www.recordedfuture.com Open in urlscan Pro
172.64.144.145  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&e_ipv6=AQJFC25xEcOYtwAAAY96CwwJlLWDaH45oOpIImpF5HhljihrJ0mqaW5WerERGX4-WcbKlflG

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Show response www.recordedfuture.com/	87 KB 21 KB	567ms 488ms	Document text/html	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash 0cb2c43d0978d0eecd133446cbac6796049085fab4a5066e9f7109025d53e011 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers age 0 cache-control s-maxage=30, stale-while-revalidate cf-cache-status DYNAMIC cf-ray 883fa2db9ec96a75-TXL content-encoding gzip content-type text/html; charset=utf-8 date Wed, 15 May 2024 02:18:14 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains traceresponse 00-17cf87faba4be5bf2cec681ed1004cf9-1c37274b43bdf23b-01 vary Accept-Encoding via 1.1 varnish x-cache MISS x-cache-hits 0 x-content-type-options nosniff x-debug-info eyJyZXRyaWVzIjowfQ== x-nextjs-cache STALE x-platform-server i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0 x-powered-by Next.js x-served-by cache-ams21036-AMS
GET H2	200	brand_logo_long_black_f2ead5b5c6.svg cms.recordedfuture.com/uploads/	4 KB 1 KB	573ms 455ms	Image image/svg+xml	151.101.66.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-cache-hits 0 date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 age 0 traceresponse 00-17cd245a46c9260c6bb38ad0fea2d74a-776eddf0662091d6-01 x-cache HIT content-length 1262 x-served-by cache-fra-etou8220062-FRA last-modified Thu, 10 Mar 2022 10:37:46 GMT etag W/"6229d4fa-eab" vary Accept-Encoding content-type image/svg+xml cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes expires Tue, 07 May 2024 07:35:03 GMT
GET H2	200	large_Main_Feature_7d63aead72.webp cms.recordedfuture.com/uploads/	51 KB 51 KB	566ms 449ms	Image image/webp	151.101.66.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/large_Main_Feature_7d63aead72.webp?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 829beb2b8007ca0bf3d74a2f1b66ce6a206a9886c743eb72661d0c41568733f5 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Tue, 14 May 2024 14:25:32 GMT date Wed, 15 May 2024 02:18:14 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 fastly-io-served-by img03-europe-west3 traceresponse 00-17cf60d0c74077a9597c5ce0e33742b4-06f446c0f9b6c1ce-01 age 0 x-cache HIT fastly-io-info ifsz=52216 idim=1000x375 ifmt=webp ofsz=52216 odim=1000x375 ofmt=webp fastly-stats io=1 content-length 52216 fastly-io-warning Failed to shrink image x-served-by cache-fra-etou8220062-FRA etag "HY+n6bGU1CZbmR/Nnu8trQPg8PF701PcZQ0IBUcQeUM" vary Accept-Encoding content-type image/webp cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	fonts.css www.recordedfuture.com/fonts/	1 KB 553 B	421ms 421ms	Stylesheet text/css	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/fonts/fonts.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cf87fadb469080d024c2abe6a11808-3f38fff6c333a2f6-01 x-cache MISS content-length 208 x-served-by cache-ams21041-AMS last-modified Tue, 14 May 2024 10:48:13 GMT server cloudflare etag W/"416-18f76b791c8" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2deca946a75-TXL x-cache-hits 0
GET H2	200	9326e2d3ef7ce318.css www.recordedfuture.com/_next/static/css/	60 KB 13 KB	50ms 50ms	Stylesheet text/css	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfee428e2ced47080c4703a290b3a954d65a8600daae84c841c6b5528873d094 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff age 568225 traceresponse 00-17cd82ee407c4ce8384e68221a377d76-22b73c5a66a0dbda-01 cf-polished origSize=61104 content-encoding gzip x-cache HIT x-served-by cache-ams21057-AMS cf-bgj minify last-modified Wed, 08 May 2024 12:21:51 GMT server cloudflare etag W/"eeb0-18f58272645" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2deca966a75-TXL x-cache-hits 0
GET H2	200	dd2bb54f0b86c22d.css www.recordedfuture.com/_next/static/css/	17 KB 5 KB	80ms 80ms	Stylesheet text/css	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/dd2bb54f0b86c22d.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 535442ba111e790de54198b9f5f20369109f1607e9f69184540567863a565f91 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff age 1064319 traceresponse 00-17c8dc2a21af72191bcde5fab73d9f7b-97be3861f80be29b-01 cf-polished origSize=17537 content-encoding gzip x-cache HIT x-served-by cache-ams21024-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"4481-18f0a1a7814" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2deca996a75-TXL x-cache-hits 0
GET H2	200	webpack-8233a73dc16fc90a.js Show response www.recordedfuture.com/_next/static/chunks/	5 KB 2 KB	77ms 74ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/webpack-8233a73dc16fc90a.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a772948c9dfd011eda575fd1528e5a0ebe39eb183f8876098d023a88e9370061 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 568224 traceresponse 00-17cd82ee460ad0b89607e5b6f2190aa3-0492493af62e420b-01 x-cache HIT content-length 2302 x-served-by cache-ams21057-AMS last-modified Wed, 08 May 2024 12:21:51 GMT server cloudflare etag W/"15a4-18f582725f2" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2deda9e6a75-TXL x-cache-hits 0
GET H2	200	framework-467b11a89995b152.js Show response www.recordedfuture.com/_next/static/chunks/	138 KB 45 KB	52ms 49ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cd65d3e6641a9458522c9476907463-c6b1432afcf756b4-01 x-cache HIT content-length 45457 x-served-by cache-ams21075-AMS last-modified Thu, 02 May 2024 14:30:34 GMT server cloudflare etag W/"2270d-18f39b6d57a" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2deda9f6a75-TXL x-cache-hits 0
GET H2	200	main-75bdb96a41ba80f4.js Show response www.recordedfuture.com/_next/static/chunks/	113 KB 32 KB	76ms 74ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1035416 traceresponse 00-17cb59bad48d3458c4f43e078b7d7885-2a90f6f93384e0bc-01 x-cache HIT content-length 33036 x-served-by cache-ams21027-AMS last-modified Wed, 01 May 2024 11:14:27 GMT server cloudflare etag W/"1c3b0-18f33dcea6b" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2dedaa06a75-TXL x-cache-hits 0
GET H2	200	_app-d8e4586260386d57.js Show response www.recordedfuture.com/_next/static/chunks/pages/	122 KB 39 KB	75ms 73ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/_app-d8e4586260386d57.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5e17346547b84fb6eb39887940896609ab42df0d14fdcfa501063d90d226d9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 1056299 traceresponse 00-17cb181b0ec832e4590f8a077f735221-c61375a139058a1c-01 x-cache HIT content-length 39378 x-served-by cache-ams21070-AMS last-modified Tue, 30 Apr 2024 15:22:55 GMT server cloudflare etag W/"1e8a1-18f2f9a0c0d" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2dedaa26a75-TXL x-cache-hits 0
GET H2	200	0-b9f0bdf121f9dd16.js Show response www.recordedfuture.com/_next/static/chunks/	250 KB 74 KB	76ms 74ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/0-b9f0bdf121f9dd16.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d6bf56f26962e5bba9948ccac567405e17bf925ece3882eb3b215b02d10845e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cdc0d1cfbea23da4f5ce4d9a6573b5-0fab217f4b3f178b-01 x-cache HIT content-length 75785 x-served-by cache-ams21066-AMS last-modified Wed, 08 May 2024 13:11:53 GMT server cloudflare etag W/"3e90f-18f5854f293" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2dedaa36a75-TXL x-cache-hits 0
GET H2	200	129-18f7d6c1f8c4b98c.js Show response www.recordedfuture.com/_next/static/chunks/	37 KB 11 KB	48ms 46ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/129-18f7d6c1f8c4b98c.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46d64a78d884e43692e0b4b83e8affef1f858885563fcb1ce92d11235499aa17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1056299 traceresponse 00-17cb59bad43f94a60c2fe36aad403dde-1209c7eedf7f0d46-01 x-cache HIT content-length 11517 x-served-by cache-ams21047-AMS last-modified Wed, 01 May 2024 11:14:26 GMT server cloudflare etag W/"93e4-18f33dce9d0" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2dedaa46a75-TXL x-cache-hits 0
