blogs.jpcert.or.jp Open in urlscan Pro
52.198.153.39 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
Submission: On July 11 via api (July 11th 2024, 2:11:42 am UTC) from TR — Scanned from JP

Summary HTTP 66 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 13 IPs in 4 countries across 9 domains to perform 66 HTTP transactions. The main IP is 52.198.153.39, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is blogs.jpcert.or.jp.
TLS certificate: Issued by Cybertrust Japan SureServer EV CA G3 on January 5th 2024. Valid for: a year.

This is the only time blogs.jpcert.or.jp was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
22	52.198.153.39 52.198.153.39	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2404:6800:400... 2404:6800:400a:80e::2008	15169 (GOOGLE) (GOOGLE)
15	3.115.249.128 3.115.249.128	16509 (AMAZON-02) (AMAZON-02)
6	210.231.184.197 210.231.184.197	2514 (INFOSPHER...) (INFOSPHERE NTT PC Communications)
5	117.18.237.66 117.18.237.66	15133 (EDGECAST) (EDGECAST)
2	2404:6800:400... 2404:6800:400a:80a::200e	15169 (GOOGLE) (GOOGLE)
1	52.196.227.230 52.196.227.230	16509 (AMAZON-02) (AMAZON-02)
5	172.217.25.164 172.217.25.164	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:400a:804::200e	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4008:c02::9a	15169 (GOOGLE) (GOOGLE)
1	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
66	13

22 52.198.153.39 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

blogs.jpcert.or.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:400a:80e::2008 (Osaka, Japan)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 3.115.249.128 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

movabletype.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 210.231.184.197 (Japan)

ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)
PTR: 210-231-184-197.pro.static.arena.ne.jp

pro.ranklet4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 117.18.237.66 (Australia)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:400a:80a::200e (Osaka, Japan)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.196.227.230 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-196-227-230.ap-northeast-1.compute.amazonaws.com

ws.jpcert.or.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.25.164 (United States)

ASN15169 (GOOGLE, US)
PTR: kix06s19-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:400a:804::200e (Osaka, Japan)

ASN15169 (GOOGLE, US)

clients1.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4008:c02::9a (Taipei, Taiwan)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	jpcert.or.jp blogs.jpcert.or.jp ws.jpcert.or.jp	780 KB
15	movabletype.net movabletype.net	3 MB
8	google.com cse.google.com — Cisco Umbrella Rank: 5883 www.google.com — Cisco Umbrella Rank: 10 clients1.google.com — Cisco Umbrella Rank: 686	184 KB
6	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1906 syndication.twitter.com — Cisco Umbrella Rank: 2295	31 KB
6	ranklet4.com pro.ranklet4.com	16 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 102	21 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 110	268 KB
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 208	348 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 331	6 KB
66	9

	Domain	Requested by
22	blogs.jpcert.or.jp	blogs.jpcert.or.jp
15	movabletype.net	blogs.jpcert.or.jp
6	pro.ranklet4.com	blogs.jpcert.or.jp
5	www.google.com	cse.google.com www.google.com blogs.jpcert.or.jp
5	platform.twitter.com	blogs.jpcert.or.jp platform.twitter.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	www.googletagmanager.com	blogs.jpcert.or.jp www.googletagmanager.com
2	cse.google.com	blogs.jpcert.or.jp www.google.com
1	syndication.twitter.com	blogs.jpcert.or.jp
1	stats.g.doubleclick.net	www.google-analytics.com
1	clients1.google.com	blogs.jpcert.or.jp
1	ws.jpcert.or.jp	blogs.jpcert.or.jp
1	cdnjs.cloudflare.com	blogs.jpcert.or.jp
66	13

This site contains links to these domains. Also see Links.

Domain
www.jpcert.or.jp
asec.ahnlab.com

Subject Issuer	Validity	Valid
blogs.jpcert.or.jp Cybertrust Japan SureServer EV CA G3	`2024-01-05` - `2025-01-31`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
*.google-analytics.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
movabletype.net Amazon RSA 2048 M02	`2024-02-11` - `2025-03-11`	a year	crt.sh
*.ranklet4.com R3	`2024-06-03` - `2024-09-01`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-08` - `2025-07-07`	a year	crt.sh
*.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
ws.jpcert.or.jp Cybertrust Japan SureServer EV CA G3	`2024-01-05` - `2025-01-31`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
syndication.twitter.com R3	`2024-05-28` - `2024-08-26`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
Frame ID: F0C22C170BBB7473FCCF00A1F0A5546D
Requests: 63 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fblogs.jpcert.or.jp
Frame ID: 6AB5E8007D7D80EA23DD550874E0FA67
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: CE0AFE029538E2BE3D3A81A66E48A8C3
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: ABB87C2512C718B50F29BE724E2AC559
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Attack Activities by Kimsuky Targeting Japanese Organizations - JPCERT/CC Eyes | JPCERT Coordination Center official Blog

Detected technologies

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

66
Requests

100 %
HTTPS

46 %
IPv6

9
Domains

13
Subdomains

13
IPs

4
Countries

4468 kB
Transfer

5638 kB
Size

4
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.jpcert.or.jp/english/

Search URL Search Domain Scan URL

URL: https://asec.ahnlab.com/en/65245/
Title: https://asec.ahnlab.com/en/65245/

Search URL Search Domain Scan URL

URL: https://asec.ahnlab.com/en/54736/
Title: https://asec.ahnlab.com/en/54736/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

66 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request attack-activities-by-kimsuky-targeting-japanese-organizations.html Show response
blogs.jpcert.or.jp/en/2024/07/ 52 KB
10 KB 81ms
62ms Document
text/html 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

47f7eeef23249fe011c951550da901abeb20d8f18f395f5a707e4d19d8cb5a83

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 63812
content-encoding: gzip
content-length: 10181
content-type: text/html; charset=utf-8
date: Thu, 11 Jul 2024 02:11:37 GMT
expect-ct: enforce, max-age=3600
strict-transport-security: max-age=3600
vary: Accept-Encoding
x-content-type-options: nosniff
x-runtime: 1.536202
x-xss-protection: 1; mode=block

