thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo4MTM2NTczNjQ2Nzk4OTY3MixcInJcIjo4MTM2NTk1NTUzOTYzMzgwOX...
Effective URL:
https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=...
Submission: On March 01 via manual (March 1st 2023, 7:52:47 am UTC) from GB — Scanned from GB

Summary HTTP 44 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 16 domains to perform 44 HTTP transactions. The main IP is 2606:4700:20::681a:61, located in United States and belongs to CLOUDFLARENET, US. The main domain is thehackernews.com. The Cisco Umbrella rank of the primary domain is 135847.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 1st 2022. Valid for: a year.

This is the only time thehackernews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700::68... 2606:4700::6811:6cef	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700:20:... 2606:4700:20::681a:61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:26f0:350... 2a02:26f0:3500:12::1730:1786	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
3	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
3	65.9.97.56 65.9.97.56	16509 (AMAZON-02) (AMAZON-02)
6	23.97.225.52 23.97.225.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	2a00:1450:400... 2a00:1450:400d:806::200e	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:212... 2600:9000:2127:3200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	65.9.95.19 65.9.95.19	16509 (AMAZON-02) (AMAZON-02)
2	3.225.32.203 3.225.32.203	14618 (AMAZON-AES) (AMAZON-AES)
1	54.229.20.73 54.229.20.73	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400d:80c::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:400d:80a::2002	15169 (GOOGLE) (GOOGLE)
1	65.9.99.209 65.9.99.209	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:400d:808::2002	15169 (GOOGLE) (GOOGLE)
44	20

1 2606:4700::6811:6cef (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ejyazl.clicks.mlsend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::681a:61 (United States)

ASN13335 (CLOUDFLARENET, US)

thehackernews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:3500:12::1730:1786 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.97.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-97-56.prg50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.97.225.52 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

e3.adpushup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:400d:806::200e (Ireland)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:ef75:8280:f209:5ba1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:3200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-19.prg50.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.32.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-32-203.compute-1.amazonaws.com

prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.20.73 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-20-73.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80c::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80a::2002 (Ireland)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.99.209 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-99-209.prg50.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:808::2002 (Ireland)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	adpushup.com cdn.adpushup.com — Cisco Umbrella Rank: 15967 e3.adpushup.com — Cisco Umbrella Rank: 17050	210 KB
7	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1939	103 KB
6	thehackernews.com thehackernews.com — Cisco Umbrella Rank: 135847	196 KB
4	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 282 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 476	51 KB
4	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 184 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	162 KB
2	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102	169 KB
2	gstatic.com fonts.gstatic.com	170 KB
2	amazon.dev prod.us-east-1.cxm-bcn.publisher-services.amazon.dev — Cisco Umbrella Rank: 673	459 B
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1183 bcp.crwdcntrl.net — Cisco Umbrella Rank: 858	10 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 339	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 195	28 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	4 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 924	634 B
1	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 980	9 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 693	30 KB
1	mlsend.com 1 redirects ejyazl.clicks.mlsend.com	620 B
44	16

	Domain	Requested by
7	fundingchoicesmessages.google.com	cdn.adpushup.com
6	e3.adpushup.com	thehackernews.com
6	thehackernews.com	thehackernews.com
3	c.amazon-adsystem.com	cdn.adpushup.com c.amazon-adsystem.com
3	securepubads.g.doubleclick.net	cdn.adpushup.com securepubads.g.doubleclick.net
3	cdn.adpushup.com	thehackernews.com cdn.adpushup.com
2	pagead2.googlesyndication.com	thehackernews.com pagead2.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
2	prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	c.amazon-adsystem.com
1	googleads.g.doubleclick.net	pagead2.googlesyndication.com
1	cdn.jsdelivr.net	cdn.adpushup.com
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	cdnjs.cloudflare.com	thehackernews.com
1	fonts.googleapis.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	tags.crwdcntrl.net	thehackernews.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	cdn.adpushup.com
1	code.jquery.com	cdn.adpushup.com
1	ejyazl.clicks.mlsend.com	1 redirects
44	20

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
www.facebook.com
deals.thehackernews.com
thehackernews.tradepub.com
www.youtube.com
www.instagram.com
feeds.feedburner.com
t.me
thn.news
www.trendmicro.com
www.bitdefender.com
developer.chrome.com
insight-jp.nttsecurity.com
www.reddit.com
news.ycombinator.com
api.whatsapp.com
telegram.me

Subject Issuer	Validity	Valid
thehackernews.com Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
cdn.adpushup.com R3	`2023-01-25` - `2023-04-25`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
*.adpushup.com Sectigo ECC Domain Validation Secure Server CA	`2022-08-02` - `2023-09-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
quantserve.com R3	`2023-02-13` - `2023-05-14`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev Amazon RSA 2048 M02	`2022-12-27` - `2024-01-25`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Frame ID: 2CD806F95EB642CFBF4C53C81ED9A90A
Requests: 51 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230227/r20190131/zrt_lookup.html
Frame ID: 67C3924AF3BD48735BFB090A2C571AE8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cyber Espionage Group Earth Kitsune Deploys WhiskerSpy Backdoor in Latest Attacks

Page URL History Show full URLs

https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo4MTM2NTczNjQ2Nzk4OTY3MixcInJcIjo4MT... HTTP 302
https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_me... Page URL

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

44
Requests

100 %
HTTPS

70 %
IPv6

16
Domains

20
Subdomains

20
IPs

4
Countries

1153 kB
Transfer

3415 kB
Size

5
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/thehackersnews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://www.facebook.com/thehackernews
Title: 

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/search?query=cybersecurity%2Bhacking%2BVPN%2Bsoftware
Title:  Store

Search URL Search Domain Scan URL

URL: https://thehackernews.tradepub.com/
Title: Free eBooks

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/free
Title: Freebies

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/thehackernews?sub_confirmation=1
Title: 

Search URL Search Domain Scan URL

URL: https://www.instagram.com/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://feeds.feedburner.com/TheHackersNews
Title:  RSS Feeds

