www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:67e1 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Submission: On August 07 via api (August 7th 2023, 12:37:33 pm UTC) from DE — Scanned from DE

Summary HTTP 151 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 48 IPs in 4 countries across 38 domains to perform 151 HTTP transactions. The main IP is 2606:2c40::c73c:67e1, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reversinglabs.com.
TLS certificate: Issued by GTS CA 1P5 on July 24th 2023. Valid for: 3 months.

This is the only time www.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
62	2606:2c40::c7... 2606:2c40::c73c:67e1	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	151.101.129.181 151.101.129.181	54113 (FASTLY) (FASTLY)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ecb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6812:d0c9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2606:4700::68... 2606:4700::6812:f0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8f65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.78.118 65.9.78.118	16509 (AMAZON-02) (AMAZON-02)
1	18.66.192.39 18.66.192.39	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	18.173.154.13 18.173.154.13	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ecd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
1	2600:9000:26d... 2600:9000:26db:4800:9:d7d4:1380:93a1	16509 (AMAZON-02) (AMAZON-02)
1	35.171.143.69 35.171.143.69	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6811:816e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:62ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:88ce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:18c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:6ac7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:78be	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.160.212.84 3.160.212.84	16509 (AMAZON-02) (AMAZON-02)
9	95.101.111.170 95.101.111.170	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
6	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:401... 2a00:1450:4016:80a::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:26d... 2600:9000:26db:800:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6811:d3f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:d6f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:c9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:480... 2a02:26f0:480:22::1726:62ed	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
151	48

62 2606:2c40::c73c:67e1 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.reversinglabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.181 (United States)

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ecb (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:d0c9 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6812:f0f (United States)

ASN13335 (CLOUDFLARENET, US)

3375217.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8f65 (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

cookieinfoscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.78.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-78-118.ams1.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.192.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-39.muc50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.154.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-13.muc50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ecd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26db:4800:9:d7d4:1380:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.metadata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.171.143.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-143-69.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:816e (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:62ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:88ce (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:18c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:6ac7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:78be (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.160.212.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-160-212-84.mxp53.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 95.101.111.170 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-170.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4016:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:26db:800:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d3f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d6f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c9cc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:22::1726:62ed (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	reversinglabs.com www.reversinglabs.com	2 MB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 5439 c.6sc.co — Cisco Umbrella Rank: 8622 ipv6.6sc.co — Cisco Umbrella Rank: 5612 b.6sc.co — Cisco Umbrella Rank: 3549	18 KB
10	hubspotusercontent-na1.net 3375217.fs1.hubspotusercontent-na1.net	232 KB
6	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2577 www.google.com — Cisco Umbrella Rank: 3	920 B
6	linkedin.com 4 redirects platform.linkedin.com — Cisco Umbrella Rank: 3010 px.ads.linkedin.com — Cisco Umbrella Rank: 391 www.linkedin.com — Cisco Umbrella Rank: 539 px4.ads.linkedin.com — Cisco Umbrella Rank: 6039	165 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5177 track.hubspot.com — Cisco Umbrella Rank: 2254 forms.hubspot.com — Cisco Umbrella Rank: 4396	4 KB
5	gstatic.com fonts.gstatic.com	80 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 170	223 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 73	360 KB
3	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4156 forms-na1.hsforms.com — Cisco Umbrella Rank: 6801	3 KB
3	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1003 syndication.twitter.com — Cisco Umbrella Rank: 1212	132 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 55 region1.google-analytics.com — Cisco Umbrella Rank: 1869	21 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	269 B
2	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 870	752 B
2	google.de www.google.de — Cisco Umbrella Rank: 5576	562 B
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 stats.g.doubleclick.net — Cisco Umbrella Rank: 115	2 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4645 forms.hscollectedforms.net — Cisco Umbrella Rank: 4755	26 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 745 script.hotjar.com — Cisco Umbrella Rank: 967	59 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1375 insight.adsrvr.org — Cisco Umbrella Rank: 604	3 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3473	1 KB
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1468	637 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2791	258 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3228	3 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2192	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2187	21 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 4789	22 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4274	86 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4388	2 KB
1	quora.com q.quora.com — Cisco Umbrella Rank: 3965	423 B
1	metadata.io cdn.metadata.io — Cisco Umbrella Rank: 33170	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1326	8 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 783	5 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	1 KB
1	cookieinfoscript.com cookieinfoscript.com — Cisco Umbrella Rank: 90872	4 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5423	5 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 257	27 KB
1	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 7970	2 KB
1	vidyard.com play.vidyard.com — Cisco Umbrella Rank: 12467	23 KB
151	38