GET H2	200	911-ff01f8a62625f045.js Show response www.recordedfuture.com/_next/static/chunks/	55 KB 19 KB	76ms 75ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 1064319 traceresponse 00-17cba90d19a54bcb9bd38b7dc693cac4-0e4ec2d54a661780-01 x-cache HIT content-length 18806 x-served-by cache-ams21024-AMS last-modified Wed, 01 May 2024 11:27:40 GMT server cloudflare etag W/"ddd2-18f33e905b4" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2dedaa66a75-TXL x-cache-hits 0
GET H2	200	747-a2f14eda3070de3f.js Show response www.recordedfuture.com/_next/static/chunks/	61 KB 12 KB	83ms 82ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/747-a2f14eda3070de3f.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1386c80797947cd37337fea484173915324f254e0a8ff7cd3918cce9fc7e733f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cdc40eac6882d602a36753d6c9773c-d87f156eaaf3b0fa-01 x-cache MISS content-length 12347 x-served-by cache-ams21053-AMS last-modified Wed, 08 May 2024 13:11:53 GMT server cloudflare etag W/"f5a3-18f5854f2f1" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defac56a75-TXL x-cache-hits 0
GET H2	200	407-b4466bcdd3b591b7.js Show response www.recordedfuture.com/_next/static/chunks/	15 KB 5 KB	87ms 86ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/407-b4466bcdd3b591b7.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cd3f41df37480eefd459420d80df5c-4e7216db277ddb12-01 x-cache HIT content-length 5304 x-served-by cache-ams21029-AMS last-modified Thu, 02 May 2024 14:30:34 GMT server cloudflare etag W/"3cad-18f39b6d517" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defac66a75-TXL x-cache-hits 0
GET H2	200	925-b476103fb5a7b7aa.js Show response www.recordedfuture.com/_next/static/chunks/	58 KB 18 KB	83ms 82ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/925-b476103fb5a7b7aa.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b12025936e837cee34970b346233fd8f61ba7c2981b033ec44c4fa08d7fa718 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cdb3e37db4ab5fe2ae737f30556fb1-5c5521842793f363-01 x-cache HIT content-length 18004 x-served-by cache-ams21045-AMS last-modified Wed, 08 May 2024 13:11:53 GMT server cloudflare etag W/"e6fc-18f5854f335" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defac76a75-TXL x-cache-hits 0
GET H2	200	399-3e032cf2cdcd2c45.js Show response www.recordedfuture.com/_next/static/chunks/	44 KB 11 KB	84ms 83ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/399-3e032cf2cdcd2c45.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1db331de86952c9f703e6c0ab6625aefa3a389ad5b32adf164740e12f554820f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 496894 traceresponse 00-17cd82ee4883de09f632b249e67b0ae1-6920cc7725ab9bee-01 x-cache HIT content-length 11408 x-served-by cache-ams21071-AMS last-modified Wed, 08 May 2024 12:21:51 GMT server cloudflare etag W/"af21-18f5827235b" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defac96a75-TXL x-cache-hits 0
GET H2	200	826-18ad179a8e810285.js Show response www.recordedfuture.com/_next/static/chunks/	29 KB 6 KB	84ms 83ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/826-18ad179a8e810285.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0221625275c684b6fb20e80bd68744369135a73d05b5debe3d4c6b66457c3286 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 561563 traceresponse 00-17cd85a724a16a3d3f5ef607401ec440-8dcbfc74eab2eaec-01 x-cache HIT content-length 5815 x-served-by cache-ams21051-AMS last-modified Wed, 08 May 2024 13:11:53 GMT server cloudflare etag W/"7382-18f5854f312" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defacb6a75-TXL x-cache-hits 0
GET H2	200	%5B%5B...slug%5D%5D-ff6c9f0081f77ba3.js Show response www.recordedfuture.com/_next/static/chunks/pages/	107 KB 24 KB	87ms 86ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-ff6c9f0081f77ba3.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3ebf7df56ccf7b503193cf32c4cbdb3e9db92c0b4dae3db60b8320bcec031e26 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 54085 traceresponse 00-17cf55a9590a540c2e2bff7eee8cd9dc-27bb4b69273a5315-01 x-cache HIT content-length 24530 x-served-by cache-ams21034-AMS last-modified Tue, 14 May 2024 10:56:03 GMT server cloudflare etag W/"1acfd-18f76bec039" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defacd6a75-TXL x-cache-hits 0
GET H2	200	_buildManifest.js Show response www.recordedfuture.com/_next/static/iGREdnCzBaSDiYMuAorJy/	2 KB 943 B	83ms 83ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/iGREdnCzBaSDiYMuAorJy/_buildManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2eaeceb14a3974219b9e4ef2262c5fa005a08017580296c47b44042e654e064e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 54085 traceresponse 00-17cf5601fe5dd878380444497d3da251-2c51e88a8b2f9824-01 x-cache HIT content-length 786 x-served-by cache-ams21027-AMS last-modified Tue, 14 May 2024 10:56:04 GMT server cloudflare etag W/"8c7-18f76bec26d" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2defad16a75-TXL x-cache-hits 0
GET H2	200	_ssgManifest.js Show response www.recordedfuture.com/_next/static/iGREdnCzBaSDiYMuAorJy/	173 B 279 B	84ms 83ms	Script application/javascript	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/iGREdnCzBaSDiYMuAorJy/_ssgManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 020a19839813fdee2eacf5a88bb1c537c26cb6cffb8cb3fffdbac86d5cf939fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 cf-cache-status HIT age 54085 traceresponse 00-17cf55a95a20460d1e5b547231d4ab4d-e9ead9f7331f9b46-01 content-encoding gzip x-cache HIT x-served-by cache-ams21052-AMS last-modified Tue, 14 May 2024 10:56:04 GMT server cloudflare etag W/"ad-18f76bec27c" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2defad26a75-TXL x-cache-hits 0
GET H2	200	insikt_group_logo_updated_3_300x48_b5390f4ff2.png cms.recordedfuture.com/uploads/	2 KB 3 KB	560ms 443ms	Image image/png	151.101.66.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Sun, 12 May 2024 20:03:42 GMT date Wed, 15 May 2024 02:18:14 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 fastly-io-served-by vpop-etou8240192 traceresponse 00-17ced61bc388534f824ce3a136d92c3c-0a857264ef14ddde-01 age 0 x-cache HIT fastly-io-info ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png fastly-stats io=1 content-length 2186 fastly-io-warning Failed to shrink image x-served-by cache-fra-etou8220062-FRA etag "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg" vary Accept-Encoding content-type image/png cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	43 KB 9 KB	147ms 56ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&vn=2.1&x=true Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 4b1dcb25c6279235ba23fb4a2f57900abd0a2f9e1b6acfe1523c13e807efee26 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 google server gfra1 etag W/"1715725479_EA" vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin https://www.recordedfuture.com cache-control public, max-age=0, no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	x-social-media-black-icon.svg www.recordedfuture.com/images/	456 B 461 B	480ms 479ms	Image image/svg+xml	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.recordedfuture.com/images/x-social-media-black-icon.svg Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 cf-cache-status MISS content-encoding gzip traceresponse 00-17cf87fae457d8f3288d2f82dc24ffa8-469df740ab0b0ad1-01 x-cache MISS x-served-by cache-ams21034-AMS last-modified Tue, 14 May 2024 10:48:13 GMT server cloudflare etag W/"1c8-18f76b791c8" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2df6b526a75-TXL x-cache-hits 0
GET H2	200	Inter-Regular.86422bf3.ttf www.recordedfuture.com/_next/static/media/	303 KB 144 KB	45ms 44ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 492166 traceresponse 00-17cced8ede88cdc28b1754364b7a0777-94c1bb3eef98e82a-01 x-cache HIT content-length 147167 x-served-by cache-ams21043-AMS last-modified Thu, 02 May 2024 14:30:35 GMT server cloudflare etag W/"4ba44-18f39b6d841" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b646a75-TXL x-cache-hits 0