Search URL Search Domain Scan URL

URL: https://t.me/joinchat/AAAAADwuDObFWF60CiR-HQ
Title:  Telegram Channel

Search URL Search Domain Scan URL

URL: https://thn.news/cs-header-1

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html
Title: said

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/blog/labs/side-loading-onedrive-for-profit-cryptojacking-campaign-detected-in-the-wild/
Title: abusing

Search URL Search Domain Scan URL

URL: https://developer.chrome.com/docs/apps/nativeMessaging/
Title: native messaging APIs

Search URL Search Domain Scan URL

URL: https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
Title: Operation RestyLink

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/research/23/b/invitation-to-secret-event-uncovering-earth-yako-campaigns.html
Title: said

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html&text=Cyber%20Espionage%20Group%20Earth%20Kitsune%20Deploys%20WhiskerSpy%20Backdoor%20in%20Latest%20Attacks&via=TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html
Title: 

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html&t=Cyber%20Espionage%20Group%20Earth%20Kitsune%20Deploys%20WhiskerSpy%20Backdoor%20in%20Latest%20Attacks
Title: Share on Hacker News

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Cyber%20Espionage%20Group%20Earth%20Kitsune%20Deploys%20WhiskerSpy%20Backdoor%20in%20Latest%20Attacks%20%E2%80%94%20https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html
Title: Share on WhatsApp

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html&text=Cyber%20Espionage%20Group%20Earth%20Kitsune%20Deploys%20WhiskerSpy%20Backdoor%20in%20Latest%20Attacks
Title: Share on Telegram

Search URL Search Domain Scan URL

URL: https://thn.news/web-n-2
Title: Discover the Truth About File-Based Threats: Join Our MythBusting Webinar

Search URL Search Domain Scan URL

URL: https://thn.news/safedns-s-1
Title: Protect Against Online Threats with AI-Powered Cloud-Based DNS Security

Search URL Search Domain Scan URL

URL: https://thn.news/fortify-s-1
Title: Protect Your Business from Cyber Threats with FortifyData's Risk Management Platform

Search URL Search Domain Scan URL

URL: https://thn.news/exeon-s-1
Title: Transform Your Cybersecurity Strategy with Exeon's AI-Driven Analytics

Search URL Search Domain Scan URL

URL: https://thn.news/owasp-api-top
Title: Mitigating OWASP Top 10 API Security ThreatsLearn how to mitigate risks and protect your organization from the top 10 OWASP API threats.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-complete-2023-cyber-security-developer-it-skills-bundle
Title: Get Training Top 2023 Cybersecurity Certifications for Only $99Become a Cybersecurity Pro with most demanded 2023 top certifications training courses.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-a-to-z-cyber-security-it-certification-training-bundle
Title: A to Z Cybersecurity Certification CoursesMaster cybersecurity from A to Z with expert-led cybersecurity and IT certification training.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/hacking
Title: Hacking

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-specialization-developer
Title: Development

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-interest-android
Title: Android

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo4MTM2NTczNjQ2Nzk4OTY3MixcInJcIjo4MTM2NTk1NTUzOTYzMzgwOX0iLCJzIjoiMjgyMjc4NGQ0ZjFhYzAzMCJ9 HTTP 302
https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

44 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request north-korean-cyber-espionage-group.html Show response
thehackernews.com/2023/02/
Redirect Chain

https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo4MTM2NTczNjQ2Nzk4OTY3MixcInJcIjo4MTM2NTk1NTUzOTYzMzgwOX0iLCJzIjoiMjgyMjc4NGQ0ZjFhYzAzMCJ9
https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortine...

223 KB
125 KB

652ms
547ms

Document
text/html

2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / WordPress VIP

Resource Hash

3f180292b41fe4c7f72ba93858e158edfd5024417ff096355c605713453a1df1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, s-maxage=604800, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7a0fd265eb367756-LHR
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 01 Mar 2023 07:52:41 GMT
expires: Wed, 01 Mar 2023 07:52:40 GMT
last-modified: Wed, 01 Mar 2023 06:12:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FWxIBNvESFa%2B96C3raIXwR%2Bw%2F4kQnenk1x4utKcqirj4PVTDNtzGlfXoYx3GwrjHWNYYZjE9NJAHJysBNbAbTS4JCfLuSKWpYL8dlpTnBxE%2Bk0hrin5wNbY59QUghmTO37tFDteLgrwmLSn6zJs"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-forwarded-for: 2a01:4a0:2c::9
x-frame-options: DENY
x-powered-by: WordPress VIP
x-xss-protection: 1; mode=block

Redirect headers

cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 7a0fd263eaf24134-LHR
content-type: text/html; charset=UTF-8
date: Wed, 01 Mar 2023 07:52:40 GMT
location: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HIyv2%2BannJh78zWy%2F4moAMkafNVxhFCajDH9mODoHA08d8d5ak%2FLOLTyyHeXR6%2F0miIwpKAU2GeYRPQjvDr8MzygrzI8P3oBLgD4iANcNcuO%2BsG0wRDIZEDoeLdZpjzOoP1VWwNf7Sz1mz6Qnk2wqg5MtDGjOg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/37020/ 507 KB
113 KB 234ms
58ms Script
application/javascript 2a02:26f0:3500:12::1730:1786
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/37020/adpushup.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:12::1730:1786 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 2914216cad9ac6c3dd47daeda151e11225f74738085e65f74e4a376ba0a3b6f5

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-akamai-country: GB
date: Wed, 01 Mar 2023 07:52:41 GMT
content-encoding: br
last-modified: Tue, 28 Feb 2023 19:48:37 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=4, ak_p; desc="466015_389027462_423761394_376_1328_52_0";dur=1
x-cf-geodata: DE
content-length: 115228
expires: Wed, 01 Mar 2023 08:52:41 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a

Request headers

Referer
Origin: https://thehackernews.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2de33ca2d2cfb7f437aa190ecdd4b3991ff2879604c0e24aaf02849ae1f360b3

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 288 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbf4fa73ce4f2bd113dde31b7f7eff7bfd3a1271f30ababad320f07033408f06

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 296 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c6c51dafc8bdf4ef6841da2faf4d5d7555393739fd7577d931b0268fe3060a9