GET
H2 200 styles.css
blogs.jpcert.or.jp/en/common/css/ 37 KB
8 KB 29ms
26ms Stylesheet
text/css 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/css/styles.css

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

6f7505af235b3dec440dedfbc35698ffd35372032e9c0122afc003636ea894b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.051290
date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=3600
age: 63812
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 8161
x-xss-protection: 1; mode=block

GET
H2 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
6 KB 42ms
20ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://blogs.jpcert.or.jp/
Origin: https://blogs.jpcert.or.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 16554
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5884
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-9226"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGzSwZNq%2BnJlA3BzWT%2BoXHhI7a6wvMyo8uttM%2BRyrWvCythtXtx5I8HReA1vfTLlZXAEwBYMAi6iXUxEPFhDYWsZNYPS%2BJMLz2%2BVfJlScU6QaTwwM8DVI%2F8HbSdoH6JczdIyrDhFwkl4FksyahE9agP1"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a15438d7c058a7e-NRT
expires: Tue, 01 Jul 2025 02:11:37 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 198 KB
72 KB 133ms
64ms Script
application/javascript 2404:6800:400a:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80e::2008 Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b19fdba3215ee25adf8ad72ba5b322d1cda012f55c66afbecbae42fbb643fe30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 73500
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 290 KB
98 KB 142ms
73ms Script
application/javascript 2404:6800:400a:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80e::2008 Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cd7495cc0174b33a7294c4a6206ad39c5af9edab9aadb54ae5b84be441d407b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 100360
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H2 200 header_logo.svg
blogs.jpcert.or.jp/en/common/images/ 3 KB
2 KB 28ms
27ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/header_logo.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.047280
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 7PlhVPaL1XdtPVOkYQdVycFCOo3AsXaK
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:20:14 GMT
content-encoding: gzip
age: 228816
etag: W/"470f7c2a7f953ad63a2f660ce00a9ef3"
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1443
x-xss-protection: 1; mode=block

GET
H2 200 image-992ce083-832a-45c5-a3d8-5922b68506a7.jpg
movabletype.net/users/kino/ 81 KB
82 KB 73ms
39ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/kino/image-992ce083-832a-45c5-a3d8-5922b68506a7.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

d025d624352f8a6ceec63d1be3f7513b4874d370d224a3011620d20c03276e2e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: rm7cfsZ5Ce6oLWec3yfNemazc91RQBCq
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 19 Feb 2020 02:36:54 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "e1c0b0f3e14981fa62431e8e3dee6b24"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 83292
x-xss-protection: 1; mode=block

GET
H2 200 kimsuky_flow_en-800wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 92 KB
92 KB 28ms
27ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/kimsuky_flow_en-800wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

90c303a365018ed76dffa5bbb9562f3f90d55f7381714cb86bc8933dfb02f20c

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.080152
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 12 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 02 Jul 2024 10:47:30 GMT
age: 6127
etag: "50c5ab9eab62bfaaf2036ada320a0d76"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 94066
x-xss-protection: 1; mode=block

GET
H2 200 favicon-800wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 16 KB
16 KB 5ms
4ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/favicon-800wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

dea4794dcfd4d100622bcf0779f940c227609bffe3529f1b843dd9f58418148c

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.079876
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 12 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 02 Jul 2024 10:49:42 GMT
age: 6127
etag: "16b9a3a124ad84a73da52cdf223b0b30"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 15890
x-xss-protection: 1; mode=block

GET
H2 200 PokDoc-800wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 14 KB
14 KB 5ms
4ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/PokDoc-800wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

47c6df2277c9b5d205828e4cd75bf095cf4e8c891de60d7424c6c5a5bbbe67b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.089423
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 12 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 02 Jul 2024 10:49:42 GMT
age: 6127
etag: "52b9a602c936f4cd2c79f17055850afc"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 14185
x-xss-protection: 1; mode=block

GET
H2 200 vbs-800wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 7 KB
7 KB 4ms
4ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/vbs-800wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

de582e8fbdee40e0bdb5b55b703891779f53c244b5e83a77e5c038ae51c010e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.182096
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 12 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 02 Jul 2024 10:49:42 GMT
age: 6126
etag: "22e8e7b3225b3763f50b94d657b2e983"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 7153
x-xss-protection: 1; mode=block

GET
H2 200 InfoKey-800wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 12 KB
12 KB 10ms
4ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/InfoKey-800wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

feb37150b5f9e9ca94b9238d125134dc36f2515de2dda77c439450e9d016e761

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.099228
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 12 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 02 Jul 2024 10:49:42 GMT
age: 6126
etag: "a6b3ce54aa3e0c53105d807795126eec"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 12244
x-xss-protection: 1; mode=block

GET
H2 200 fb_loader.gif
blogs.jpcert.or.jp/en/common/images/ 889 B
1 KB 10ms
3ms Image
image/gif 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/fb_loader.gif

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

2ec9087635398a0a4f08808b2d5bd3af37542c290314c060303ee3a41e7af6bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.049525
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: teKMG5tddGNKpEgVSFdR5NGD.rr0iMNz
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
age: 220952
etag: "86ca4d6e0539b88294cdf7e757b79455"
expect-ct: enforce, max-age=3600
content-type: image/gif
accept-ranges: bytes
content-length: 889
x-xss-protection: 1; mode=block

GET
H2 200 pypi-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 35 KB
35 KB 13ms
6ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/pypi-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

9c55a48ea14ce2f39c148c8b10018e4e844de9182393762e31434f1ceed3e525

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.072378
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Thu, 08 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Fri, 28 Jun 2024 11:16:58 GMT
age: 50603
etag: "d8980dabf974a0968593a9f30d037772"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 35581
x-xss-protection: 1; mode=block

GET
H2 200 maldocpdf-fig1-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 270 KB
270 KB 13ms
7ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/maldocpdf-fig1-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

cf99cf55b2afc39f2d5c89093e53203df0e5446052cbe9d6353128fc649a27de

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.096239
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Wed, 07 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Thu, 27 Jun 2024 10:38:00 GMT
age: 50603
etag: "5e47f2801058e89b5be3ebbbe389bc0a"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 276097
x-xss-protection: 1; mode=block

GET
H2 200 yama-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 12 KB
12 KB 12ms
6ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/yama-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