	Domain	Requested by
62	www.reversinglabs.com	www.reversinglabs.com js.usemessages.com
10	3375217.fs1.hubspotusercontent-na1.net	www.reversinglabs.com
7	b.6sc.co	www.reversinglabs.com
5	region1.analytics.google.com	www.googletagmanager.com
5	fonts.gstatic.com	fonts.googleapis.com
4	connect.facebook.net	www.reversinglabs.com connect.facebook.net
4	www.googletagmanager.com	www.reversinglabs.com www.googletagmanager.com www.google-analytics.com js.hsadspixel.net
3	track.hubspot.com
3	px.ads.linkedin.com	3 redirects
3	www.facebook.com	www.reversinglabs.com
2	forms.hsforms.com	www.reversinglabs.com
2	cdn.linkedin.oribi.io	snap.licdn.com
2	www.google.de	www.reversinglabs.com
2	platform.twitter.com	www.reversinglabs.com platform.twitter.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	forms.hubspot.com	js.hsleadflows.net
1	insight.adsrvr.org	js.adsrvr.org
1	region1.google-analytics.com	www.googletagmanager.com
1	syndication.twitter.com	platform.twitter.com
1	www.google.com	www.reversinglabs.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	api.hubapi.com	js.hsadspixel.net
1	forms-na1.hsforms.com	www.reversinglabs.com
1	alb.reddit.com	www.reversinglabs.com
1	px4.ads.linkedin.com	www.reversinglabs.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	j.6sc.co	www.reversinglabs.com
1	vc.hotjar.io	script.hotjar.com
1	app.hubspot.com	www.reversinglabs.com
1	js.hsadspixel.net	www.reversinglabs.com
1	js.hscollectedforms.net	www.reversinglabs.com
1	js.hs-banner.com	www.reversinglabs.com
1	js.hs-analytics.net	www.reversinglabs.com
1	js.usemessages.com	www.reversinglabs.com
1	js.hsleadflows.net	www.reversinglabs.com
1	ws.zoominfo.com	www.reversinglabs.com
1	q.quora.com	www.reversinglabs.com
1	cdn.metadata.io	www.reversinglabs.com
1	www.redditstatic.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	fonts.googleapis.com	www.reversinglabs.com
1	static.hotjar.com	www.reversinglabs.com
1	js.adsrvr.org	www.reversinglabs.com
1	cookieinfoscript.com	www.reversinglabs.com
1	static.hsappstatic.net	www.reversinglabs.com
1	cdnjs.cloudflare.com	www.reversinglabs.com
1	cdn2.hubspot.net	www.reversinglabs.com
1	platform.linkedin.com	www.reversinglabs.com
1	play.vidyard.com	www.reversinglabs.com
151	54

This site contains links to these domains. Also see Links.

Domain
register.reversinglabs.com
support.reversinglabs.com
rli.reversinglabs.com
www.secure.software
github.com
docs.python.org
blog.reversinglabs.com
pypi.org
twitter.com
www.linkedin.com
www.youtube.com
www.facebook.com
www.instagram.com
cookieinfoscript.com

Subject Issuer	Validity	Valid
www.reversinglabs.com GTS CA 1P5	`2023-07-24` - `2023-10-22`	3 months	crt.sh
*.vidyard.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-01` - `2024-08-01`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2023-05-17` - `2024-05-16`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2023-04-06` - `2024-04-05`	a year	crt.sh
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3	`2023-01-26` - `2024-01-25`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
hsappstatic.net Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
cookieinfoscript.com E1	`2023-06-14` - `2023-09-12`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-05-16` - `2023-08-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
*.metadata.io DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-18` - `2024-01-07`	a year	crt.sh
*.quora.com R3	`2023-07-12` - `2023-10-10`	3 months	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-28` - `2024-07-26`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
6sc.co R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Frame ID: F699EEC6A2D3EAF24A190C6CF6EA1051
Requests: 148 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Frame ID: 104D83F8C7896E093BFACAE44B922B43
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 05148DCC315CE10000EE9C21F19E0546
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Frame ID: 36FCA830E3620ACB107B91870132CEFA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VMConnect: Malicious PyPI packages imitate popular open source modules