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 rocket-loader.min.js Show response
thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 47ms
46ms Script
application/javascript 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Mon, 27 Feb 2023 12:06:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: gzip
etag: W/"63fc9cbe-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2qscu88B65sUsSpINVgheWnpYzc9o297UlFiFHQKxI87Os8kWod9hhMD4F%2F5kzJUjO%2BHGJgxe%2BlkleiM%2BqHrxKdCnxLX%2BE%2BtEFWwDfTLnLzZe6y1O%2BHapHOKO0DpdCcgF1vr5mEF%2BSaiS19AbAuK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7a0fd26a0f9a7756-LHR
expires: Fri, 03 Mar 2023 07:52:41 GMT

GET
DATA 200
OK truncated
/ 194 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 trend.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgP8EmA64mqJbZdYVLq9nxSVXCI9M2XhAj4c0B8zNMGYUIYYXBrNKIDiJi3DUhZHti-JW1iuWq_hgH_KGkQT_pkqueXKc0WcPMVbLXmAIPg9BotGqpr9xFx0yMyAUyMDgNz_Ar4heB34OmTE4ThP... 56 KB
57 KB 415ms
414ms Image
image/png 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEgP8EmA64mqJbZdYVLq9nxSVXCI9M2XhAj4c0B8zNMGYUIYYXBrNKIDiJi3DUhZHti-JW1iuWq_hgH_KGkQT_pkqueXKc0WcPMVbLXmAIPg9BotGqpr9xFx0yMyAUyMDgNz_Ar4heB34OmTE4ThPz9VHq3QCC9EcZyyW_oQTKK5EvsbRCGK_sU_s3kC/s728-e3650/trend.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0fdfc303b44fb34ca3c6236d383d691dfed2c9717c093fb289862ccbcb6ef44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-disposition: inline;filename="trend.png"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 57783
x-xss-protection: 0
server: cloudflare
etag: "v2751"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=La%2BTnFh2IgZUz3v8HPDit2OghcCaHK1oNxcO7UGAWzzZjMNVawnA4EqxJKJa1Q4l%2FL8fxLAFfNKJkIV0XkTQLYizwNJfWr4fGodC3npLO2wORfl6ZIEMc2t8xgvoFP0vsuM1mM61n24M%2F6LhOhDh"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 7a0fd26a2fcf7756-LHR
expires: Sat, 26 Feb 2033 07:52:41 GMT

GET
H2 200 file.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjHvj6rnim8y8Q_KCiJbG6UMBz4mhIhOZfKs1mjBxP2JYgUXsqMkC65HcCSS-rg2zB0PF09f0I5ey6LOWU5Sd1cyjmVLLQKADy7WWduHuVr6yMM94qykHEYeijL-j9292wdA4tlq5X8Pb4q6V_T7... 4 KB
5 KB 57ms
56ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEjHvj6rnim8y8Q_KCiJbG6UMBz4mhIhOZfKs1mjBxP2JYgUXsqMkC65HcCSS-rg2zB0PF09f0I5ey6LOWU5Sd1cyjmVLLQKADy7WWduHuVr6yMM94qykHEYeijL-j9292wdA4tlq5X8Pb4q6V_T7NkiM5XqNLoCP_6Bq2v0r_s6JDRTeSnmRxu5eIdfNw/w72-h72-p-k-no-nu/file.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c023fa6f919fe8dbaafaad3c08dcc418c71ebf05d38db759c4d7bb0e169bf5ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4885
cf-polished: origFmt=png, origSize=6442
content-disposition: inline; filename="file.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4394
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ve719"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xa7YRAjT3I9wZK09MtTFLBZ4phcBiGWKkmN2mAlZOuLJVI7x%2BtD1dCtFZrJGIEZzuFxu3iRpE80qWgA42KvwhdspFfYunHvPkn91pOjAvwRdNGO9dPsBsNwvhDdInlePs6xZgQqVl%2BOwRN%2Bp5art"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 7a0fd26a2fd07756-LHR
expires: Thu, 02 Mar 2023 06:31:16 GMT

GET
H2 200 lastpass.png
thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEg-uGMUB3tHhy0O3xzEdAO3UIFLmHRNyaAqPd7cEEz8sbfWX4dbXt5U1qXp9OS7FB4zyhmW0pxhzIbUHDhFDHhWVT8RUF5kYDYXsY3tlfW0UOX52iBrR9QM827L2b0vv-1-Tw6YOZ22FJ0hg3Dp7... 1 KB
1 KB 58ms
57ms Image
image/webp 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEg-uGMUB3tHhy0O3xzEdAO3UIFLmHRNyaAqPd7cEEz8sbfWX4dbXt5U1qXp9OS7FB4zyhmW0pxhzIbUHDhFDHhWVT8RUF5kYDYXsY3tlfW0UOX52iBrR9QM827L2b0vv-1-Tw6YOZ22FJ0hg3Dp7D6c6uXELAhWCzWdHKmveE67uQDUA-BjlB1EUNFE/w72-h72-p-k-no-nu/lastpass.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89484d4e67da574120fdf5b7d4d68e8296996dc075d1e4968c3928a8a3e910ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4734
cf-polished: origFmt=png, origSize=1584
content-disposition: inline; filename="lastpass.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1038
x-xss-protection: 0
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v27b0"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sYRm6ItXYo5FV0nddX7%2B9VuXR5oIZK%2FmHQ%2BlU95bNnxwWD0nBC0PXssfuUgcALNSZAnzrCOGuiYZlq0Cd1T8DTwKDdza45yVCeVe6V%2B7Tl9LKom%2Bt7mx%2FVp82Gh3y9Weaz%2FtwWIhaLZGBycMupqM"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-expose-headers: Content-Length
cache-control: public, max-age=31536000, immutable, s-maxage=31536000
accept-ranges: bytes
cf-ray: 7a0fd26a2fd17756-LHR
expires: Thu, 02 Mar 2023 06:33:47 GMT