2bc994d7f7baad1cfcf4ab458b8e70f442174b075308e9603adefd82b42f6629

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.175691
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 19 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 09 Jul 2024 11:09:16 GMT
age: 140541
etag: "94a5ee3202d5dee553fe30d984a52d5c"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 12359
x-xss-protection: 1; mode=block

GET
H2 200 dangerouspassword_dev-fig3-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 103 KB
104 KB 15ms
9ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/dangerouspassword_dev-fig3-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

620ab418519842f322d81bcd5bc64c155d997de8a2a3022b55ddee829820cff6

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.090510
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Mon, 29 Jul 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Tue, 18 Jun 2024 08:14:19 GMT
age: 140542
etag: "c4df15cea62e38ace8414d3427d20d12"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 105621
x-xss-protection: 1; mode=block

GET
H2 200 AutoYara4FLIRT-fig5-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 50 KB
51 KB 14ms
8ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/AutoYara4FLIRT-fig5-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

31cbdbebe460b0cfd10970b833b9f916dcad07aea0390c86c2b0f0fc941aa755

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.088214
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=3600
x-content-type-options: nosniff
x-amz-expiration: expiry-date="Fri, 16 Aug 2024 00:00:00 GMT", rule-id="RemoveOldData"
last-modified: Sat, 06 Jul 2024 11:07:53 GMT
age: 140542
etag: "ff599b7c597a9d0749027c6ee5adea29"
x-amz-server-side-encryption: AES256
expect-ct: enforce, max-age=3600
content-type: image/png
accept-ranges: bytes
content-length: 51384
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK N2r04NQy9WPJiTSHTadz.js Show response
pro.ranklet4.com/widgets/ 7 KB
2 KB 32ms
4ms Script
text/javascript 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.ranklet4.com/widgets/N2r04NQy9WPJiTSHTadz.js
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS: 210-231-184-197.pro.static.arena.ne.jp
Software: nginx/1.26.1 /
Resource Hash: 83c18c1898643a188a8b8d0dbdf739de95de53312b2c300f8759df19c7f1249d

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jul 2024 21:12:01 GMT
Server: nginx/1.26.1
x-amz-request-id: 0SBFE5CW821HMGW0
ETag: "f059a2023ec6e6fb9c6f1a7badc2b045"
x-amz-server-side-encryption: AES256
X-Cache: HIT
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1470
x-amz-id-2: fsAiPzMaDo8xBfVyw4VutkgKz0ifFtTrmvAH7tI9NoBPihTNNmdR5U8VrBKS5lxqzc7qnndtbBE=

GET
H2 200 matsu.png
movabletype.net/users/SHIKAPON/ 579 KB
580 KB 111ms
79ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/SHIKAPON/matsu.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

d0777e2e2c6a47608109aa789d1f8769aa6b972da30e0ffaf631a1fefbf31fd4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 4CqEq9yloEXP.7_Aa3yLht9hpURhskiF
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 26 Sep 2018 07:36:08 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "f042b8ca8c2df4e375d83530eea4d1b2"
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 593069
x-xss-protection: 1; mode=block

GET
H2 200 default-userpic-90.jpg
blogs.jpcert.or.jp/en/common/images/ 634 B
953 B 13ms
8ms Image
image/jpeg 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/default-userpic-90.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

bff0831e53ffe4da0fc58d076aafffae2e6f46b7210f7f2d08c2b88c53304fe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.022582
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: Hnbukdk4pnKX3_Jdrtqqb2JY3w31WOp_
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
age: 228816
etag: "5a94d27506940168f6de59eb32f920dc"
expect-ct: enforce, max-age=3600
content-type: image/jpeg
accept-ranges: bytes
content-length: 634
x-xss-protection: 1; mode=block

GET
H2 200 picture.png
movabletype.net/users/t.koshiishi/ 259 KB
260 KB 67ms
36ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/t.koshiishi/picture.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

fa4d9ac8279e6b85fa89a0d15119c2108d7965857964047e2cb44327d805bdb8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: ._TLfalDIkeXXrexJa8tb2Tbs8Zd2Ymo
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 05 Dec 2018 05:04:37 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "11fd73053320cb39c7da519552f76aba"
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 265361
x-xss-protection: 1; mode=block

GET
H2 200 Q6VN1jSR_400x400.jpg
movabletype.net/users/reto/ 61 KB
62 KB 111ms
80ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/reto/Q6VN1jSR_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

23fd61c6a9f5a2c1d58d42eebce6f72a1e0838eafcd8adb349ee85b1024db128

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 5CyHQUgE0cDtK5ZBTTH8nuPiZLj4rNoJ
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 25 Mar 2020 01:50:50 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "0280c12bed1fc39e5dd1ace0986264ab"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 62701
x-xss-protection: 1; mode=block

GET
H2 200 profile_icon.png
movabletype.net/users/ikuya/ 209 KB
210 KB 76ms
46ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/ikuya/profile_icon.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

10de10394a37304a0c94242badee67380313edf5d99f963126c0660f7115315f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 6aNgdxXWGy8r9Je1nvYiwKC3aPMq0TOL
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Thu, 04 Apr 2019 03:31:39 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "0ff73c7fe128b36457b0d8d582689949"
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 214306
x-xss-protection: 1; mode=block

GET
H2 200 ENCORE_400x400.jpg
movabletype.net/users/shu_tom/ 64 KB
65 KB 79ms
48ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/shu_tom/ENCORE_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

7fe1a58ea8b8fdfaca777d67aab3b8c3162591f5370294c693fbf6713b563bee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: ZSziZ7mhrWfa6SnVIF9Z5BQnQABGuZ_s
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 03 Oct 2018 05:27:14 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "e6e4162bb599969e44d37cb379a6db54"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 65659
x-xss-protection: 1; mode=block

GET
H2 200 photo_sparky_small.jpg
movabletype.net/users/kkomiyama/ 94 KB
95 KB 54ms
51ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/kkomiyama/photo_sparky_small.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

90bfb0ff383c74405328fce0fcfa8544f0a8549f9d3d18c3245dd8fb54f6a65e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: OEfSIkB0RGovJcaXq6G39aw4RboYWtHl
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 03 Oct 2018 05:08:05 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "b97364fc77ea6e5b13cb43a6a4be63bf"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 96469
x-xss-protection: 1; mode=block

