dc7fa876cf0e0d570b76bbb3c
2c9fcde0c447d7b2157aaed5d5357a229701b1c039c8db2c29a177ab4cbc54e0
2d6e76e1083bfb34b269e2975a61eff471414ee974fef8f8700cac19fe334804
2deefa30437796b66867cb9f98f24cb81a0c86c217efc3fe1878e99d05aa7fa3
2e5aa81e02f13eb7e2376331a641bc0bdf3dcfbc769872074cc3134c3fc4d0e3
30ac95fbea6ac28a43d8b4a46f7a694d4f52bf97e7e910e548f29b8376393cf4
31556181b378d1e27d769a0c4bd113d5957786a8381b08a214b4d949fef5face
31fb68e4d7b0b92cc6b747869f05294ac0e08fb61c192065d2002be05c1633db
329a79571f5d41fbc3cbddd576f7d3d9112f963e12f500c16b7a736e9ff97994
35bbaf39a449ccd5f8187d9ad0c345b234b9e0c011ac23ae181cd1e7d308bdc4
36d100d1554b961d54f7af19c2ce10fd92e4480a3481d339e5e3ce20a970d276
3772fa8fe35f266712e4ccf5ad06bc31947eb2387a59fe2b33f76aff24135acd
3969804522a0b32cd9dbe609047076c5a239cf16e0c0ebe4b8c71c812c53b9f0
3a1f53a72a4ff3c23812f7a06cc3ef3ea1f188046f2c75d9c0b19e1cb2b652a9
3a41b31d3fc11a54b030a945602bfb18ff6fb5e7dd4272bd93b1494419fc20d3
3d3373fce495fde24561ffd856116f62ac7d42d619a3acffb6556967698bf448
425a554d2e5e61aa00622f973658f00e847bb629ab1968c464b8a78dbb6e4bb9
42760af362a128e1b6f67f00960576edc43f3891410d7084e6c96dba8dfd2a6d
42c5ee092bc5589dc18cc56a407d52a37869b35dc9bbe5195fe503e31ce617d9
4b475b63a797144d91a4b2e34499ab7321bdf6d298d5f1177ec1fa3f5d3b4e0e
4c55d392bdb65697ff55914eec8ef5ded828bfa114328546fae2032e73ded866
50377d1d3e7dcb2c8298feb8d2505099df1957e3700a358b993b4cf443fd36e8
51946d8864a58143d85de6496bc55ff5eda3e23b2894ff7bde5c1721038d58bb
56587cffbb30e338497c9114f74803a530a713ebe374b69fcfa8551ad8dad1e9
58016ccef8b151b18ba8a751a7666689dcb78facc25a8710434d2e8629a83142
592356a6c52e99185da7862c1bc4929308efd3618e8f1c8e1dd665abf205ee62
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a5d7866972caabd60df827fd964e18f939ce0cfd0b96b449f5fa9170441f89c
5ba5891b54f0c6b68d79a2506a7d6b5289ec69c02f26989f5e049f5d2f6c1a0d
5bef8c9e1cd6bba25a5e7115d3b7a61a6ce406eaae651a82963069b98f7d39f9
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62a683fb450f7fa9845bc05412211a15a4b09b406db0c7fcb6fe2fe18acff1ad
62eee22f7f92913689361d7cad70e166c1f0fe52937c1269996cffaa712e60f7
66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a
67c3a76057046e3ea92ec65308fdba7f6782f2f77088192818f95e9d6fb3cda9
6827842b59fb54f9200f3560355eb95c7dab3a74542cdb96e65403b1ccbb518d
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6c9307ad52e158ea2906d2835fa885687a96e814af27ea75f9fb7b99cfa27b81
6ef59df86d3826ee2048c7707b14be9a819ffe3ce87ca7e989511ac24e447812
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
720438a0254f48dd91b936773f96bacff54d181369ea8a8122419c6ca4a70947
73dd8352c22f6c1894b5141e464cf6d3eca974cae966e88b7ec490a061f99538