GET
H3 200 s.js Show response
thehackernews.com/cdn-cgi/zaraz/ 6 KB
3 KB 54ms
54ms Script
text/javascript 2606:4700:20::681a:61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyQ3liZXIlMjBFc3Bpb25hZ2UlMjBHcm91cCUyMEVhcnRoJTIwS2l0c3VuZSUyMERlcGxveXMlMjBXaGlza2VyU3B5JTIwQmFja2Rvb3IlMjBpbiUyMExhdGVzdCUyMEF0dGFja3MlMjIlMkMlMjJ4JTIyJTNBMC4yMzUxNzk0MjQzNzAyNjE2MiUyQyUyMnclMjIlM0ExNjAwJTJDJTIyaCUyMiUzQTEyMDAlMkMlMjJqJTIyJTNBMTIwMCUyQyUyMmUlMjIlM0ExNjAwJTJDJTIybCUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGdGhlaGFja2VybmV3cy5jb20lMkYyMDIzJTJGMDIlMkZub3J0aC1rb3JlYW4tY3liZXItZXNwaW9uYWdlLWdyb3VwLmh0bWwlM0Z1dG1fc291cmNlJTNEbmV3c2xldHRlciUyNnV0bV9tZWRpdW0lM0RlbWFpbCUyNnV0bV90ZXJtJTNEMjAyMy0wMi0yOCUyNnV0bV9jYW1wYWlnbiUzREZha2UlMkJDaGF0R1BUJTJCQXBwcyUyQldoaXNrZXJTcHklMkJTdGVhbGMlMkJNYWx3YXJlJTJCRm9ydGluZXQlMkJSQ0UlMkJFeHBsb2l0JTJCYW5kJTJCTW9yZSUyMiUyQyUyMnIlMjIlM0ElMjIlMjIlMkMlMjJrJTIyJTNBMjQlMkMlMjJuJTIyJTNBJTIyVVRGLTglMjIlMkMlMjJvJTIyJTNBMCUyQyUyMnElMjIlM0ElNUIlNUQlN0Q=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:61 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e757521bbdbd5a05a4281b33bfd0c8326722ba6afa0ef21f274cf4610c9d9eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
access-control-max-age: 600
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://thehackernews.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9RzKEmjAHJ3tNv3Ec5ka5nEEYIJ63QmMvgG7BFgWZZWAJBV2Qq0sx0A6Ytik6TnYocd0X3yUeurBZGDbz5uhvG1IsQdH%2BJOG60RfoDgAJa6xSdWVnARF30PyT8o1r8vz3x6SVoLrkoIJDMfgQrO7"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-credentials: true
cf-ray: 7a0fd26a590a7587-LHR
access-control-allow-headers: Content-Type, Set-Cookie, Cache-Control

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 147ms
47ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1677657161.dop035.lo4.t,1677657161.cds011.lo4.hn,1677657161.cds263.lo4.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 pb.37020.1664558804419.js Show response
cdn.adpushup.com/prebid/ 355 KB
95 KB 60ms
60ms Script
application/javascript 2a02:26f0:3500:12::1730:1786
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.37020.1664558804419.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:12::1730:1786 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: d5ef141c8649172cc921e50e9b28d5deb2cabfeda102a9c40ef5cf39daf2aaa1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-akamai-country: GB
date: Wed, 01 Mar 2023 07:52:41 GMT
content-encoding: br
last-modified: Fri, 30 Sep 2022 17:26:56 GMT
server: nginx/1.18.0
etag: W/"633726e0-58d15"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=6, ak_p; desc="466015_389027462_423761815_601_1121_52_0";dur=1
content-length: 96224
expires: Thu, 29 Feb 2024 07:52:41 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
562 B 57ms
56ms Script
application/javascript 2a02:26f0:3500:12::1730:1786
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:12::1730:1786 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-akamai-country: GB
date: Wed, 01 Mar 2023 07:52:41 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466015_389027462_423761894_47_1395_52_0";dur=1
content-length: 211
expires: Thu, 29 Feb 2024 07:52:41 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 76 KB
27 KB 227ms
77ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

40569e95bbefa60d6888470b1c46d8354a25a50dd7633833492c131b8202e165

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26883
x-xss-protection: 0
server: sffe
etag: "1497 / 384 of 1000 / last-modified: 1677625601"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 01 Mar 2023 07:52:41 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 193 KB
47 KB 209ms
68ms Script
application/javascript 65.9.97.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.97.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-97-56.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a661f8f8090e763d9e46c3b0745a402070fc823d3cf116aba6c2ad0287282d62

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:09:11 GMT
content-encoding: gzip
via: 1.1 fd4a8fa7c304171992e7f22fc8894904.cloudfront.net (CloudFront), 1.1 d5da174e34f35b7d1482b8432bf7e084.cloudfront.net (CloudFront)
last-modified: Wed, 22 Feb 2023 21:30:54 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, PRG50-C1
age: 2611
x-amz-server-side-encryption: AES256
etag: W/"0d9f2b192f61b596888847da998647d3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: VMIAkwX5cEcxIHQD5mAUQ34lS5XSizkPXNwFx_B9lLNdr_SHabdtuw==

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
368 B 179ms
56ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:41 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid not set due to GDPR
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA= Show response
fundingchoicesmessages.google.com/f/ 126 KB
43 KB 305ms
125ms Script
application/javascript 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA=

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8ba824471646f9bffe16fbc012a8cfb19cfdbf2d10f77e4bd9403abdac4cda0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4pdv0ETkXuWZhY1gAnnrqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-4pdv0ETkXuWZhY1gAnnrqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 21 KB
9 KB 190ms
56ms Script
application/javascript 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 79b87df922384438d3c4a7e6f3b2ebaef856e7b2ddc5f15e279dc7167c33553c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-encoding: gzip
etag: "liYNKlRv1+e+pwbkZBrDjQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 08 Mar 2023 07:52:42 GMT

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
634 B 206ms
60ms Script
application/javascript 2600:9000:2127:3200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:3200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:50:07 GMT
via: 1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 156
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: 9pUpgOQWsEkMftYieN4_13zIVIuDewErKQnbGPDAN8NPjnam9llRhg==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 783 B
1 KB 174ms
173ms XHR
application/json 65.9.97.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthehackernews.com&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.97.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-97-56.prg50.r.cloudfront.net
Software: Server /
Resource Hash: 2b26ca4f6f3bc00866f87f65a5f0ce2b95a52325170a89046e9ab9b30afd0ca3