GET H2	200	Inter-Bold.0b1aaf81.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	52ms 51ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 1064319 traceresponse 00-17c899461157c89251e61386f80ddab7-d88fef6eafc4fd9d-01 x-cache HIT content-length 157388 x-served-by cache-ams21066-AMS last-modified Mon, 22 Apr 2024 11:20:25 GMT server cloudflare etag W/"4d2c4-18f05892850" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b656a75-TXL x-cache-hits 0
GET H2	200	icomoon.ttf www.recordedfuture.com/icons/fonts/	6 KB 3 KB	475ms 475ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cf87fae4dd40e6eb3bf10c7dfbeb90-7aa18a71ac85ed20-01 x-cache MISS content-length 3235 x-served-by cache-ams21036-AMS last-modified Tue, 14 May 2024 10:48:13 GMT server cloudflare etag W/"160c-18f76b791c8" vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b686a75-TXL x-cache-hits 0
GET H2	200	Inter-SemiBold.ebaf29e9.ttf www.recordedfuture.com/_next/static/media/	308 KB 153 KB	59ms 59ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 492166 traceresponse 00-17cced8ef08780f885ccd725577593d4-f6599b3dedc8627e-01 x-cache HIT content-length 156755 x-served-by cache-ams21047-AMS last-modified Thu, 02 May 2024 14:30:35 GMT server cloudflare etag W/"4d16c-18f39b6d857" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b696a75-TXL x-cache-hits 0
GET H2	200	Inter-ExtraBold.d19caa02.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	55ms 54ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 492165 traceresponse 00-17cdc85ba7a9cbc8e25c27e1dc98d2b3-f021cba3d42031ef-01 x-cache MISS content-length 157010 x-served-by cache-ams21083-AMS last-modified Wed, 08 May 2024 13:11:54 GMT server cloudflare etag W/"4d52c-18f5854f625" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b6b6a75-TXL x-cache-hits 0
GET H2	200	Inter-Medium.6ee661b3.ttf www.recordedfuture.com/_next/static/media/	307 KB 152 KB	55ms 54ms	Font font/ttf	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/9326e2d3ef7ce318.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1056299 traceresponse 00-17c91e8e09eb435a1c2c33c3c4af6498-417eab4df98bd0df-01 x-cache HIT content-length 155503 x-served-by cache-ams21046-AMS last-modified Tue, 23 Apr 2024 08:37:38 GMT server cloudflare etag W/"4cd58-18f0a1a78c3" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2df7b6d6a75-TXL x-cache-hits 0
GET H3	200	worker-4bc354d7c93d5ef53b4039bffb7959c0.js Show response dev.visualwebsiteoptimizer.com/edrv/	247 KB 60 KB	82ms 40ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/worker-4bc354d7c93d5ef53b4039bffb7959c0.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash bd15b0ea74bdb57c3f31883129bdc1012c9ef2175b6ee672cb71627df246bb99 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding br via 1.1 google last-modified Tue, 14 May 2024 11:37:23 GMT server gfra1 etag "66434cf3-eec2" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 61122
GET H3	200	va_gq-452ba7dd4c547562cb3cb4585b559e67.js Show response dev.visualwebsiteoptimizer.com/edrv/	249 KB 65 KB	84ms 44ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/va_gq-452ba7dd4c547562cb3cb4585b559e67.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 2818a7888dd41abb997b7d22de2fe34a77453744284b67f07704addc94f8d22d Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding br via 1.1 google last-modified Tue, 14 May 2024 11:37:23 GMT server gfra1 etag "66434cf3-104be" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 66750
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 154 B	131ms 130ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=D301335B9FF8943724AF44753194445A5&h=f1f891aefd85de8200a58f6ce5393fe7&t=false Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT via 1.1 google x-content-type-options nosniff server gnv2c content-type image/gif access-control-allow-origin * cache-control public, max-age=43200 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35
GET H2	200	gtm.js Show response www.googletagmanager.com/	308 KB 103 KB	154ms 65ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 853e3f10f8bb92256affc50b0b1680036724fd2c4e6b4d40e9025b6482df2161 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 104966 x-xss-protection 0 last-modified Wed, 15 May 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 15 May 2024 02:18:14 GMT
GET H2	200	resource-sidebars Show response cms.recordedfuture.com/api/	82 B 825 B	119ms 40ms	XHR application/json	151.101.66.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash 6f2a66b7c2567498349c8dc31d361a2208aa2babd36fdaabe7ef20aefe992bd9 Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Wed, 15 May 2024 02:18:14 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-permitted-cross-domain-policies none age 3091 traceresponse 00-17cf852b2c4c1185f20b74a3cbfe5226-5df5ba829ab6b985-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache HIT via 1.1 varnish content-length 82 x-served-by cache-fra-etou8220021-FRA referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	resources Show response cms.recordedfuture.com/api/	19 KB 19 KB	891ms 812ms	XHR application/json	151.101.66.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][1][$or][0][showFrom][$null]=true&filters[$and][1][$or][1][showFrom][$lte]=2024-05-15T02%3A18%3A14Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash 67afaa5c3b174fe3ad8a3875f8000252ccbf8e60023d3f29ac6778c8f0cf785e Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Wed, 15 May 2024 02:18:15 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-permitted-cross-domain-policies none age 0 traceresponse 00-17cf87faee77182e02544906a5ae0945-190ec1206b952e03-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache MISS via 1.1 varnish content-length 19657 x-served-by cache-fra-etou8220021-FRA referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	blog.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	41 KB 8 KB	450ms 448ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/blog.json?slug=blog Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ef09555eecf0891034910d82b7ab329e133cf9aee921543a1743188dfd59bf3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cf7c791a739effb116d24a36321e36-c21926995f393c8d-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 7654 x-served-by cache-ams21036-AMS server cloudflare etag "sgmhdf52wxwic" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c806a75-TXL x-cache-hits 0
GET H2	404	careers.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	63 KB 12 KB	944ms 942ms	Fetch text/html	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/careers.json?slug=careers Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash 6d4ada1ea389d97b8f475978823cc82c888c1fd2529bc9cd7c7a7038bb669056 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17cf87faeea01de1ff8975aed8a61da6-1141496ae8be6d8a-01 x-powered-by Next.js content-encoding gzip x-cache MISS x-served-by cache-ams21051-AMS server cloudflare vary Accept-Encoding content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2e08c826a75-TXL x-cache-hits 0
GET H2	200	contact.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	50 KB 10 KB	487ms 486ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/contact.json?slug=contact Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0626d10a330336059178ce1b48539d07f02cd898e7f37b9a24603134698ef71a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cf82d55282438c693b4266b57fc567-10797a4894bd990e-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 9887 x-served-by cache-ams21044-AMS server cloudflare etag "2detc5wujf13eh" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c856a75-TXL x-cache-hits 0