GET
H2 200 blog_image.png
movabletype.net/users/masubuchi/ 590 KB
591 KB 54ms
51ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/masubuchi/blog_image.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

46e2a1c601fb504a72bfdca8785474711d40549df3a0f73cef2474e4f3c66476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: LJ6qoYQ_vcq3zigInkn5q7BD.yiOZuYR
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 16 Apr 2021 09:36:36 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "f40ace5c0be0a709e386e540a5721f51"
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 603691
x-xss-protection: 1; mode=block

GET
H2 200 %E7%94%BB%E5%83%8F%E3%81%AE%E8%B2%BC%E3%82%8A%E4%BB%98%E3%81%91%E5%85%88_-2021-3-18-22-18.png
movabletype.net/users/hori-32tk/ 498 KB
499 KB 54ms
50ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/hori-32tk/%E7%94%BB%E5%83%8F%E3%81%AE%E8%B2%BC%E3%82%8A%E4%BB%98%E3%81%91%E5%85%88_-2021-3-18-22-18.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

e502f0bbfcb50ab822ce1f941eed85eb4628a4e301132e1dcb047f5b96a55900

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: tsBKAQ7ddCyKP5DFD715zfoyWgcV9zJt
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Thu, 18 Mar 2021 13:18:53 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "3f84e9e59a0216813f9868cdb0750a58"
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 509789
x-xss-protection: 1; mode=block

GET
H2 200 14190908.jpg
movabletype.net/users/uchida/ 56 KB
56 KB 116ms
113ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/uchida/14190908.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

23e6d93452a4c0db3f01dfcdcef099dfe3e9861eb3b03ea07ae1878d63b7d412

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: xSjrABhuC5_UsXL2kH2LUKWQ_9rQM.jm
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 14 Nov 2018 02:44:17 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "27bdb7b931ee101c812d31c210c562ee"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 57308
x-xss-protection: 1; mode=block

GET
H2 200 Sajo0191031.jpg
movabletype.net/users/sajo/ 42 KB
42 KB 39ms
36ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/sajo/Sajo0191031.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

830ae81a7374748dc123821adcb7c0548ba35d4f16b74c234aa8a0dba1729960

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: nK1wfC4U_YAKdNPjnfFNOz6hYlZz6Hwo
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Mon, 02 Dec 2019 04:26:56 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "46a715f26415fd287dd8d636e655227a"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 42964
x-xss-protection: 1; mode=block

GET
H2 200 Tomotaka-Ito.jpg
movabletype.net/users/Tomotaka/ 33 KB
33 KB 34ms
31ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/Tomotaka/Tomotaka-Ito.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

a6653a5760c7cea6cdad209d739f01c8436527a428fa218459716fab12ce37cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 2fvcyuaHrwAXr_kpyHORm2o39hfGCEKt
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Thu, 03 Dec 2020 15:10:39 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "2cf4a537d5062bfa194893d424988d62"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 33853
x-xss-protection: 1; mode=block

GET
H2 200 default-userpic-90.jpg
movabletype.net/users/tnakano/ 832 B
1 KB 60ms
57ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/tnakano/default-userpic-90.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

db202f6b1909fb514275f7d608e1497fa95e8ba8f850c8909b1927cf11f85e52

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: rkhmeUk7DoOh.CA_DZpezULC6kVHyLQL
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 06 Dec 2023 06:58:16 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "3de507977021a6e538d85c4f23549ec2"
x-amz-server-side-encryption: AES256
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 832
x-xss-protection: 1; mode=block

GET
H2 200 DSCN1042-(2).png
movabletype.net/users/shoko/ 555 KB
556 KB 61ms
58ms Image
image/png 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/shoko/DSCN1042-(2).png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

36ba36d6118ad765aa17b49bcc2d3fc44379b1c8715cabc60bda192ad0a79261

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: gn1ENFMTC8XJoZacN7.XPNO_LiNxcra.
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Wed, 10 May 2023 04:30:01 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "c5f4e594f6c0a33267016d18f4aa0b36"
x-amz-server-side-encryption: AES256
x-frame-options: sameorigin
content-type: image/png
accept-ranges: bytes
content-length: 568417
x-xss-protection: 1; mode=block

GET
H2 200 j_icon72_400x400.jpg
movabletype.net/users/retiree_blog/ 29 KB
29 KB 59ms
57ms Image
image/jpeg 3.115.249.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/retiree_blog/j_icon72_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.115.249.128 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-115-249-128.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

92f1bc2e6be6094ffa0bd7ba2538fb71e6aadfd481c2b762c35a4b5559380a6d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: fP9rPqYkUqVXLZFK4aYyKZ4lsm.JbgHp
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Thu, 04 Oct 2018 05:28:49 GMT
server: openresty
content-security-policy: frame-ancestors 'self'
etag: "0678b8fce84b34cf896501f2e5bd184a"
x-frame-options: sameorigin
content-type: image/jpeg
accept-ranges: bytes
content-length: 29768
x-xss-protection: 1; mode=block

GET
H2 200 footer_logo.svg
blogs.jpcert.or.jp/en/common/images/ 3 KB
2 KB 12ms
8ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/footer_logo.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.046290
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: Cx1bNBQORdTZDbUNftTAcH.2LEt5sDW2
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
content-encoding: gzip
age: 228578
etag: W/"470f7c2a7f953ad63a2f660ce00a9ef3"
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1443
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 32ms
5ms Script
application/javascript 117.18.237.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 117.18.237.66 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (tkb/739F) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Encoding: gzip
Age: 1060
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (tkb/739F)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H2 200 prototype.js Show response
blogs.jpcert.or.jp/en/common/js/ 168 KB
48 KB 10ms
9ms Script
application/javascript 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/js/prototype.js

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

d0496587eb0e1b42d3614c76d3e0a76290f7a5139940cc2cd8c195cbcab39b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.024057
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: N0KlEhkLkgpbiO2iNalwwcYGYXmQIPcc
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
content-encoding: gzip
age: 232378
etag: W/"c052d39fe57096c11105495ae5eaa363"
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
accept-ranges: bytes
content-length: 48438
x-xss-protection: 1; mode=block