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:41 GMT
via: 1.1 d5da174e34f35b7d1482b8432bf7e084.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: PRG50-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://thehackernews.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 783
x-amz-cf-id: liOTRBdhd5QlXjvMrbGEhEVzFMxFu-3ED6ZuMnib2r7F7HHe4Q8S3A==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 184ms
61ms XHR
application/javascript 65.9.97.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.97.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-97-56.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: pfXD8LfbTWwWYbVa8nASYbe6_QUldhGN
content-encoding: gzip
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
date: Wed, 01 Mar 2023 05:53:42 GMT
x-amz-cf-pop: PRG50-C1
age: 8905
x-cache: Hit from cloudfront
last-modified: Wed, 15 Feb 2023 23:43:01 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: EgAm93mwB15B9VlJfjzJiRKt301UgVTdtYzWn7iLi63O3x0Cajr35w==

GET
H2 200 pubads_impl_2023022301.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
130 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f13c6b3026bf5f9437ea17554965e56be1b5ab25b5cf6f3de7415b5b8bd2f60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:31:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1288
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132695
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 09:36:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 29 Feb 2024 07:31:14 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 260 B
175 B 171ms
63ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=thehackernews.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75261d098063049f7ff4f630e83ed35adba017905a066e75c9fadf158ae8ef7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 150
x-xss-protection: 0
expires: Wed, 01 Mar 2023 07:52:42 GMT

POST
H3 204 AGSKWxU9-MEau1YF8G1T-8I1iwjNJLWBukVnQ_SPZ0rcQwmm4g4ptv7qIUc_3Hpi6LrE3kjFj8YrYu37NcUpY3Vsfuk= Show response
fundingchoicesmessages.google.com/el/ 0
28 B 349ms
203ms XHR
text/html 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU9-MEau1YF8G1T-8I1iwjNJLWBukVnQ_SPZ0rcQwmm4g4ptv7qIUc_3Hpi6LrE3kjFj8YrYu37NcUpY3Vsfuk=?pvid=5FD55585-837F-4415-9A95-02BDC1490B9B

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.AkMO_7m1EFE.es5.O/d=1/rs=AJlcJMzUtgx60T6P11e6osXTL8u0witfjg/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MnSbCKVyuESradZUMjb8sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-MnSbCKVyuESradZUMjb8sQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://thehackernews.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxU9-MEau1YF8G1T-8I1iwjNJLWBukVnQ_SPZ0rcQwmm4g4ptv7qIUc_3Hpi6LrE3kjFj8YrYu37NcUpY3Vsfuk= Show response
fundingchoicesmessages.google.com/el/ 0
29 B 247ms
102ms XHR
text/html 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU9-MEau1YF8G1T-8I1iwjNJLWBukVnQ_SPZ0rcQwmm4g4ptv7qIUc_3Hpi6LrE3kjFj8YrYu37NcUpY3Vsfuk=?pvid=5FD55585-837F-4415-9A95-02BDC1490B9B

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-60eXD0sysUraGvybXUdl-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-60eXD0sysUraGvybXUdl-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://thehackernews.com
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
321 B 57ms
57ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2Nzc2NTcxNjIyMjIsInBhY2tldElkIjoiMDAwMDkwOUMtMmZkNmIwMTQtOWRlMi00YWE4LTg1ZTgtODI5ODkyNzdmMjcwIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAyL25vcnRoLWtvcmVhbi1jeWJlci1lc3Bpb25hZ2UtZ3JvdXAuaHRtbD91dG1fc291cmNlPW5ld3NsZXR0ZXImdXRtX21lZGl1bT1lbWFpbCZ1dG1fdGVybT0yMDIzLTAyLTI4JnV0bV9jYW1wYWlnbj1GYWtlK0NoYXRHUFQrQXBwcytXaGlza2VyU3B5K1N0ZWFsYytNYWx3YXJlK0ZvcnRpbmV0K1JDRStFeHBsb2l0K2FuZCtNb3JlIiwibW9kZSI6NCwiZXJyb3JDb2RlIjowLCJyZWZlcnJlciI6IiIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGwsInBhZ2VHcm91cCI6IlBPU1QifQ%3D%3D&c_b=2337.6000003814697
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 56ms
56ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2Nzc2NTcxNjIyMjMsInBhY2tldElkIjoiMDAwMDkwOUMtMmZkNmIwMTQtOWRlMi00YWE4LTg1ZTgtODI5ODkyNzdmMjcwIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAyL25vcnRoLWtvcmVhbi1jeWJlci1lc3Bpb25hZ2UtZ3JvdXAuaHRtbD91dG1fc291cmNlPW5ld3NsZXR0ZXImdXRtX21lZGl1bT1lbWFpbCZ1dG1fdGVybT0yMDIzLTAyLTI4JnV0bV9jYW1wYWlnbj1GYWtlK0NoYXRHUFQrQXBwcytXaGlza2VyU3B5K1N0ZWFsYytNYWx3YXJlK0ZvcnRpbmV0K1JDRStFeHBsb2l0K2FuZCtNb3JlIiwibW9kZSI6MiwiZXJyb3JDb2RlIjo3LCJyZWZlcnJlciI6IiIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGwsInBhZ2VHcm91cCI6IlBPU1QifQ%3D%3D&c_b=2337.8999996185303
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 AGSKWxVuig5Vu8jbu5N9IZh8gmK4V0ut__Bn13svTbZC1LCjGecr4d4M_7zJveQYzAmJ5oNEF7GRpbBinm7SxrjoB6w= Show response
fundingchoicesmessages.google.com/f/ 461 KB
60 KB 186ms
185ms Script
application/javascript 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVuig5Vu8jbu5N9IZh8gmK4V0ut__Bn13svTbZC1LCjGecr4d4M_7zJveQYzAmJ5oNEF7GRpbBinm7SxrjoB6w=?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjc3NjU3MTYyLDI1MDAwMDAwMF0sIjVGRDU1NTg1LTgzN0YtNDQxNS05QTk1LTAyQkRDMTQ5MEI5QiIsbnVsbCxudWxsLFtudWxsLFs3XV0sImh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vMjAyMy8wMi9ub3J0aC1rb3JlYW4tY3liZXItZXNwaW9uYWdlLWdyb3VwLmh0bWwiLG51bGwsW1s4LCJBa01PXzdtMUVGRSJdLFs5LCJlbi1HQiJdLFsxNywiW2ZhbHNlXSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