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

151
Requests

99 %
HTTPS

77 %
IPv6

38
Domains

54
Subdomains

48
IPs

4
Countries

3506 kB
Transfer

7049 kB
Size

35
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://register.reversinglabs.com/demo
Title: Demo

Search URL Search Domain Scan URL

URL: https://support.reversinglabs.com/hc/en-us/restricted
Title: Support

Search URL Search Domain Scan URL

URL: https://rli.reversinglabs.com/accounts/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.secure.software/
Title: Developer Portal

Search URL Search Domain Scan URL

URL: https://github.com/vmware/pyvmomi
Title: pyVmomi VMware vSphere bindings

Search URL Search Domain Scan URL

URL: https://docs.python.org/3/library/asyncio.html
Title: asyncro

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure1-behaviors.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure2-init.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure4-loop.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure5-PyPI_author.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure6-PyPI_project.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure7-husky_github.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure8-init_gihub.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure9-VMConnect.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/vmconnect-blog-figure10-vconnector.png

Search URL Search Domain Scan URL

URL: https://github.com/MarianaCamelia
Title: repository

Search URL Search Domain Scan URL

URL: https://pypi.org/project/eth-tester/#description
Title: eth-tester

Search URL Search Domain Scan URL

URL: https://pypi.org/project/databases/
Title: databases

Search URL Search Domain Scan URL

URL: https://twitter.com/reversinglabs
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/reversinglabs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/reversinglabs
Title: Youtube play

Search URL Search Domain Scan URL

URL: https://www.facebook.com/reversinglabs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/reversinglabs
Title: Instagram

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/blog/rss.xml
Title: RSS

Search URL Search Domain Scan URL

URL: https://cookieinfoscript.com/
Title: cookie script

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 120

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691411847570%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%252Fblog%252Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJor8H8KaErAAAAAYnQAJxA6GgmH0b2oVuxO5dqddVo4Bsc03U9d1QaryaDzbT7E9EhLsba

151 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules Show response
www.reversinglabs.com/blog/ 133 KB
28 KB 133ms
69ms Document
text/html 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-ray: 7f2f92296db92c23-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 07 Aug 2023 12:37:26 GMT
edge-cache-tag: CT-128190968732,CG-3375217,CG-5901382633,P-3375217,L-11118979719,L-11735000539,CW-103636562700,CW-10782554896,CW-11119297579,CW-11395370497,CW-114796045952,CW-115016303498,CW-115021731904,CW-11538883136,CW-23776629869,CW-23799638916,CW-28186900061,CW-36845096476,CW-6520974104,CW-79001037452,CW-80857835930,CW-80864562095,CW-80864563080,CW-80868056874,CW-87757605656,E-10528761402,E-10777459487,E-11119463588,E-11190015046,E-11395370929,E-11395383304,E-11708570900,E-21052151416,E-23712622487,E-28203361861,E-38216899954,E-5951651806,E-6021532803,E-6021916068,E-6519964395,E-70521421874,PGS-ALL,SW-1,B-112999115134,B-5901382633,B-70179327783,B-94488163452,GC-103819429689,GC-115009898400,GC-115015365221,GC-115020232564,GC-25875947801,GC-25876057703,GC-26129507391,GC-28186555742,GC-80858624881,GC-80970810765,GC-80971492144,GC-81200326231,GC-87768577627
etag: W/"fc65ff0bb81ce00ae84caf0244109953"
last-modified: Sun, 06 Aug 2023 04:05:31 GMT
link: </hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mR9vqTSFb6VSiYIREkZAa7JPg0w2mgePGIBkUHNmWcb3ehLe5q9OF5w%2FUjlPQ1NGAhpvsfakvE0x5nU0WJdLAktfUW89yRQPl3UhpCt6g0KDacRKeruGSxfMGTAB9WnZvZMuETeBIEonVsNrhdbdwVy0lA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-0s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 128190968732
x-hs-https-only: worker
x-hs-hub-id: 3375217
x-hs-prerendered: Sun, 06 Aug 2023 04:05:31 GMT