GET
H2 200 script.js Show response
blogs.jpcert.or.jp/en/common/feedback/ 6 KB
3 KB 11ms
3ms Script
application/javascript 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/feedback/script.js

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

64871e8b15628e5023849cfadc90ec6482233a8260fb39d32458e94ebfbc5de5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.050141
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: WKblPiUK5m0VfpbMlZmR5cNpURSAe3r4
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
content-encoding: gzip
age: 220952
etag: W/"95fc36ba90d76fcaacd9b49a254fd6a5"
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
accept-ranges: bytes
content-length: 2527
x-xss-protection: 1; mode=block

GET
H2 200 cse.js Show response
cse.google.com/ 6 KB
3 KB 182ms
73ms Script
text/javascript 2404:6800:400a:80a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80a::200e Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

a98de636daf1181e48c18247a0697a10690cb0b41a5c262a28edae1f1a613350

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-Alb-WqQL5RKOfUmj7iSsAA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-Alb-WqQL5RKOfUmj7iSsAA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
content-encoding: br
date: Thu, 11 Jul 2024 02:11:37 GMT
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
server: gws
x-frame-options: SAMEORIGIN
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type: text/javascript; charset=UTF-8
permissions-policy: unload=()
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2477
x-xss-protection: 0

GET
H2 200 bg_header.jpg
blogs.jpcert.or.jp/en/common/images/ 79 KB
80 KB 14ms
9ms Image
image/jpeg 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/bg_header.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/css/styles.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

261c7d35b8070f9e07d90aec18fe37b29b78e49cbbdb13c279efda50dc92cbfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/common/css/styles.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.052961
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: 1LYFnOgGMu3b7ap_0FNaHRLj.1SCoQ94
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
age: 228578
etag: "36b8b54cd6c4d3cedb6f1fab7973bd13"
expect-ct: enforce, max-age=3600
content-type: image/jpeg
accept-ranges: bytes
content-length: 81378
x-xss-protection: 1; mode=block

GET
H2 200 icon-mail.svg
blogs.jpcert.or.jp/en/common/images/ 334 B
619 B 10ms
4ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/icon-mail.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/css/styles.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

eba8d7f3703d70c73f3403a2754b3b41c92e4aeaaabdbdd417585bfefd49eec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/common/css/styles.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.023395
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: iRtpKkMVBni00J5p7Fi1DUAc6G11sxXt
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
content-encoding: gzip
age: 220952
etag: W/"cdfcff7746225765d03d1b1fe8135ca9"
expect-ct: enforce, max-age=3600
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 263
x-xss-protection: 1; mode=block

GET
H2 200 fb_loader.gif
blogs.jpcert.or.jp/common/feedback/images/ 4 KB
4 KB 8ms
3ms Image
image/gif 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/common/feedback/images/fb_loader.gif

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

684476872d3b64b3fbb972c14b1d21d4bde8b6c8074a644f93e234764f542ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.047138
date: Thu, 11 Jul 2024 02:11:37 GMT
x-amz-version-id: rraXNl8QFXJ4DUlZOhqk4kUmZQBo6KKB
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:44 GMT
age: 247069
etag: "2acb729ed298b6a3f2455e651bb5d876"
expect-ct: enforce, max-age=3600
content-type: image/gif
accept-ranges: bytes
content-length: 3917
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSW5mb0tleS04MDB3aS5wbmc.jpg
pro.ranklet4.com/imgproxy/SNoqIVNVHyPzr8sqrUSqzReBeh4kidqIRjhzJonsTXA/rs:fit:160:160/q:75/sm:1/ 2 KB
2 KB 7ms
3ms Image
image/jpeg 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/SNoqIVNVHyPzr8sqrUSqzReBeh4kidqIRjhzJonsTXA/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSW5mb0tleS04MDB3aS5wbmc.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-197.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

6a2fbbe670d3e049df7de0e20f3698882ed9783e47a010e1b0c2c746b919091c

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Security-Policy: script-src 'none'
Server: nginx/1.26.1
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Content-Disposition: inline; filename="InfoKey-800wi.jpg"
Connection: keep-alive
Content-Length: 1826
X-Request-Id: BOwSWQRLZQYUBXbGnaYbf
Expires: Thu, 10 Jul 2025 01:04:52 GMT

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvJUUzJTgzJUFEJUUzJTgyJUI0LTgwMHdpLmpwZw.jpg
pro.ranklet4.com/imgproxy/oD9UIVAi7QaQhfIKlzI6LSf9Yh8bUkcrzAPefgyJqLA/rs:fit:160:160/q:75/sm:1/ 1 KB
2 KB 11ms
4ms Image
image/jpeg 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/oD9UIVAi7QaQhfIKlzI6LSf9Yh8bUkcrzAPefgyJqLA/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvJUUzJTgzJUFEJUUzJTgyJUI0LTgwMHdpLmpwZw.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-197.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

3eb59031e11a678d81f252f9bbde2c7485376af26fb50b2d5099497e8de378a3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Security-Policy: script-src 'none'
Server: nginx/1.26.1
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Content-Disposition: inline; filename="ãã´-800wi.jpg"
Connection: keep-alive
Content-Length: 1508
X-Request-Id: GimrItWyQDSgLZqqRYkLc
Expires: Thu, 10 Jul 2025 01:04:52 GMT

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvMDMtODAwd2kuanBn.jpg
pro.ranklet4.com/imgproxy/6oKY2Hgudik94XC29C95P0i1NTZgDRecCbq1iFp4N9g/rs:fit:160:160/q:75/sm:1/ 2 KB
2 KB 10ms
4ms Image
image/jpeg 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/6oKY2Hgudik94XC29C95P0i1NTZgDRecCbq1iFp4N9g/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvMDMtODAwd2kuanBn.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-197.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

62173c7f7a3f43f2beb1f3a35a68dbfc8738b3b0d00bdc6290427eaa1d33df16

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Security-Policy: script-src 'none'
Server: nginx/1.26.1
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Content-Disposition: inline; filename="03-800wi.jpg"
Connection: keep-alive
Content-Length: 2118
X-Request-Id: oykgOWQ9aKXPuC5epdunF
Expires: Thu, 10 Jul 2025 01:04:52 GMT