08df39cb9c4a196884eb337c01b99637308af53f12f6ec2e758008092d5966c5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-76k9Z7uCKlmjzyKBP_-ZAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-76k9Z7uCKlmjzyKBP_-ZAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 32 KB
10 KB 214ms
63ms Script
text/javascript 65.9.95.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-19.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1b9bc9c5d136e5e10a89c8902b5c6540cd738265af675ed3e3984e28c0c14f02

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Tue, 28 Feb 2023 15:20:11 GMT
content-encoding: gzip
via: 1.1 32f35b6a71829a460d6fdae31f270164.cloudfront.net (CloudFront)
last-modified: Thu, 05 Jan 2023 20:07:47 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 59552
x-amz-server-side-encryption: AES256
etag: W/"322a4a4dadec5839e9040f77edf9282d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: QbEvLXsPKHJX4Y2iWTgkRSFnWJ0HPKi32pchJrxclVU808Bk34cfQA==

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
459 B 118ms
117ms XHR
text/plain 3.225.32.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.32.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-32-203.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Wed, 01 Mar 2023 07:52:42 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 380ms
117ms Preflight 3.225.32.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.32.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-32-203.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://thehackernews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Wed, 01 Mar 2023 07:52:42 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 179ms
56ms XHR
application/json 54.229.20.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.20.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-20-73.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 7c5ae988d44c2579da1f28bb50de8ffaf1f7cc38dc430730009fe41182977cfc

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache
x-server: 10.45.27.121
access-control-allow-credentials: true
content-length: 60
expires: 0

POST
H3 204 AGSKWxVGfCwHcyuIyWqChqRcTDgPb0mP1jFjAySG33bm-EDJK9JLar-VPBqOoxwWlOhGWT7IkkxQGm6phShMzrZL_U4-HyuwNbbtXy_jvfty_kLojHnWcVVircxo4DQANp7LjmIRlnVF4A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 114ms
114ms XHR
text/html 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVGfCwHcyuIyWqChqRcTDgPb0mP1jFjAySG33bm-EDJK9JLar-VPBqOoxwWlOhGWT7IkkxQGm6phShMzrZL_U4-HyuwNbbtXy_jvfty_kLojHnWcVVircxo4DQANp7LjmIRlnVF4A==?pvid=5FD55585-837F-4415-9A95-02BDC1490B9B

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nV3NUk3F1Fsk4MSEM4_vKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-nV3NUk3F1Fsk4MSEM4_vKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://thehackernews.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVGfCwHcyuIyWqChqRcTDgPb0mP1jFjAySG33bm-EDJK9JLar-VPBqOoxwWlOhGWT7IkkxQGm6phShMzrZL_U4-HyuwNbbtXy_jvfty_kLojHnWcVVircxo4DQANp7LjmIRlnVF4A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 113ms
113ms XHR
text/html 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HljaBpGPRJ7_bKFsyNIT0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-HljaBpGPRJ7_bKFsyNIT0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 60 KB
4 KB 279ms
103ms Stylesheet
text/css 2a00:1450:400d:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.AkMO_7m1EFE.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzUtgx60T6P11e6osXTL8u0witfjg/m=web_iab_tcf_v2_wall_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a9e9b25183086d9a4f38ffa75b83c2ac9be135dfc45e599e5160b425836251c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Mar 2023 07:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Mar 2023 07:52:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Mar 2023 07:52:42 GMT

POST
H3 204 AGSKWxXjLxH1sXt_ecnng2R_j_zgVm93aB5q9f4Du7pTQ_fEKDDLtDNhyW9hUa5pI_eEAh5bxLmE4ZFKMArqLv-TorNu0fk52ixkQVxhdVhy1OguzRnLzqU5URLnPETzWCHvDTIYiAtd7g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 101ms
101ms XHR
text/html 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXjLxH1sXt_ecnng2R_j_zgVm93aB5q9f4Du7pTQ_fEKDDLtDNhyW9hUa5pI_eEAh5bxLmE4ZFKMArqLv-TorNu0fk52ixkQVxhdVhy1OguzRnLzqU5URLnPETzWCHvDTIYiAtd7g==?dmid=970e7566fd7b1e49

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IPNJehsUFifJD8n6DMtzVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-security-policy: script-src 'report-sample' 'nonce-IPNJehsUFifJD8n6DMtzVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v139/ 125 KB
126 KB 239ms
72ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v139/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 00:59:31 GMT
x-content-type-options: nosniff
age: 543192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128352
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 00:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Feb 2024 00:59:31 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 311ms
155ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 19:34:57 GMT
x-content-type-options: nosniff
age: 476266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Feb 2024 19:34:57 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 88 KB
28 KB 140ms
49ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1080411
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27990
last-modified: Fri, 26 Aug 2022 18:34:13 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "63091225-6d56"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LZmYEUY04%2BAXt3Gtnjj1W8MaY5nW9Z6VaXZjyCObrfHOjvQYYhreX1b%2BGX6J5Qi3EsRlxxHflkxIPPuLH21%2FevLM4mM%2FX%2FzjpHdplye6t%2BHyWmECZrfVVsMFqwcp15IiV9S3Ibv%2FE%2FsgVh3936BD79ta"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7a0fd2748b8523d1-LHR
expires: Mon, 19 Feb 2024 07:52:42 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
49 KB 287ms
121ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7930b2cc502d37150cdd65f5d68b3d204860f23baa8945139c467cbd9039e13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49494
x-xss-protection: 0
server: cafe
etag: 12313540175401508991
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 01 Mar 2023 07:52:43 GMT

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b664f07c3d32e08b0cc4db38f1b1a943fb4c219c2816386876ee9a6a7cb930f