GET H2	200	index.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	87 KB 16 KB	83ms 82ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/index.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7950cbdf4e6452f722cbc67d5d4da6dd4516794267972a4bfa989beffd573904 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 2827 traceresponse 00-17cf7fe1f63a29ae2f1daca6683693f6-341a7e8627836be8-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 15632 x-served-by cache-ams21054-AMS server cloudflare etag "r3k088okmv1weq" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c866a75-TXL x-cache-hits 0
GET H2	200	intelligence-cloud.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/platform/	71 KB 13 KB	398ms 397ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/platform/intelligence-cloud.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e640c4cae29215ef0b25e36c3d58aaaecb8d5e5fea3b481eeca932c7b3ed26f4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cf871dbb6c8e793f6f761df83445f4-bb1aa2b1dc421f73-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 12796 x-served-by cache-ams21065-AMS server cloudflare etag "inupmc7ino1jxv" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c876a75-TXL x-cache-hits 0
GET H2	200	solutions.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	76 KB 13 KB	495ms 494ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/solutions.json?slug=solutions Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f0afab194059a19ae41c0ea69719b5b6d8944bb04fb60516f67bab35574ea41 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cf869eeb4886709dae0ce850afc501-3af31f2e64b445d9-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 13464 x-served-by cache-ams21046-AMS server cloudflare etag "14s3a0sr34g1nye" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c886a75-TXL x-cache-hits 0
GET H2	200	client-success.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/services-support/	48 KB 9 KB	482ms 481ms	Fetch application/json	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/services-support/client-success.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 83fa0803830793c3be2cc3432e96c4a53a7e371139bbf3789e9d192746821cda Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cf8568ab61b73f463361e0491e9eb4-377abae423091b85-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 9484 x-served-by cache-ams21038-AMS server cloudflare etag "3uq2pz8ysi11wa" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2e08c896a75-TXL x-cache-hits 0
GET H2	404	research.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	63 KB 12 KB	941ms 940ms	Fetch text/html	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/research.json?slug=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash a12fd62cbae67e4188ea7e9ff176e1c91199b6519c4ea6bcf4b15473c2764896 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17cf87faee790b271d783289b562e9d7-7cc49f4f77ffa41d-01 x-powered-by Next.js content-encoding gzip x-cache MISS x-served-by cache-ams21054-AMS server cloudflare vary Accept-Encoding content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2e08c8a6a75-TXL x-cache-hits 0
GET H2	404	resources.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	63 KB 12 KB	1016ms 1016ms	Fetch text/html	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/resources.json?slug=resources Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash f4764241292bd268ad29bc7695301152ecd4a5fe58b90d6edfb7355d90ba2bc0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17cf87faeeddfcd3050b442f266a88b4-4685fc3e64a30bac-01 x-powered-by Next.js content-encoding gzip x-cache MISS x-served-by cache-ams21033-AMS server cloudflare vary Accept-Encoding content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2e08c8c6a75-TXL x-cache-hits 0
GET H2	404	company.json Show response www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/	63 KB 12 KB	1015ms 1014ms	Fetch text/html	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/4ZFTguBJFaHB-Xb0L8yS_/company.json?slug=company Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash e4fae807f1df28a9af7f5fe950b8a5d9dd5caa7ec0faedc15bf1dce4827edc1a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC age 0 traceresponse 00-17cf87faef0b41e09574d1322bed31ec-e98d03808edf3d32-01 x-powered-by Next.js content-encoding gzip x-cache MISS x-served-by cache-ams21083-AMS server cloudflare vary Accept-Encoding content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2e08c8d6a75-TXL x-cache-hits 0
GET H2	200	dd2bb54f0b86c22d.css Show response www.recordedfuture.com/_next/static/css/	17 KB 0	0ms 0ms	Fetch text/css	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/dd2bb54f0b86c22d.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 535442ba111e790de54198b9f5f20369109f1607e9f69184540567863a565f91 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT via 1.1 varnish x-content-type-options nosniff cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 age 1064319 traceresponse 00-17c8dc2a21af72191bcde5fab73d9f7b-97be3861f80be29b-01 cf-polished origSize=17537 content-encoding gzip x-cache HIT x-served-by cache-ams21024-AMS cf-bgj minify last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"4481-18f0a1a7814" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 883fa2deca996a75-TXL x-cache-hits 0
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	130ms 130ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=D301335B9FF8943724AF44753194445A5&s=1715739494&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1715739494580%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1715739494586&v=2a0cb3dda Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT via 1.1 google x-content-type-options nosniff server gnv2c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET BLOB	200 OK	a67eab9e-0cd2-42d3-834d-666861f0acff https://www.recordedfuture.com/	247 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.recordedfuture.com/a67eab9e-0cd2-42d3-834d-666861f0acff Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash e7225fa97f1c35431df5948009a0dcd93f16774405b2aeddd034cdcd2795738a Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 253053 Content-Type application/javascript
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/	42 KB 8 KB	48ms 47ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=880669&settings_type=1&vn=&eventArch=1&uuid=&ec=958153|962224&exc=8|12|15 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 8fd071e1b806a2660b9b1a0b593a0661513ad688aa43a4bc155f7d6c1e9de6f0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 google server gfra1 etag W/"1715725479_EA" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	129ms 128ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_variationShown&a=880669&v=2a0cb3dda&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip via 1.1 google server gnv2c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	l.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	236ms 236ms	Ping image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=12&account_id=880669&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&combination=2&s=1&sId=1715739494&u=D301335B9FF8943724AF44753194445A5&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1715739494634%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&vn=undefined&vns=undefined&vno=undefined&eTime=1715739494640&v=2a0cb3dda Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT via 1.1 google x-content-type-options nosniff server gnv2c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	129ms 129ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=D301335B9FF8943724AF44753194445A5&s=1715739494&p=1&tags={%22si%22:{%2212%22:%222%22}}&update=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1715739494641&v=2a0cb3dda&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT via 1.1 google x-content-type-options nosniff server gnv2c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H2	200	64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response j.6sc.co/j/	6 KB 2 KB	642ms 470ms	Script application/javascript	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9a73601ec1d6e441ee47efbe510855a822e6d855fa36728d42ff8db3ca13edb9 