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvcHlwaS04MDB3aS5wbmc.jpg
pro.ranklet4.com/imgproxy/CsaXon7TTQo4DrrSOAJyvdq-pKuw1Na5nbOSUA9JZ5Q/rs:fit:160:160/q:75/sm:1/ 3 KB
3 KB 5ms
3ms Image
image/jpeg 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/CsaXon7TTQo4DrrSOAJyvdq-pKuw1Na5nbOSUA9JZ5Q/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvcHlwaS04MDB3aS5wbmc.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-197.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

0c796b92298cae3003c4825c90a022b52d93bb26682b1ae75887ee8af5bb4def

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Security-Policy: script-src 'none'
Server: nginx/1.26.1
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Content-Disposition: inline; filename="pypi-800wi.jpg"
Connection: keep-alive
Content-Length: 2936
X-Request-Id: KkwZP2sAEdDEnT-roBlF0
Expires: Thu, 10 Jul 2025 03:17:12 GMT

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSUNTUjIwMjRfdGl0bGUtODAwd2kuanBn.jpg
pro.ranklet4.com/imgproxy/ub7m_qgq3xmLpE9k_ZLkSCvsF5qUCwi9lKyZy0-NB7s/rs:fit:160:160/q:75/sm:1/ 4 KB
4 KB 10ms
8ms Image
image/jpeg 210.231.184.197
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/ub7m_qgq3xmLpE9k_ZLkSCvsF5qUCwi9lKyZy0-NB7s/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSUNTUjIwMjRfdGl0bGUtODAwd2kuanBn.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.197 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-197.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

30fd5ac5ff296d31a1646f775764fc2a11b9a05311700d43950bb0cd186d9736

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Security-Policy: script-src 'none'
Server: nginx/1.26.1
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Content-Disposition: inline; filename="ICSR2024_title-800wi.jpg"
Connection: keep-alive
Content-Length: 4101
X-Request-Id: imFbAO2kC3OpSwZ1bmIxe
Expires: Thu, 10 Jul 2025 01:04:52 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 6AB5 0
0 17ms
5ms Document
text/html 117.18.237.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fblogs.jpcert.or.jp
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 117.18.237.66 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (tkb/72B3) /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 9274171
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Jul 2024 02:11:37 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (tkb/72B3)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H/1.1 200
OK get_feedback_jsonp.cgi Show response
ws.jpcert.or.jp/cgi-bin/ 155 B
386 B 43ms
13ms Script
application/javascript 52.196.227.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.jpcert.or.jp/cgi-bin/get_feedback_jsonp.cgi?uri=/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html&_d=1720663897440
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/feedback/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.196.227.230 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-196-227-230.ap-northeast-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 498a16b6c4e50cf3271cfd7253ac17a421d230fe5dca896c7f10e2983b602ae6

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Upgrade: h2,h2c
Date: Thu, 11 Jul 2024 02:11:37 GMT
Server: Apache
Connection: Upgrade, Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H3 200 cse_element__ja.js Show response
www.google.com/cse/static/element/8fa85d58e016b414/ 287 KB
94 KB 108ms
51ms Script
text/javascript 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8fa85d58e016b414/cse_element__ja.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix06s19-in-f4.1e100.net

Software

sffe /

Resource Hash

9d3c12b97ece45f6079634b9086909b43c0f0aed4320f0630cf4b32baebb0d18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 96200
x-xss-protection: 0
last-modified: Wed, 12 Jun 2024 21:33:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/javascript
cache-control: private, max-age=31536000
accept-ranges: bytes
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H3 200 default+ja.css
www.google.com/cse/static/element/8fa85d58e016b414/ 41 KB
9 KB 110ms
54ms Stylesheet
text/css 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix06s19-in-f4.1e100.net

Software

sffe /

Resource Hash

a5402de70228d4bf5379b518225b702918f6ae277e9293f9d16334c2b1fa31e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9068
x-xss-protection: 0
last-modified: Wed, 12 Jun 2024 21:33:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/css
cache-control: private, max-age=31536000
accept-ranges: bytes
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H3 200 default.css
www.google.com/cse/static/style/look/v4/ 4 KB
1 KB 68ms
13ms Stylesheet
text/css 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v4/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix06s19-in-f4.1e100.net

Software

sffe /

Resource Hash

dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:03:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 462
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1345
x-xss-protection: 0
last-modified: Wed, 17 Jun 2020 00:00:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 11 Jul 2024 02:53:55 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 290 KB
98 KB 67ms
66ms Script
application/javascript 2404:6800:400a:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80e::2008 Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4909eb8df32ae8243f72108519e590d77f01fd19e24d05a7246585b2d03c313a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 100387
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 75ms
3ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 11 Jul 2024 00:42:45 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 5332
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 11 Jul 2024 02:42:45 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 59ms
57ms Fetch
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-6NX4WBMERX&gtm=45je4790v889024560za200&_p=1720663897226&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=237641905.1720663898&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1720663897&sct=1&seg=0&dl=https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fattack-activities-by-kimsuky-targeting-japanese-organizations.html&dt=Attack%20Activities%20by%20Kimsuky%20Targeting%20Japanese%20Organizations%20-%20JPCERT%2FCC%20Eyes%20%7C%20JPCERT%20Coordination%20Center%20official%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=504&_z=fetch
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Jul 2024 02:11:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.jpcert.or.jp
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
92 B 43ms
38ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=588309098&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fattack-activities-by-kimsuky-targeting-japanese-organizations.html&ul=ja-jp&de=UTF-8&dt=Attack%20Activities%20by%20Kimsuky%20Targeting%20Japanese%20Organizations%20-%20JPCERT%2FCC%20Eyes%20%7C%20JPCERT%20Coordination%20Center%20official%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=51702897&gjid=1422368745&cid=237641905.1720663898&tid=UA-124034031-1&_gid=274016421.1720663898&_r=1&gtm=457e4790za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&jsscut=1&z=905693217

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 11 Jul 2024 02:11:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.jpcert.or.jp
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async-ads.js Show response
cse.google.com/adsense/search/ 192 KB
75 KB 78ms
75ms Script
text/javascript 2404:6800:400a:80a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/adsense/search/async-ads.js