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 66ms
66ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2Nzc2NTcxNjI4MzcsInBhY2tldElkIjoiMDAwMDkwOUMtMmZkNmIwMTQtOWRlMi00YWE4LTg1ZTgtODI5ODkyNzdmMjcwIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAyL25vcnRoLWtvcmVhbi1jeWJlci1lc3Bpb25hZ2UtZ3JvdXAuaHRtbD91dG1fc291cmNlPW5ld3NsZXR0ZXImdXRtX21lZGl1bT1lbWFpbCZ1dG1fdGVybT0yMDIzLTAyLTI4JnV0bV9jYW1wYWlnbj1GYWtlK0NoYXRHUFQrQXBwcytXaGlza2VyU3B5K1N0ZWFsYytNYWx3YXJlK0ZvcnRpbmV0K1JDRStFeHBsb2l0K2FuZCtNb3JlIiwibW9kZSI6MSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6IjRjNzZiYjA1LWI5NTktNGY4YS05ZTkwLWY4YzEyOGQxZGRkNiIsInNlY3Rpb25OYW1lIjoiQVBfVF9SX3Jlc3BvbnNpdmVYcmVzcG9uc2l2ZV80Yzc2YiIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJBRFBfMzcwMjBfcmVzcG9uc2l2ZVhyZXNwb25zaXZlXzRjNzZiYjA1LWI5NTktNGY4YS05ZTkwLWY4YzEyOGQxZGRkNiIsInNlcnZpY2VzIjpbMiwzXSwiYWRVbml0VHlwZSI6MX1dfQ%3D%3D&c_b=2952.2000007629395
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
321 B 64ms
64ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2Nzc2NTcxNjI4NDksInBhY2tldElkIjoiMDAwMDkwOUMtMmZkNmIwMTQtOWRlMi00YWE4LTg1ZTgtODI5ODkyNzdmMjcwIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAyL25vcnRoLWtvcmVhbi1jeWJlci1lc3Bpb25hZ2UtZ3JvdXAuaHRtbD91dG1fc291cmNlPW5ld3NsZXR0ZXImdXRtX21lZGl1bT1lbWFpbCZ1dG1fdGVybT0yMDIzLTAyLTI4JnV0bV9jYW1wYWlnbj1GYWtlK0NoYXRHUFQrQXBwcytXaGlza2VyU3B5K1N0ZWFsYytNYWx3YXJlK0ZvcnRpbmV0K1JDRStFeHBsb2l0K2FuZCtNb3JlIiwibW9kZSI6MSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6ImU4NTg5ZmU1LWRkNTQtNDVlOC1iMTM3LWFjN2ZiMTBhNjEzMCIsInNlY3Rpb25OYW1lIjoiQVBfVF9SX3Jlc3BvbnNpdmVYcmVzcG9uc2l2ZV9lODU4OSIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJBRFBfMzcwMjBfcmVzcG9uc2l2ZVhyZXNwb25zaXZlX2U4NTg5ZmU1LWRkNTQtNDVlOC1iMTM3LWFjN2ZiMTBhNjEzMCIsInNlcnZpY2VzIjpbMiwzXSwiYWRVbml0VHlwZSI6MX1dfQ%3D%3D&c_b=2963.8999996185303
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
321 B 74ms
73ms Image
image/png 23.97.225.52
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2Nzc2NTcxNjI4MzcsInBhY2tldElkIjoiMDAwMDkwOUMtMmZkNmIwMTQtOWRlMi00YWE4LTg1ZTgtODI5ODkyNzdmMjcwIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIzLzAyL25vcnRoLWtvcmVhbi1jeWJlci1lc3Bpb25hZ2UtZ3JvdXAuaHRtbD91dG1fc291cmNlPW5ld3NsZXR0ZXImdXRtX21lZGl1bT1lbWFpbCZ1dG1fdGVybT0yMDIzLTAyLTI4JnV0bV9jYW1wYWlnbj1GYWtlK0NoYXRHUFQrQXBwcytXaGlza2VyU3B5K1N0ZWFsYytNYWx3YXJlK0ZvcnRpbmV0K1JDRStFeHBsb2l0K2FuZCtNb3JlIiwibW9kZSI6NSwiZXJyb3JDb2RlIjoxLCJyZWZlcnJlciI6IiIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGwsInBhZ2VHcm91cCI6IlBPU1QifQ%3D%3D&c_b=2976.6000003814697
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 07:52:42 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 23 B
463 B 258ms
114ms XHR
text/javascript 65.9.99.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthehackernews.com%2F2023%2F02%2Fnorth-korean-cyber-espionage-group.html%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2023-02-28%26utm_campaign%3DFake%2BChatGPT%2BApps%2BWhiskerSpy%2BStealc%2BMalware%2BFortinet%2BRCE%2BExploit%2Band%2BMore&pid=20SzI5if7waEs&cb=0&ws=1600x1200&v=23.203.336&t=3000&slots=%5B%7B%22sd%22%3A%22ADP_37020_responsivexresponsive_00000001-c0ed0e52-a0da-4d1d-b489-9a18f2c19a4c%22%2C%22s%22%3A%5B%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889224%22%7D%2C%7B%22sd%22%3A%22ADP_37020_responsivexresponsive_00000001-498f3924-6b88-4d29-9fed-49ea19e271dc%22%2C%22s%22%3A%5B%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889209%22%7D%5D&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.99.209 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-99-209.prg50.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:43 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 a198ea04052d45eb515f27260bc6c05c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: PRG50-C1
x-amz-rid: WVJSN8J86EPZ0A7F18PN
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://thehackernews.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: dfubLdz4kPyZNf08W-T8YerzuJqu7nXI6k1TYXj8OG2rEsoH-mJqgQ==

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 140ms
44ms XHR
application/json 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230301

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1664558804419.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

488420f41d0bbb4ea0129717b5e51c0ae026661667230fce9de38e44fc8d581d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 01 Mar 2023 07:52:43 GMT
x-content-type-options: nosniff
content-encoding: gzip
age: 13915
x-jsd-version: 1.0.1632
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 892
x-served-by: cache-fra-eddf8230103-FRA, cache-lon420119-LON
x-jsd-version-type: version
etag: W/"634-1p6XaMqzupP8SxkJZ8CmzkHr8Wg"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302140101/ 366 KB
121 KB 142ms
142ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302140101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7983783048239650&plah=thehackernews.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50eaced85d2b0862b90bab248ab2cbc2307278066400a33e58fdf8638dacdb69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 07:52:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123271
x-xss-protection: 0
server: cafe
etag: 14032187200501253475
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 01 Mar 2023 07:52:43 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230227/r20190131/ Frame 67C3 10 KB
5 KB 237ms
72ms Document
text/html 2a00:1450:400d:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230227/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7983783048239650