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id 3w5hm63GPAfRo68wp1nEVb5uiedjUjtH content-encoding gzip date Wed, 15 May 2024 02:18:15 GMT x-amz-cf-pop BOS50-P3 x-amz-server-side-encryption AES256 x-amz-meta-content-type application/json content-length 1962 pragma no-cache last-modified Thu, 28 Mar 2024 14:04:56 GMT server AmazonS3 etag "7d2aaf9fa96d19c8ff79cd758e1347b6" vary Accept-Encoding content-type application/javascript cache-control max-age=0, no-cache, no-store accept-ranges bytes x-amz-cf-id 8NHyIiyyL-aQsttqOg3fUy-hD4hEBBX7QdL_Diq1N4RIo5GA4_GeVw== expires Wed, 15 May 2024 02:18:15 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	315 KB 103 KB	57ms 57ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b8928abd3c469acedb706817198b8bf13e758608c86d0339107af4499a24d3d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 105656 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Wed, 15 May 2024 02:18:14 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	134ms 38ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip last-modified Fri, 22 Mar 2024 21:07:24 GMT x-amz-server-side-encryption AES256 etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15412 x-served-by cache-iad-kiad7000168-IAD, cache-fra-etou8220107-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	47 KB 17 KB	142ms 41ms	Script application/javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 06 May 2024 17:20:18 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=62955 accept-ranges bytes content-length 16683
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	46ms 39ms	Script text/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 15 May 2024 02:15:32 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 162 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Wed, 15 May 2024 04:15:32 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	133ms 39ms	Script text/javascript	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:18:44 GMT content-encoding gzip x-content-type-options nosniff age 68370 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 14 May 2025 07:18:44 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	218 KB 59 KB	127ms 40ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 15 May 2024 02:18:14 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 57845 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=38, rtx=0, c=12, mss=1294, tbw=2789, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug WsCiRV26foNgJOVyaK0TELy8/1NwvYsEVWHhdNt5SVrCCWF0u4olzGa1AxuNuilYdFtIR4BeJT2vm5Zun6msZA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	container_nbhoRDM8.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	255 KB 72 KB	188ms 97ms	Script application/javascript	2600:9000:2724:2c00:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2724:2c00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 1a05df42ef9d39590206db8fa312263869e8bb5412e8e49e4a26f69434378342 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 01:42:52 GMT x-amz-version-id fWFQoupYkDYoPThaxu70CFB9bmx.yYlZ content-encoding gzip strict-transport-security max-age=31536000 via 1.1 8a7cd2920ac4cbceb2a8f9a130562a4c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P12 age 2123 x-cache Hit from cloudfront x-amz-replication-status FAILED last-modified Mon, 13 May 2024 21:21:56 GMT server CloudFront etag W/"e82c9d0943cb96607be27127743df235" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id 5VrwDp6dUQYb7BaZ_w81EENEIQD-LkO0d16tbjlX_SkrdVznAa52uA==
GET H2	200	matomo.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	202 KB 59 KB	135ms 44ms	Script application/javascript	2600:9000:2724:2c00:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2724:2c00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 00:03:17 GMT x-amz-version-id nUcBrzhVy9JMMaAtFkxpvW8b5Jy3nYQT content-encoding gzip strict-transport-security max-age=31536000 via 1.1 8a7cd2920ac4cbceb2a8f9a130562a4c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P12 age 8098 x-cache Hit from cloudfront x-amz-replication-status FAILED last-modified Mon, 29 Apr 2024 00:09:25 GMT server CloudFront etag W/"5c359e1fa9398dc7248bc8740cc8eb49" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id HApf8BCX4MqbG44WXKsVe4JoHL9my-5pi6QlIqTIwJ6XUDWzMsiptg==
GET H2	200	252628.js Show response js.hs-scripts.com/	2 KB 1 KB	148ms 55ms	Script application/javascript	2606:4700::6810:8dd1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/252628.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8dd1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 912205c0a8cb83fdd604f68c64c699c7cc6e1492fbd519d56f28a1c6d7b55c9a Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT x-hubspot-correlation-id 5cd8f0d7-0c49-49d3-a8c1-f6924c0a3a3a x-evy-trace-route-service-name envoyset-translator cf-polished origSize=2007 age 0 x-envoy-upstream-service-time 6 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5cd8f0d7-0c49-49d3-a8c1-f6924c0a3a3a cf-bgj minify last-modified Wed, 15 May 2024 02:18:14 GMT server cloudflare access-control-max-age 3600 vary origin, Accept-Encoding content-type application/javascript;charset=utf-8 access-control-allow-origin https://therecord.media x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5d47c8d44f-rgk8x x-evy-trace-virtual-host all access-control-allow-credentials true cache-control public, max-age=90 cf-ray 883fa2e26bb3a02e-FRA expires Wed, 15 May 2024 02:19:44 GMT
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 195 B	49ms 48ms	Image image/gif	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2019543576&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future&utmhid=1415296009&utmr=-&utmp=%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&utmht=1715739494733&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.1761997920.1715739495.1715739495.1715739495.1%3B%2B__utmz%3D93161374.1715739495.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=547516202&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAAAAAAE~ Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 259 B	170ms 34ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je45d0v873499763z8830966511za200&_p=1715739494405&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1825314062.1715739495&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1715739494&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&dt=GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1181 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 259 B	183ms 46ms	Ping text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=1825314062.1715739495&gtm=45je45d0v873499763z8830966511za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	122ms 48ms	Image image/gif	172.217.16.195 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-MHTMF48BZH&cid=1825314062.1715739495&gtm=45je45d0v873499763z8830966511za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=471558163 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f195.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:14 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 376 B	259ms 151ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=9da77592-8201-47c3-a193-32828c61a0af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=9bdb6fd2-48ab-42b2-b56b-ae145e010e3b&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 108 date Wed, 15 May 2024 02:18:14 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 60d8686400a8a943 cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash 6435afcc8bc1adc70cfc5db2cfa7222a70bc7234abff94a0f61f116bfa03369f content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 394 B	337ms 224ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=9da77592-8201-47c3-a193-32828c61a0af&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=9bdb6fd2-48ab-42b2-b56b-ae145e010e3b&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 184 date Wed, 15 May 2024 02:18:14 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 6e0a622cad6fe60f cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash 178540e24f1a3c79d5c91b80186f7d06fd45d6443710f1c886fb1624fa2e4d6c content-length 43