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/8fa85d58e016b414/cse_element__ja.js?usqp=CAI%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80a::200e Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51de6c9cdd6479fc581c336ff793f2cea46bc3ff2fd61e821a03789e6415369f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "10096935959572006545"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
expires: Thu, 11 Jul 2024 02:11:37 GMT

GET
H3 200 clear.png
www.google.com/cse/static/css/v2/ 1018 B
1 KB 16ms
14ms Image
image/png 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/css/v2/clear.png

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix06s19-in-f4.1e100.net

Software

sffe /

Resource Hash

329d1a750114920332eadc55c129957d9dbe5a1b25745e2f7e0ed4fad75e04cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 04 Jul 2024 19:33:16 GMT
x-content-type-options: nosniff
age: 542301
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1018
x-xss-protection: 0
last-modified: Mon, 25 May 2020 08:30:00 GMT
server: sffe
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Fri, 04 Jul 2025 19:33:16 GMT

GET
H3 200 branding.png
www.google.com/cse/static/images/1x/ja/ 1 KB
1 KB 13ms
12ms Image
image/png 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/images/1x/ja/branding.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kix06s19-in-f4.1e100.net

Software

sffe /

Resource Hash

b0983545a358cc3907ff7ff53f7c075eff35e8ca3d1c5c54704470abc4624a29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 04 Jul 2024 11:26:40 GMT
x-content-type-options: nosniff
age: 571497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1249
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 21:00:00 GMT
server: sffe
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Fri, 04 Jul 2025 11:26:40 GMT

GET
H2 204 generate_204
clients1.google.com/ 0
117 B 79ms
8ms Image
text/plain 2404:6800:400a:804::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clients1.google.com/generate_204
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:400a:804::200e Osaka, Japan, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 02:11:37 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
348 B 182ms
53ms XHR
text/plain 2404:6800:4008:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-124034031-1&cid=237641905.1720663898&jid=51702897&gjid=1422368745&_gid=274016421.1720663898&_u=YADAAUAAAAAAACAAI~&z=1483554079

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4008:c02::9a Taipei, Taiwan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 11 Jul 2024 02:11:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.jpcert.or.jp
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK button.856debeac157d9669cf51e73a08fbc93.js Show response
platform.twitter.com/js/ 8 KB
3 KB 7ms
6ms Script
application/javascript 117.18.237.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.856debeac157d9669cf51e73a08fbc93.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 117.18.237.66 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (tkb/739F) /
Resource Hash: 426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 02:11:37 GMT
Content-Encoding: gzip
Age: 9274175
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 2620
Last-Modified: Mon, 11 Dec 2023 17:19:47 GMT
Server: ECS (tkb/739F)
Etag: "fdf02dd038ed38dbf3c240d56262af0c+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame CE0A 0
0 5ms
5ms Document
text/html 117.18.237.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 117.18.237.66 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (tkb/7352) /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 9360586
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 12332
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Jul 2024 02:11:37 GMT
Etag: "e29e65db7bf0a096587728e1faacfd9c+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:48 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (tkb/7352)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H/1.1 200
OK tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame ABB8 0
0 2ms
2ms Document
text/html 117.18.237.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 117.18.237.66 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (tkb/7352) /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 9360586
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 12332
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Jul 2024 02:11:37 GMT
Etag: "e29e65db7bf0a096587728e1faacfd9c+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:48 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (tkb/7352)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
292 B 168ms
128ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fattack-activities-by-kimsuky-targeting-japanese-organizations.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1720663897841%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=d99359fbdf0dd49d982b5915bc44fa91619ec974

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_q /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://blogs.jpcert.or.jp/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-response-time: 114
date: Thu, 11 Jul 2024 02:11:37 GMT
strict-transport-security: max-age=631138519
last-modified: Thu, 11 Jul 2024 02:11:37 GMT
server: tsa_q
vary: Origin
content-type: image/gif
x-transaction-id: 660c5abaa2b0f855
cache-control: must-revalidate, max-age=600
perf: 7402827104
x-connection-hash: 05a0bb630983fe7ec78a63ded13176074c103c590ffa1b32a7518198b9e77ac9
content-length: 43

GET
H2 200 favicon.ico
blogs.jpcert.or.jp/en/common/images/ 5 KB
6 KB 4ms
3ms Other
image/vnd.microsoft.icon 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/images/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