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:808::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca070dfc7785775cbf5cce16064029ee534259de42c6d9de10e476e710000e93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/2023/02/north-korean-cyber-espionage-group.html?utm_source=newsletter&utm_medium=email&utm_term=2023-02-28&utm_campaign=Fake+ChatGPT+Apps+WhiskerSpy+Stealc+Malware+Fortinet+RCE+Exploit+and+More
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 33743
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4549
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Feb 2023 22:30:20 GMT
etag: 2378337311435320485
expires: Tue, 14 Mar 2023 22:30:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

181 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
thehackernews.com/2023/02	1969-12-31 23:59:59	Name: _ga4s Value: 1
thehackernews.com/2023/02	1969-12-31 23:59:59	Name: _ga4sid Value: 2094074990
.thehackernews.com/	1970-01-20 19:36:57	Name: _ga4 Value: 55e1baca-97a2-474c-a251-672cb4c06ac1
thehackernews.com/	1970-01-20 10:44:09	Name: _pbjs_userid_consent_data Value: 3524755945110770
.thehackernews.com/	1970-01-20 10:44:09	Name: _pubcid Value: 0dc085b1-e09a-4c93-9650-4436dd2e1696

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-dtb-cf.amazon-adsystem.com
bcp.crwdcntrl.net
c.amazon-adsystem.com
cdn.adpushup.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
e3.adpushup.com
ejyazl.clicks.mlsend.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
tags.crwdcntrl.net
thehackernews.com
2001:4de0:ac18::1:a:3a
23.97.225.52
2600:9000:2127:3200:6:44e3:f8c0:93a1
2606:4700:20::681a:61
2606:4700::6811:190e
2606:4700::6811:6cef
2620:116:800d:21:ef75:8280:f209:5ba1
2a00:1450:4001:827::2002
2a00:1450:400d:806::200e
2a00:1450:400d:808::2002
2a00:1450:400d:80a::2002
2a00:1450:400d:80a::2003
2a00:1450:400d:80c::200a
2a02:26f0:3500:12::1730:1786
2a04:4e42::485
3.225.32.203
54.229.20.73
65.9.95.19
65.9.97.56
65.9.99.209
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08df39cb9c4a196884eb337c01b99637308af53f12f6ec2e758008092d5966c5
0c6c51dafc8bdf4ef6841da2faf4d5d7555393739fd7577d931b0268fe3060a9
1b9bc9c5d136e5e10a89c8902b5c6540cd738265af675ed3e3984e28c0c14f02
1e757521bbdbd5a05a4281b33bfd0c8326722ba6afa0ef21f274cf4610c9d9eb
26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16
2914216cad9ac6c3dd47daeda151e11225f74738085e65f74e4a376ba0a3b6f5
2b26ca4f6f3bc00866f87f65a5f0ce2b95a52325170a89046e9ab9b30afd0ca3
2b664f07c3d32e08b0cc4db38f1b1a943fb4c219c2816386876ee9a6a7cb930f
2de33ca2d2cfb7f437aa190ecdd4b3991ff2879604c0e24aaf02849ae1f360b3
3f13c6b3026bf5f9437ea17554965e56be1b5ab25b5cf6f3de7415b5b8bd2f60
3f180292b41fe4c7f72ba93858e158edfd5024417ff096355c605713453a1df1
40569e95bbefa60d6888470b1c46d8354a25a50dd7633833492c131b8202e165
488420f41d0bbb4ea0129717b5e51c0ae026661667230fce9de38e44fc8d581d
50eaced85d2b0862b90bab248ab2cbc2307278066400a33e58fdf8638dacdb69
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
75261d098063049f7ff4f630e83ed35adba017905a066e75c9fadf158ae8ef7b
79b87df922384438d3c4a7e6f3b2ebaef856e7b2ddc5f15e279dc7167c33553c
7c5ae988d44c2579da1f28bb50de8ffaf1f7cc38dc430730009fe41182977cfc
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
89484d4e67da574120fdf5b7d4d68e8296996dc075d1e4968c3928a8a3e910ea
a0fdfc303b44fb34ca3c6236d383d691dfed2c9717c093fb289862ccbcb6ef44
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a661f8f8090e763d9e46c3b0745a402070fc823d3cf116aba6c2ad0287282d62
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a
a9e9b25183086d9a4f38ffa75b83c2ac9be135dfc45e599e5160b425836251c3
b7930b2cc502d37150cdd65f5d68b3d204860f23baa8945139c467cbd9039e13
c023fa6f919fe8dbaafaad3c08dcc418c71ebf05d38db759c4d7bb0e169bf5ae
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690
ca070dfc7785775cbf5cce16064029ee534259de42c6d9de10e476e710000e93
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d5ef141c8649172cc921e50e9b28d5deb2cabfeda102a9c40ef5cf39daf2aaa1
dbf4fa73ce4f2bd113dde31b7f7eff7bfd3a1271f30ababad320f07033408f06
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a
edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02
f8ba824471646f9bffe16fbc012a8cfb19cfdbf2d10f77e4bd9403abdac4cda0
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

thehackernews.com Open in urlscan Pro 2606:4700:20::681a:61 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

44 Requests

100 %HTTPS

70 %IPv6

16 Domains

20 Subdomains

20 IPs

4 Countries

1153 kBTransfer

3415 kBSize

5 Cookies

33 Outgoing links

Page URL History

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

thehackernews.com Open in urlscan Pro
2606:4700:20::681a:61 Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

100 %
HTTPS

70 %
IPv6

16
Domains

20
Subdomains

20
IPs

4
Countries

1153 kB
Transfer

3415 kB
Size

5
Cookies

44 HTTP transactions
9 data transactions