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 705 B	301ms 189ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:14 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 04EDCEF28E60468BB8E2C86875E462EA Ref B: FRAEDGE1319 Ref C: 2024-05-15T02:18:14Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.recordedfuture.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYYdLshMYoK67gh2r17cQ==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-inf... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-inf... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-in...	0 265 B	393ms 174ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&e_ipv6=AQJFC25xEcOYtwAAAY96CwwJlLWDaH45oOpIImpF5HhljihrJ0mqaW5WerERGX4-WcbKlflG Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.recordedfuture.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Wed, 15 May 2024 02:18:15 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 8B14B498978F440E89574A4D88DD9402 Ref B: DUS30EDGE0808 Ref C: 2024-05-15T02:18:15Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAYYdLssWKOQAGM40IO4tA== Redirect headers date Wed, 15 May 2024 02:18:14 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: AD9DA697F0C24FE394D15D1F08FA3D49 Ref B: FRAEDGE1319 Ref C: 2024-05-15T02:18:15Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715739494851&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&e_ipv6=AQJFC25xEcOYtwAAAY96CwwJlLWDaH45oOpIImpF5HhljihrJ0mqaW5WerERGX4-WcbKlflG x-li-proto http/2 content-length 0 x-li-uuid AAYYdLsm6dXxZLVLKdQOKg==
POST H2	204	matomo.php recordedfuture.matomo.cloud/	0 173 B	181ms 73ms	Ping text/plain	18.157.122.248 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2FGitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future&idsite=1&rec=1&r=187999&h=4&m=18&s=14&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&_id=&_idn=1&send_image=0&_refts=0&pv_id=vgreic&pf_net=79&pf_srv=487&pf_tfr=6&pf_dm1=21&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22124.0.6367.201%22%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22124.0.6367.201%22%7D%2C%7B%22brand%22%3A%22Not-A.Brand%22%2C%22version%22%3A%2299.0.0.0%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200 Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-122-248.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=utf-8 Response headers access-control-allow-origin https://www.recordedfuture.com date Wed, 15 May 2024 02:18:15 GMT access-control-allow-credentials true server Apache vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent
GET H2	200	configs.php Show response recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/	116 B 290 B	119ms 49ms	Script application/javascript	18.157.122.248 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=1SjEAU&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-122-248.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash e2f3970b00547efcc12b46373bd9e9dd14306c0f1808ae426fe68c95f8df7756 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT content-encoding gzip server Apache content-length 118 vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent content-type application/javascript
GET H2	200	194163687656043 Show response connect.facebook.net/signals/config/	67 KB 14 KB	119ms 116ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/194163687656043?v=2.9.156&r=stable&domain=www.recordedfuture.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa9ce7833973c4c7eb59f8fd769049807c3e27fbc651dcf62aebf109a5aa14f4 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Wed, 15 May 2024 02:18:15 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=39, rtx=0, c=63, mss=1294, tbw=63331, tp=-1, tpl=-1, uplat=76, ullat=0 pragma public x-fb-debug gOUTxIsz6IW/Nzcu3gLkaMY4WDi69acqqUj3tXXi5zFw4tXoiaw8iYIbFmXOWjIx38+1NCgUnDwvZKJSpc/JXg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 274 B	126ms 40ms	Image text/plain	2a03:2880:f177:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&rl=&if=false&ts=1715739495056&sw=1600&sh=1200&v=2.9.156&r=stable&ec=0&o=4126&fbp=fb.1.1715739495055.1843180347&cs_est=true&ler=empty&cdl=API_unavailable&it=1715739494921&coo=false&rqm=GET Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=38, rtx=0, c=10, mss=1294, tbw=2781, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Wed, 15 May 2024 02:18:15 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	6si.min.js Show response j.6sc.co/	66 KB 18 KB	45ms 45ms	Script application/javascript	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 0ab9bf7458a4a0fb39e8e166e646a17495c51b99ea45e0ab4c66e22427e42d83 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 09 May 2024 06:01:26 GMT server nginx/1.14.0 (Ubuntu) etag "663c66b6-106e1" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 18049 expires Wed, 15 May 2024 02:18:15 GMT
GET H2	200	252628.js Show response js.hs-banner.com/	62 KB 17 KB	719ms 347ms	Script text/javascript	2606:4700:4400::6812:22e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17c39229a4d60659b47d8474aa4b13f76d563dc7883ed91f8faa86e3f01744b1 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT x-amz-version-id U5pxzyApImJkFHlpe.yavVjG2WZI8SX6 content-encoding br cf-cache-status REVALIDATED x-amz-request-id D6TNC2VP17W6F3XD x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 85fa266a-0096-4d02-8b59-1f04f9babc52 x-envoy-upstream-service-time 22 x-amz-id-2 6HPdy8GDjKU3dBCrhJUnFRFVDzK8y0SejRqDS3BMIQ4Ual3se86gEVzWjDrvr8dZjnrZA5/0bgM= x-evy-trace-listener listener_https x-request-id 85fa266a-0096-4d02-8b59-1f04f9babc52 x-evy-trace-route-configuration listener_https/all last-modified Mon, 29 Apr 2024 16:58:41 GMT server cloudflare etag W/"4fa54ac73d5a033ba4bf8ed126e75c5a" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://therecord.media x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-6w4vh vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 883fa2e85c378eca-FRA expires Wed, 15 May 2024 02:23:16 GMT
GET H2	200	web-interactives-embed.js Show response js.hubspot.com/	82 KB 25 KB	436ms 65ms	Script application/javascript	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hubspot.com/web-interactives-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf6683ec2fb825072bc67ba2b4831425951dc365245d5334ca6f2150f50e1590 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding br age 334 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1122/bundles/project.js&cfRay=883f9abd59859c07-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"fa60ef0d372e46facb8180b2d901ba81" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.1122/bundles/project.js date Wed, 15 May 2024 02:18:15 GMT x-amz-version-id TKnbzs9HpFoaV4UGBsfs5UANej3HQBO9 via 1.1 b9e3ae23b2e5d7b2e1c159467ba23f34.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id a72790fd-e36f-4f65-accf-1fee166cca80 x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-request-id a72790fd-e36f-4f65-accf-1fee166cca80 last-modified Tue, 14 May 2024 11:26:52 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewjhDIJ5O9awHPAbRkYx7FGbpmmi5JDs%2FE1kJtjvDooO3fRNuKv9kHEq57HfkJ7jVfsmZ%2BLrQSDA51R1OZ5%2BL9d2pKrE6iGAWq3G6dPZcOxm4GypUvhYFR0hv0o99pxVWT4xGZIOg7mFCkf0"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-68b7f7fbff-qbnbs cf-ray 883fa2e85f114db9-FRA x-amz-cf-id xX1XoSs3u6iUlbOz-8ZUhr4OrtdCut9rqFNg5stitZzhF8-jDQvTkw==