GET
H2 200 index.js Show response
www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/ 11 KB
5 KB 76ms
74ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 5cb605e8100138acccc04f094724133e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 7630268
x-amz-cf-pop: CDG52-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: inhS2tX2f2C4tITR3p2haS.uhsvA9eGz
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 21 Apr 2023 15:17:56 GMT
server: cloudflare
etag: W/"0bbd63c0750f141fd5cec04a9393647e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FIQ0QOnOnz8AE9Y6FNvXn3dq8xDmlc9My%2B9chS%2BHXlqElTZaKBBKGARurPk17iwdMd2elGafwOLmAYNPji%2FGoVpuyLYrBZD19dMoCunllYCVF9QnBhp6r7bff8HIhq4Cm%2FPc0RVaAPip68Tl2yu0jE%2FKaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f9229ee8a2c23-FRA
x-amz-cf-id: 1HpAFXqvL-enGli7aFtbEYFS9QYd6YvOX2Rnrw2xQ2piSsJZzYKgAg==
expires: Tue, 06 Aug 2024 12:37:26 GMT

GET
H2 200 project.js Show response
www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 125ms
124ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 18609518
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ws3yj095V%2FtfYuwGF7i8aBeP1dQ%2FpKbYzlMegsRiHCnUfOJjO46SixhmihZ0lfY%2FbjjipK0W1LFzU7FTGFUFvmQJkSzYkKM2fuI%2BYFLiFB2bh3ObbRreiYagBZUtQ7k1bW4UazCL%2F2fBeFeCx8yn8nk9uQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f9229ee8c2c23-FRA
x-amz-cf-id: 4vqYOqTM0WbGp0-GCaAl1Rqxz0zHXUS33BRu8hoAMeiWnfDDXFZmEw==
expires: Tue, 06 Aug 2024 12:37:26 GMT

GET
H2 200 v2.js Show response
www.reversinglabs.com/_hcms/forms/ 526 KB
172 KB 76ms
75ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 123
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3512/bundles/project-v2.js&cfRay=7f2f8f28273c2c7b-FRA
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-evy-trace-listener: listener_https
etag: W/"c93e66dd60926c55c794dc765ffe6c1a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.3512/bundles/project-v2.js
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-amz-version-id: ti0_iiw7PITtrft.AIEOPeRnP3ag2uRE
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: a8dcdf20-94b7-45e3-8d0e-4ba2f69e8764
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: a8dcdf20-94b7-45e3-8d0e-4ba2f69e8764
last-modified: Tue, 01 Aug 2023 10:17:49 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLFNg2m%2Bs0Tpv1%2B5ieqdrP%2BOq2PU3c7noMGfj4pDsV5%2BAiHkoqU7iVzjVzwYdyxmUasmpMsKc%2FKlOzo%2FKDzK%2FkSDHBuLR%2B12oDcRSgLtwJmsgJTcSClwzh5HP%2FrUSSXF04NrHy0qqm8uwWvvypRUV2jwLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5flz8
cf-ray: 7f2f9229ee8f2c23-FRA
x-amz-cf-id: kZzVjkieRBPqNACwyZY4MxnVaVB7vpzbMQ-LADvHCxPE-9KwTGdvog==

GET
H2 200 stickybar.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/ 4 KB
2 KB 117ms
107ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/stickybar.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: A1EP1F3CR54NCV7Q
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"424627ea38e47986af8095e0d67d40e2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683495051068
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: jgLYEQ4EOqvxpqZTyxVIjrm84TepXoQY
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 98
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Lc6djJd1ckKCs+aBHkYMonVKhz1sxjFxH09hsCTMR2phNMdXw4mGMkPvk2JbdJkNU/5N8So/Jf8=
x-evy-trace-route-configuration: listener_https/all
x-request-id: c02b97cd-1364-47d3-adbf-d1a8d022ecb1
last-modified: Sun, 07 May 2023 21:30:52 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UyAg%2BubCUgtuX%2BZ%2BmX6%2BnFQz3qbmc%2BmoizIcugwvFv7xN5reBe6L7piPCyDcy%2FXuKqDuubG%2B6BzkL9wVkp%2BZbQN9Q7XUyDmEudQvNp1S1Lf9GAQj7GMBCokrVn%2BfChWlZXMyyB9Rvpnn1bnI1twFXbOM0A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f9229feb42c23-FRA
x-amz-cf-id: KEtlFgYrqOgWJ2sF5vU80pJ-w4dWVS04qXJdWbPHx7UPpnFQmRj-_w==