74bb46c1b88ad27186911e3fc25fbbef3bdeb12e6cc85699bd58a538eb09cd13
76f448ec45359e863fb3a6432a2a3cf22c0cc0a52aead6318b57ab38db6f1d14
79611d23ecaa67700bdea21cd1c64be8f870003ce33517e2a3b8be885823982d
7b75529201e97f7566ae404c0bd803c64ce29092a13c8e1893369ef3c32c6337
7bedfa40d9b703c758256071c557b3939123059342735f66c8a23ac6b63444cb
7cc8aa97498f881cfe4a6cc5df8ff00c0428e6955dd25f6650fd3982ac5b2456
7f5c967f662151c1967ec3baa5f62ad5b6f92c9d52f41066f9cdd547ceed5f54
7fe6411146e7aabcda85d71ec42eabe4fe5fb199f0e9ad759bfa78a42a853535
829af6717d377a2b0873b2bf0e58ea1f032c852bc022acf4ca9c17e93681c9c9
882c0ef9f4096af29e037f9ba9dcbc71a46605828ae12a77002c0fa5e00c309a
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8b0bfdd5f26914dedc882d8608cb6fdd71dde9f1024ffcb9d240697c7b30cfef
8bd3bdae06abdf03754bc167e98e1e154f035622f125b12e4d80671b392d8af6
8ca1e264e9d970f404cff959829ce838d535d2026544fdee48bb17af600a1c2c
8ec46b18a40650b7b852d08e95cbc81c59e677bc4ccaf3db7514fd4226c54f5f
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
90e8c4d16b6b7fd68df8c6cea5be4f076cf83487ad9f7bfb5bef51c54d8ca4e1
93e85be27eea7299d8af517f64e6bb38425373b848ffb3dae3c13806ee67f5e6
9c648f364816fc44d54ba553e59eebfec6f956cbe9c221a2a9bfacb3565b8944
9de5761fc6870deefd28dc5df2f67f6eacbc99bb2a04a8e3f6eaee3620bcdba0
9e4d00cfee02d472b0c80124f87c00a8cb8ea5610201ebbf922d894d2fea4db1
a2aa218236f7f4a84cf7078e8b3015b981a39802358c465c520329dfe3a93c6f
a49e1d9c398771a9e944c3c920933a6791a83bd4943766504c71c0acc6ece8e2
a8b5050c00e65112ae30afa040177c7af59fafecf502c995f29073cc00d06666
abe14b8073d94d21cdd7cb1c66e53583a0ea561d9edd39cce8291cb8371086d7
ac42cf20760d5b0f71be7a0391c76020002aa1dcfc75bae782360bf2761db29f
adb12889b35f0c4429f3d6468469a58378f9b4bcbd088d5c754eb1229edfc597
ae59b218ab2a4bdc90c9da5d696d7c14eb10c26ddfe9882dc74f4e4e0deb7255
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b28623c3480c73b59c37a94a307f3e37f22852adde2f7bc4fe83f6b53a152d23
b417abce04733c5db213a46db68308fe82b5201a348850ff9130f6ab3f132bd3
b51ced2792af47d3fc5c4af61148fd145e39430f0474eb3ef6ac14224662a331
b69d75ae81862f19c174d696d8f11743be7c54d92e2a97ede7c4c9c7c352ae79
b7dd61f31dd9d4d1b9e2b24e139ddcaef62287a13664cdb50544ea421f1a1899
b8ab512c10de26c64fa61cc6ff621848274c4ee09578d2bf1f90ed1c53e325b3
ba4e35ef406aaa468df2936fc0472ea6c984bb3df0c4e49d76e3d98e287eac00
c1fefe3e1740472b885c24e10d9565282a72fb5246200d912dc7d58b235e90b5
c39fa609f4a9b43e493115c723b102147f9025008bd24841e7732c5f253edd51
c3c2e2538dd857e04bb340d6230c8eeedca607d219bceba19897333cbd74b4f3
c4e5a213636d5ecfe9262e4d194e334e714fbab93b1495bfb0c08a5193398bf1