GET H2	200	leadflows.js Show response js.hsleadflows.net/	551 KB 88 KB	415ms 52ms	Script application/javascript	2606:4700::6812:8d11 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:8d11 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding br x-evy-trace-route-service-name envoyset-translator age 33075 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=883c7b654c239748-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"d252299cef5b9176cf0435e72e0baeeb" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js date Wed, 15 May 2024 02:18:15 GMT x-amz-version-id FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc via 1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 791df7bd-25f3-43cd-ac0e-bff5b69bc5c8 x-cache RefreshHit from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 20 x-evy-trace-route-configuration listener_https/all x-request-id 791df7bd-25f3-43cd-ac0e-bff5b69bc5c8 last-modified Wed, 03 Apr 2024 09:27:53 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-68b7f7fbff-ddwd7 cf-ray 883fa2e84c4e3825-FRA x-amz-cf-id wIF9Rvjhl9sUXVjDCHScz9B78URJwBaBmHLKn1omXxhf31_KTL1Ezw==
GET H2	200	252628.js Show response js.hs-analytics.net/analytics/1715739300000/	68 KB 22 KB	556ms 186ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1715739300000/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e6188d2da190a811abd709d89507a072d74b304d794596e29180eae30268637 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT x-amz-version-id null content-encoding br cf-cache-status MISS x-amz-request-id XPJQ5KEZ2G69Z7K6 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 1f096ca1-b2a2-49ae-95ff-ab5ba7c64064 x-envoy-upstream-service-time 40 x-amz-id-2 ybakni6SUOC9Ncoyevi8q8/htO05/oJGdd9zBwlkhFEnckBx+TnQDhe5e5YiAOmCuyDzAqAvZ0c= x-evy-trace-listener listener_https x-request-id 1f096ca1-b2a2-49ae-95ff-ab5ba7c64064 x-evy-trace-route-configuration listener_https/all last-modified Mon, 06 May 2024 17:49:13 GMT server cloudflare etag W/"13db477962d2f63971f5678175a79547" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-9fld2 cache-control max-age=300,public access-control-allow-credentials false cf-ray 883fa2e85a194d62-FRA expires Wed, 15 May 2024 02:23:15 GMT
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 704 B	357ms 42ms	XHR application/json	37.252.171.149 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT an-x-request-uuid 90ee6e98-7271-4600-831b-eba94cf84e41 server nginx/1.23.4 accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com cache-control no-store, no-cache, private access-control-allow-credentials true x-proxy-origin 80.255.7.103; 80.255.7.103; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com content-length 11 x-xss-protection 0 expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 198 B	58ms 45ms	XHR text/html	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.recordedfuture.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	20 B 315 B	354ms 40ms	XHR text/html	2a02:26f0:ab00::214:8e70 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3992ccb3af03535e9a36522b5bdab5c153ee264de529da6bb1eea9fcfa654abc Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT vary Origin content-type text/html access-control-allow-origin https://www.recordedfuture.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::11 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715739495503_34901612_376107302_23_953_38_237_219";dur=1 content-length 20 expires Wed, 15 May 2024 02:18:15 GMT
GET H2	200	details Show response epsilon-globalaccelerator.6sense.com/v3/company/	725 B 712 B	112ms 44ms	XHR application/json	76.223.9.105 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon-globalaccelerator.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 76.223.9.105 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 X-6s-CustomID WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers x-trace-id 1359881450533133766 date Wed, 15 May 2024 02:18:15 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 387
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	139ms 131ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:15 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	141ms 133ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:15 GMT
OPTIONS H2	200	details epsilon-globalaccelerator.6sense.com/v3/company/	0 0	203ms 41ms	Preflight	76.223.9.105 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon-globalaccelerator.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 76.223.9.105 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.recordedfuture.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Wed, 15 May 2024 02:18:15 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 227317202526550794
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	131ms 130ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A11%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:15 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:15 GMT
GET H2	200	combinedConfigs Show response cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/	433 B 1 KB	161ms 152ms	Fetch application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id c86aa99d-6f81-4739-946b-2544afc06c0c content-encoding br x-envoy-upstream-service-time 9 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c86aa99d-6f81-4739-946b-2544afc06c0c server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3w%2BkhkNwDBfA6fXRSIp3oiYBSPNS0WP%2F5vB0bWLDxEoKsQeCudqKMr3jEuBGnvDyY%2Bsdu83sy41CajOiSVIHeFXLw9BsLmWOO%2BpZiv6I7LjfjRFv%2FrXUUAjgjLt9lkeJL6Lly28sNXkJRITdhHWrAD1MVL%2BnxDrwjN4%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 883fa2e8ef7b4db9-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-9ls2q
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	159ms 159ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=https%3A%2F%2Fepsilon-globalaccelerator.6sense.com&q=%7B%22name%22%3A%22https%3A%2F%2Fepsilon-globalaccelerator.6sense.com%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1949%2C%22duration%22%3A315.6999988555908%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1949%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A2264.699998855591%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22eu-central-1a%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=&d=1&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:16 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:16 GMT
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 928 B	215ms 171ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 90aa7a64-7b93-429c-97fd-81b8f42b3f7a x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 90aa7a64-7b93-429c-97fd-81b8f42b3f7a last-modified Wed, 15 May 2024 02:18:16 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-xkc98 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 883fa2ea1b6e6a74-TXL
GET H3	200	nc-07ba3c224d151a0b37b39d9ec3466137.js Show response dev.visualwebsiteoptimizer.com/edrv/	9 KB 3 KB	46ms 45ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/nc-07ba3c224d151a0b37b39d9ec3466137.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash e7d80425c6c0c64a41b69ee929c9e3b6451d7c5196f435e6248ee6496b71a2be Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT content-encoding br via 1.1 google last-modified Tue, 14 May 2024 11:37:23 GMT server gfra1 etag "66434cf3-c28" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3112
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	243ms 156ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715739496181&vi=3c6d90426a16e55d0803f6f554064a65&nc=true&u=57501621.3c6d90426a16e55d0803f6f554064a65.1715739496177.1715739496177.1715739496177.1&b=57501621.1.1715739496177&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id f4cb2ecf-4b92-4033-815d-579675b8fdbd p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id f4cb2ecf-4b92-4033-815d-579675b8fdbd server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MjONrgynsDzrbFTKkYStVuMDQMANt6W6%2FQ9yhU3qPgj6fkuO9RdveMG%2FBwX3iuKymCIozkpDneN8CAP23pD9l2JHm10P7An02%2FuvWkpQc0Vm7ezdeuLmqxLZsYh3jMcC0uK9HL1QaW0cuLKz6qYB"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-djmcg x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 883fa2ebdc834d2e-FRA x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 754 B	255ms 167ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?id=vwo_Campaign-12_Variation-1&value=null&k=3&n=vwo_Campaign-12_Variation-1&m=&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715739496184&vi=3c6d90426a16e55d0803f6f554064a65&nc=true&u=57501621.3c6d90426a16e55d0803f6f554064a65.1715739496177.1715739496177.1715739496177.1&b=57501621.1.1715739496177&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id a28a1d68-b1a4-4cc1-9c67-1634956d0e7c p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 8 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a28a1d68-b1a4-4cc1-9c67-1634956d0e7c server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V0Qw5JyRQWnjOfJGDWRa5i%2FpS3Qmt7K90qA6EXf8vm%2B3Y6K0GFj4h3P%2FeJ0XcfjGBYXTbL%2FgnHxzsvt9E6VyrWLjUuKMtfzHKaFjBzpcwzsmpWrjFtHKS%2FhRxPzF8z7XDms%2B3LDvou98PyRFLl76"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-c67ms x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 883fa2ebdc844d2e-FRA x-robots-tag none