GET
H2 200 site-menu.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/ 6 KB
2 KB 137ms
125ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1690214555806/Redesign_june_2019/Coded_Files/CSS/Components/site-menu.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: ZNCGH859ZJ43QA1Y
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
x-evy-trace-listener: listener_https
etag: W/"eb32609c5026ffac513b3e81d68d3ded"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1690214556506
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: GKLmHl3sCXmnSkwVBkhk10OG72nsj2BC
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 850b9dc4-e94f-44ab-8f9e-453a59548e6b
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 212
alt-svc: h3=":443"; ma=86400
x-amz-id-2: /RHDl8GKbOMBQsxfj8mZiFKJA25WzIa+5TvSVN7jHCsJ2bFGQJEVov6/9S/i2vvam53kcXHxbVo=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 850b9dc4-e94f-44ab-8f9e-453a59548e6b
last-modified: Mon, 24 Jul 2023 16:02:37 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B8PjfQL1xpQ2LRZeUiwy7QWBcfcASl79Y1kUGGQZHqQo9wwiVgcl1RCRS8FNWbvQ1%2BWSiufinv1WL3OE3YzfLLZm%2BSV1FGTNIUzp9m%2FWK7sjZ6JLUx%2FUanX4t2orybavRGil7hrHJr7ubeKX39uCHECAcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials: false
cf-ray: 7f2f9229feba2c23-FRA
x-amz-cf-id: PDTq2iw3fKj-4YIkxpy39-MMuABvHOd6G1A8JrEeVYXLht5g0YONTA==

GET
H2 200 micromodal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/ 4 KB
2 KB 118ms
107ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/micromodal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: X0MZZ3VAHYMRM4AN
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"20c2f66e9f10bed15056fd6b975b8a75"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866683533
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: e3VxwMWpNWQvL0ZQahFb1P28o.8Kjgu5
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 127
alt-svc: h3=":443"; ma=86400
x-amz-id-2: mbqgJtuVas50oTqyCGsbOqYtushYesY2mqKQNdYyVruQQuLJkpZzSg35g/mjgyJ1oA1VkzekAShJjMys96466izuZNswkdGNvnKLC4ICyWU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 514d4792-7ae5-483e-8ece-210e6c15c626
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1n0ETEOFzr%2BTYVTOdSF0Lcf2hUwQAOLIOepXjZree%2BgZ1zyxOfsU6Ory1iMCBo%2FL08GZE5YV3AjbjD89OScHUStXdbsuJN6BnLl8ayLg89FzEze4Y3UW9zBUPbe5lI5BJrfy%2Bna5XwcCAiYWCLJg2JKcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7f2f9229febb2c23-FRA
x-amz-cf-id: 7kPNoZp7o51u45TXIyQ2fYOajNpekOkVa78-2ZCWYOKWC1-gT6HhRg==