c8a03522223cf64474a1f91e02c8069ea5560a23266b37b476d7602a621f0c38
c99753a9a0b95a19d14edb17048794e536ab0ac8782f0953e208b6a567dcb4d7
ca87c74e7427d194095dcdfd1ad4eb62e379c33b217a5cc960c69c57ac24bf56
cbd7ba9c2af7dabc67644196dacd718139ba839fb3d1c232169c48929dac551a
ced6d94498388b24b48c4e2aa311815357ab9489c735aedd7725e0b18a02433e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cffd69c68b4284aeb7920d9f1d7a6faf12bf93b52774fc7f688aeae1be422314
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d506df4ecb2a61c6c0a1a8c9bdcb94cb6032a7f4aafeac15235d3c0622031629
d89c881f1a32b46c1e81ef7ea8520f8ba06a6d91d48fcfe1f7091dd5d37e18cb
d8f35a67f2129d433d9a690160ea7f637686033f5055199a7788f1bb500fe0e6
d99c7cd015a2b0f6f2afbc42a0ff4d9a6fb9c9958268f24367aa2794757b17aa
daf9b7be98c1057d539b7222ab50700ed2ba9550ef72c2cfb9b5e7ab283056ba
dbdeae2ab0342b9c8c48cb6d50d7ce04e63952dae045a25c2f07e121916b9075
dcb0792224f3d5745ab113919cb43eeb55646033f6f176ece806409ce47bdefd
dd95975e29f2e629c0fdcc68e7a0a68229c0f0ef081a634cccb8705a7ad2c6df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4af04cf7a5f045d2a21abb3f93d90f175680f07b9ccecb1d5559864b9716cca
e56bb0d75fa46f23163c334f4ec6675e9a9ad2784ea5ead53d7ceb05eb4b366b
eab917741c3d4e12a18565a289081249c60345a6928685b785db8877999fa181
eae0cd3b8a59b8e0a2a8494c2b6cad5abef8647b9e52064c11802a2f8eb959de
ed870769c4fd967977ef0930a14927ac6035d0a9fcd9db0bcef385da69bea2eb
eec75e095590cdb68f03a5bae61904050fd1a4763c1c3be62e3b92c406a3c42f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0293ba0b711b46fdb1f1bb339e888d07ebe611b44871c0ebbe11622308b08bb
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f4ffef72a63fe8bf8e68873d8ec01dfaaca5d58846d07ea6db2fdcd207d350e9
f5265b1ee7810702404d81885a6310959e7ff538e0396f0eea68259faed75212
fb121c45f498cba0f88de6e2235d95cf3307bb9ed5376f6a793b8253a520592f
fe8b177a639b4cb49be45b148f5919c3e62466a03e101268148ae50fe257e35c
ff10c1fe39489bf9f57c9dc9e8ccc064dfdfd4dec949636d5deeba2a8f2da2f0
ff5c6ccd23219200d1ba0f66c328e5c014b436bc783b6ce18873dd9d6ac216c6

www.darkreading.com Open in urlscan Pro 104.16.222.171 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

187 Requests

97 %HTTPS

0 %IPv6

30 Domains

47 Subdomains

44 IPs

5 Countries

4574 kBTransfer

10713 kBSize

23 Cookies

39 Outgoing links

Page URL History

Redirected requests

187 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.darkreading.com Open in urlscan Pro
104.16.222.171 Public Scan

Screenshot
Live screenshot

Full Image

187
Requests

97 %
HTTPS

0 %
IPv6

30
Domains

47
Subdomains

44
IPs

5
Countries

4574 kB
Transfer

10713 kB
Size

23
Cookies

187 HTTP transactions
1 data transactions