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	164ms 164ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=2a0cb3dda&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 15 May 2024 02:18:16 GMT content-encoding gzip via 1.1 google server gnv2c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	favicon.ico www.recordedfuture.com/	17 KB 912 B	481ms 480ms	Other image/x-icon	172.64.144.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.144.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cf87fb569fb7ac0f7ac2241e9680bc-7b05f9baa3c1f495-01 x-cache MISS content-length 676 x-served-by cache-ams21083-AMS last-modified Tue, 14 May 2024 10:48:13 GMT server cloudflare etag W/"423e-18f76b791c8" vary Accept-Encoding content-type image/x-icon cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 883fa2eb69fd6a75-TXL x-cache-hits 0
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	2 KB 2 KB	171ms 171ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=3c6d90426a16e55d0803f6f554064a65&__hstc=57501621.3c6d90426a16e55d0803f6f554064a65.1715739496177.1715739496177.1715739496177.1&__hssc=57501621.1.1715739496177&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 244f0d91a028686ee4eca2e9092b26cfb82f946dd6928a65a3b60ff3f4c45c13 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 819b62a4-85aa-4191-98fe-91163ce4a9bc content-encoding br x-envoy-upstream-service-time 26 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 819b62a4-85aa-4191-98fe-91163ce4a9bc server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-6tvwb access-control-max-age 180 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=52876HJ4afCSXIwE%2F5WvSl5toB5YYadIyHxrpUovTiLLlO14tq%2Bm%2FxRLRiVr8L7aqjOPUsSSONSRMXqE13QHdzHRo4%2BrpMMBpFKCZMTpPjALGDvoV0PhkHr9nHlfg9aWH4MK9AEbX%2FHq34FCzBJ3"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 883fa2eb88e54db9-FRA
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	132ms 132ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=2a0cb3dda&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 15 May 2024 02:18:16 GMT content-encoding gzip via 1.1 google server gnv2c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	__ptq.gif track.hubspot.com/	45 B 749 B	171ms 171ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715739496401&vi=3c6d90426a16e55d0803f6f554064a65&nc=true&u=57501621.3c6d90426a16e55d0803f6f554064a65.1715739496177.1715739496177.1715739496177.1&b=57501621.1.1715739496177&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 02:18:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 855044c7-c5ed-44df-88b2-137f42961de2 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 855044c7-c5ed-44df-88b2-137f42961de2 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBCtbWjCvSBd6cM8b4uqSm5VHFjKTrlrYDaFwOA2KDChDqobZj50uLlJMGVBEk9VHDSqZxnYqbT2UxDMaF3t0lGoS2TQ7jnAp3tOz%2F%2F3oPumHZQ2Yc1EaecaTgpnURBPS2iNfr6J9c%2FzgB9ZMUNu"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-hch7x x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 883fa2ecacea4d2e-FRA x-robots-tag none
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	133ms 133ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A15%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:16 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:16 GMT
GET H3	200	iphone-cd1.jpg go.recordedfuture.com/hubfs/	83 KB 85 KB	189ms 66ms	Image image/webp	199.60.103.254 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://go.recordedfuture.com/hubfs/iphone-cd1.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy upgrade-insecure-requests x-amz-meta-cache-tag F-99167145604,P-252628,FLS-ALL age 529830 x-amz-request-id RF2PT4B1SFJFGCCA x-amz-server-side-encryption AES256 edge-cache-tag F-99167145604,P-252628,FLS-ALL x-amz-replication-status COMPLETED content-disposition inline; filename="iphone-cd1.webp" x-hs-cf-lambda us-east-1.EnforceAclForReads 3 cf-bgj imgq:85,h2pri etag "f5c3d1b581a50e5c3637310137a43f0e" vary Accept, Accept-Encoding access-control-allow-methods GET content-type image/webp access-control-allow-origin * x-amz-meta-created-unix-time-millis 1674144065940 cache-control s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 x-robots-tag all x-hs-cf-lambda-enforce us-east-1.EnforceAclForReads 3 date Wed, 15 May 2024 02:18:17 GMT strict-transport-security max-age=31536000 via 1.1 524a19c44176623513fff0bfa6aba1f0.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-amz-version-id CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx x-amz-cf-pop MAN50-C2 x-hs-alternate-content-type text/plain cf-polished qual=85, origFmt=jpeg, origSize=229013 x-cache RefreshHit from cloudfront cache-tag F-99167145604,P-252628,FLS-ALL x-amz-meta-index-tag all x-amz-storage-class INTELLIGENT_TIERING alt-svc h3=":443"; ma=86400 content-length 85082 x-amz-id-2 q1YPYMuW2u8Ih+sIl/DxqFTYOSwhMabuasJeHARI9L2xRJXkdwoH2yyq2mB9lw7PIqTwUg+f0X4= last-modified Thu, 19 Jan 2023 16:01:07 GMT server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ppz5sXMuYXtxFd6q7LgaFQkxvxWLVpbXN%2Bjhf7gaqHqvZIa5EBKLi88r0TB8Moh8oeov4wiG308BcFwXrjPHSQLVxW8vrAg8Jg%2F0gPRFcawTfcvN8tGi%2FyATdCYfvn20AnCtFHk54w%3D%3D"}],"group":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 883fa2f3a9606a76-TXL timing-allow-origin d8fk70yj6xfhx.cloudfront.net x-amz-cf-id 6N6Uyo6EqVBEgb7AatVcvjs1V7L6BqhLh4BQYo70WvJeUuOObu35kg==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	140ms 138ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=ni%3AmapCookie&q=%7B%22thirdPartyValues%22%3A%22%5B%7B%5C%22map%5C%22%3A%5C%22Hubspot%5C%22%2C%5C%22cookieName%5C%22%3A%5C%22hubspotutk%5C%22%2C%5C%22cookieValue%5C%22%3A%5C%223c6d90426a16e55d0803f6f554064a65%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:17 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:17 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	142ms 141ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A16%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%222011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:17 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:17 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	142ms 142ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:18 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:18 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	137ms 136ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A18%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%224019%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:19 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:19 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 130ms	Image image/gif	104.115.82.10 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=5a44b29d-715d-4eb6-8280-a7c703088d29&session=395ef60a-7bbe-4cab-83d7-d106ccfdce59&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2015%20May%202024%2002%3A18%3A19%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225019%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=bfa9d72a-a2b1-4bd1-88a5-7f496c5389d5&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-115-82-10.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Wed, 15 May 2024 02:18:20 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 May 2024 02:18:20 GMT