GET
H2 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/ 610 B
923 B 126ms
115ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 c396de17c1b5d58233088e40dd170cf4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 1379
x-amz-cf-pop: IAD66-C1
x-amz-request-id: 34BQ4QV3QXNH9GN9
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: n_rdB5Zjo6jQpLlilRmMi5fLWw35sgNj
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Gi9HLZ5qvdt9x4FvAlCBkKFXo5apTSP7dQzfjebVdutLdbksismMMM/e//aBHPhIxnAp16TD6es=
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"6b50e831aa1329ecfc246611e5b73e07"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KM1fl3D4grJU%2FbxGBRxO2pw1nAZ55NzjwoyFdlJIyfuRMWuMybnxP1pFqRjy8wrsKk6ZvCAtFE1xcFmONLUR9N4IXnpjACfh9wFqVtcBCyNMbE3x0IsHvyTuXvYvpswvmagQ6Ztx%2FkF7jK%2BAFgYnRCurtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922a0ebd2c23-FRA
x-amz-cf-id: q0P9ME2IN7JRj5lDQ4Ygf8TgexC6cUB9a7c7LfU6LbRfEoII9DxX1g==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 module_103636562700_Footer_Categories_Text_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/ 89 B
1 KB 119ms
108ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/module_103636562700_Footer_Categories_Text_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 7VDYX6YBDPYEPK88
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"0e24424bd7a91e1adc940105ffcd26d9"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1677161481432
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: S9Og3Ezj9hRyblXN9qKf01bBpHlkGn4t
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 176
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GCHdKb6pnWl1WMzThxaVjLEgaktKu4Dzwu/H97avc0A6/xZYrjMa3kbjx4cC4hY98fTdWtsEqO4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: ae72356c-c3d9-4835-8240-cc1e4f163bd0
last-modified: Thu, 23 Feb 2023 14:11:22 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bv3iOMSTzCXOu3BgSgsndwK2sMu9VUSuoP0kVMWgtDSGzmMXaTxiM2E1mk%2FArLJ87VnTeM2IllrwwdDMOZaeQLEza3PPj6MTQXTG8IrlLLKL0O%2F09v2LL%2F3c8cSsEecS2rGZpVSPl6a5KSBjwNYDd%2BkiSw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7f2f922a0ebe2c23-FRA
x-amz-cf-id: CImszaV4YIMSP4JFrvyBwfFpdiSyee4TfELHa435cwuv9_1HdjF1gA==

GET
H2 200 module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/ 135 B
974 B 137ms
126ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: BSHEJJ0J7M0Z406A
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"13b7e92cbbf8ac04eec1f7b100347115"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1666371595958
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kLOdiFo6YnWIpiP8BLnJdzSgnAZ9CfEh
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 144
alt-svc: h3=":443"; ma=86400
x-amz-id-2: evQ/5MYvkDYpn1vpTO6vk99GU3OCODvH8c3gILDmY4BxuA8xOL4mV8uqTZwUC3GMeEBC8it7H5I=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 19555df2-b004-43ab-b28e-f57dd55085df
last-modified: Fri, 21 Oct 2022 16:59:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iq6wrhG7tp8%2FREjj0%2Fi%2FUS7FIXBKKzlMrgU%2FKLPto5Vq1aXubKoxqfLIqFIoDYVC6m9K4L%2BwJ66ITqe6pWgTlLCMtzydE%2F%2Bsfy0Y%2B7%2BVfuyrIO7asR5qtGl%2BMvIb7fZUCi89dMcyhDeM7sLamqoJWt00TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials: false
cf-ray: 7f2f922a0ebf2c23-FRA
x-amz-cf-id: mP_hBHU0YmCXSC5F2Kax4PpVNlFgecwbWXeLqNDMvOQH0qvcDBxMbw==

GET
H2 200 module_36845096476_Blog_listing_card_grid.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/ 304 B
1 KB 127ms
116ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/module_36845096476_Blog_listing_card_grid.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 493BPZ3TQ3W0EMJR
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"bfd6c45ad0a0ed80b73460eea867fdb6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635695217
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 0cba74644cedf83bb6fb7dc90d8b0980.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: QEtrj8a5Jw.zNpvkZ3KAKAvL2xgpFoi3
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 112
alt-svc: h3=":443"; ma=86400
x-amz-id-2: MMxDYlGAKstu6xcv7FF1yOTH82QSEPxgsUHCfDREspFI3X/rVg/KSkoCdSqFHVVi7kUtUPPCOns=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 70a882f2-5814-44ee-a5ae-368b05624550
last-modified: Tue, 09 May 2023 12:34:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jeE9jJ03PpI6WrUPFkC%2FlwJTrp1vA4EGbtW8FPSEWkIug5PqWt%2BbLuuit8cr2rd6obG8%2BEgbSEDClXJPUwiTDqYsxo9v2UFyOwvG3lTHg1TmZUD0b1HF1IvGokbkYmbHpSpDDk%2F06yzZ4XUtVAoAvU%2BnxA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f922a0ec02c23-FRA
x-amz-cf-id: nFSROtreYfVNhvwYYd0UDd-5eq1Mmw_0_LvzBmqdiBlPGjVMp0yAdw==