c7f6f4acee58585774f7bb43bd5a95200029af8d32847f29fcf1126832d82753

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-runtime: 0.023629
date: Thu, 11 Jul 2024 02:11:38 GMT
x-amz-version-id: Qo1K29yIHuYGTcjE3QmsvNjsoa6Mp9Yy
x-content-type-options: nosniff
strict-transport-security: max-age=3600
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
age: 211498
etag: "fe6624b7972582fe71cd6779a97147c5"
expect-ct: enforce, max-age=3600
content-type: image/vnd.microsoft.icon
accept-ranges: bytes
content-length: 5558
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.jpcert.or.jp/	1970-01-21 07:33:43	Name: _ga_6NX4WBMERX Value: GS1.1.1720663897.1.0.1720663897.0.0.0
.jpcert.or.jp/	1970-01-21 07:33:43	Name: _ga Value: GA1.3.237641905.1720663898
.jpcert.or.jp/	1970-01-20 21:59:10	Name: _gid Value: GA1.3.274016421.1720663898
.jpcert.or.jp/	1970-01-20 21:57:43	Name: _gat_gtag_UA_124034031_1 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogs.jpcert.or.jp
cdnjs.cloudflare.com
clients1.google.com
cse.google.com
movabletype.net
platform.twitter.com
pro.ranklet4.com
stats.g.doubleclick.net
syndication.twitter.com
ws.jpcert.or.jp
www.google-analytics.com
www.google.com
www.googletagmanager.com
104.244.42.136
117.18.237.66
172.217.25.164
2001:4860:4802:38::178
210.231.184.197
2404:6800:4008:c02::9a
2404:6800:400a:804::200e
2404:6800:400a:80a::200e
2404:6800:400a:80e::2008
2606:4700::6811:190e
3.115.249.128
52.196.227.230
52.198.153.39
0c796b92298cae3003c4825c90a022b52d93bb26682b1ae75887ee8af5bb4def
10de10394a37304a0c94242badee67380313edf5d99f963126c0660f7115315f
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
23e6d93452a4c0db3f01dfcdcef099dfe3e9861eb3b03ea07ae1878d63b7d412
23fd61c6a9f5a2c1d58d42eebce6f72a1e0838eafcd8adb349ee85b1024db128
261c7d35b8070f9e07d90aec18fe37b29b78e49cbbdb13c279efda50dc92cbfe
2bc994d7f7baad1cfcf4ab458b8e70f442174b075308e9603adefd82b42f6629
2ec9087635398a0a4f08808b2d5bd3af37542c290314c060303ee3a41e7af6bd
30fd5ac5ff296d31a1646f775764fc2a11b9a05311700d43950bb0cd186d9736
31cbdbebe460b0cfd10970b833b9f916dcad07aea0390c86c2b0f0fc941aa755
329d1a750114920332eadc55c129957d9dbe5a1b25745e2f7e0ed4fad75e04cd
36ba36d6118ad765aa17b49bcc2d3fc44379b1c8715cabc60bda192ad0a79261
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3eb59031e11a678d81f252f9bbde2c7485376af26fb50b2d5099497e8de378a3
426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007
46e2a1c601fb504a72bfdca8785474711d40549df3a0f73cef2474e4f3c66476
47c6df2277c9b5d205828e4cd75bf095cf4e8c891de60d7424c6c5a5bbbe67b5
47f7eeef23249fe011c951550da901abeb20d8f18f395f5a707e4d19d8cb5a83
4909eb8df32ae8243f72108519e590d77f01fd19e24d05a7246585b2d03c313a
498a16b6c4e50cf3271cfd7253ac17a421d230fe5dca896c7f10e2983b602ae6
51de6c9cdd6479fc581c336ff793f2cea46bc3ff2fd61e821a03789e6415369f
620ab418519842f322d81bcd5bc64c155d997de8a2a3022b55ddee829820cff6
62173c7f7a3f43f2beb1f3a35a68dbfc8738b3b0d00bdc6290427eaa1d33df16
64871e8b15628e5023849cfadc90ec6482233a8260fb39d32458e94ebfbc5de5
684476872d3b64b3fbb972c14b1d21d4bde8b6c8074a644f93e234764f542ffd
6a2fbbe670d3e049df7de0e20f3698882ed9783e47a010e1b0c2c746b919091c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f7505af235b3dec440dedfbc35698ffd35372032e9c0122afc003636ea894b4
7fe1a58ea8b8fdfaca777d67aab3b8c3162591f5370294c693fbf6713b563bee
830ae81a7374748dc123821adcb7c0548ba35d4f16b74c234aa8a0dba1729960
83c18c1898643a188a8b8d0dbdf739de95de53312b2c300f8759df19c7f1249d
90bfb0ff383c74405328fce0fcfa8544f0a8549f9d3d18c3245dd8fb54f6a65e
90c303a365018ed76dffa5bbb9562f3f90d55f7381714cb86bc8933dfb02f20c
92f1bc2e6be6094ffa0bd7ba2538fb71e6aadfd481c2b762c35a4b5559380a6d
9c55a48ea14ce2f39c148c8b10018e4e844de9182393762e31434f1ceed3e525
9d3c12b97ece45f6079634b9086909b43c0f0aed4320f0630cf4b32baebb0d18
a5402de70228d4bf5379b518225b702918f6ae277e9293f9d16334c2b1fa31e3
a6653a5760c7cea6cdad209d739f01c8436527a428fa218459716fab12ce37cf
a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5
a98de636daf1181e48c18247a0697a10690cb0b41a5c262a28edae1f1a613350
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0983545a358cc3907ff7ff53f7c075eff35e8ca3d1c5c54704470abc4624a29
b19fdba3215ee25adf8ad72ba5b322d1cda012f55c66afbecbae42fbb643fe30
bff0831e53ffe4da0fc58d076aafffae2e6f46b7210f7f2d08c2b88c53304fe8
c7f6f4acee58585774f7bb43bd5a95200029af8d32847f29fcf1126832d82753
cd7495cc0174b33a7294c4a6206ad39c5af9edab9aadb54ae5b84be441d407b2
cf99cf55b2afc39f2d5c89093e53203df0e5446052cbe9d6353128fc649a27de
d025d624352f8a6ceec63d1be3f7513b4874d370d224a3011620d20c03276e2e
d0496587eb0e1b42d3614c76d3e0a76290f7a5139940cc2cd8c195cbcab39b37
d0777e2e2c6a47608109aa789d1f8769aa6b972da30e0ffaf631a1fefbf31fd4
db202f6b1909fb514275f7d608e1497fa95e8ba8f850c8909b1927cf11f85e52
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de582e8fbdee40e0bdb5b55b703891779f53c244b5e83a77e5c038ae51c010e9
dea4794dcfd4d100622bcf0779f940c227609bffe3529f1b843dd9f58418148c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e502f0bbfcb50ab822ce1f941eed85eb4628a4e301132e1dcb047f5b96a55900
eba8d7f3703d70c73f3403a2754b3b41c92e4aeaaabdbdd417585bfefd49eec3
fa4d9ac8279e6b85fa89a0d15119c2108d7965857964047e2cb44327d805bdb8
feb37150b5f9e9ca94b9238d125134dc36f2515de2dda77c439450e9d016e761

blogs.jpcert.or.jp Open in urlscan Pro 52.198.153.39 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

66 Requests

100 %HTTPS

46 %IPv6

9 Domains

13 Subdomains

13 IPs

4 Countries

4468 kBTransfer

5638 kBSize

4 Cookies

3 Outgoing links

Redirected requests

66 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blogs.jpcert.or.jp Open in urlscan Pro
52.198.153.39 Public Scan

Screenshot
Live screenshot

Full Image

66
Requests

100 %
HTTPS

46 %
IPv6

9
Domains

13
Subdomains

13
IPs

4
Countries

4468 kB
Transfer

5638 kB
Size

4
Cookies

66 HTTP transactions
0 data transactions