GET
H2 200 module_80864562095_Sidebar_Categories_Blog_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/ 419 B
1007 B 169ms
160ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/module_80864562095_Sidebar_Categories_Blog_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: NAYX3P3QBFXSJ0XW
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"d7c0ecedc0f1ad068aa363dbf6f552be"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659712321004
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kytFTmhcx66YfyEHUvgGyzju7VPEYvXs
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Z9kOjStGIvTfaj8fcvCKu5QQ+/9/yXsNCNlkDg7YeIRxGZxM2Zuxkim0/blpoD8/cnIl5JAsKsE=
last-modified: Fri, 05 Aug 2022 15:12:02 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fYyk7VS7oda5%2B8aPiMca79GEFWZF2sbNbHApXKIhU89%2B8Jnxqd6wFEDumAg4jp50PQrnFvwuLfrW6y6cDbfnitCCEIzKb6pYx8fnIydqnYGNyd3WEDid2uyvOltUrCpDNs1kSVGPoRWowJfmVLJ9eHodNw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f922a1ed52c23-FRA
x-amz-cf-id: O86xJHE49-iPfxDzp58DEiqXVNoF2204Ahc8nNeaZbdHAGFJcCVWrQ==

GET
H2 200 module_80868056874_Sidebar_Social_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/ 298 B
1 KB 137ms
128ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/module_80868056874_Sidebar_Social_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 98NB269N0E5B3BGZ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"ea0c94f5b1324d7913f6a18ec1f3fe14"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659702739351
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 814e6200dbb5865e94b7b0c1ba6129fe.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: shmO1QlyhGMyDoImESYiUCU5phlmEXau
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 150
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lSaiJ+khQb0Samuok6dlEzLOoqMgHk31Tz8Q4h5JJv1Syr0xvdW/m2ogOiQeZHajxkcO74hExM3rZxDVwerTYQ==
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0c15f3d4-a7fa-4e9a-b20f-75858f20eab8
last-modified: Fri, 05 Aug 2022 12:32:20 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BTMsKs561JhvLqcjiKVyzAhYNcLIAw4Wvw3uqWt%2BreqBrLNXlIptBmMKHLzegO%2BZz6ISK%2FchSz%2BsYiRKSkEJJ%2FwsOR9WalcbErxARhKziNEz3PMXkDI8v%2BhUH2CT25d5U8zit3egoIdWtcQzSR53lPaMYg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-65b9b6b744-w6tv2
access-control-allow-credentials: false
cf-ray: 7f2f922a1ed72c23-FRA
x-amz-cf-id: cDzrLZi73IDvRd7UNZ0BJwSZ6N6ZAysj-LArATNoJ0XEeoV-Wa3MqA==

GET
H2 200 module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/ 620 B
1 KB 155ms
145ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: QBC7V12NZ78KQ3QK
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"058524ab080d84460f7e7c6d2ecb4d89"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659449374148
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 5d4199dbed922d7847172f5631f32dbc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: e1cZxYRKfUgD2rKmkLGGtFZUzq.7EtsO
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 144
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JqWlzxaBD5sLjdAkdFmK1hql5U9NrW5dZp1n2BFFnfMLFhbRVqi8gVfaP4l1SoH7KUbMEa39nGU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1b2490a2-9cdc-439e-8ad0-530c8d03b4ae
last-modified: Tue, 02 Aug 2022 14:09:35 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HRKJZ%2FwX4hZK6TQTyPvk2B7jMDkPkQlhCo5%2F7tPsK7mtAxn5WP855plxpHjs32F6tMcAXJ5dTtqE9uGAz5quGM%2FQGUed78smed%2F9DDd%2BcQSTv6iYaRIUaYlLZPj32Ve%2FFdifczFtZLzhKxaANs%2FpyVZW1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f922a1ed82c23-FRA
x-amz-cf-id: 4IReVkVOLhsMQP_1O6Gk1Mnw5PUItz3KDpagfdoT2Bn0nldLhBUfIA==

GET
H2 200 module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/ 581 B
1 KB 127ms
118ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: FP6W08Q1SC79GJCB
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"c2bccdea5694cead22c9370560abd5e0"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1670427753922
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 23ad05ed2873837fab42a69bc3e0703a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: wr_YakpyxY_udxaEA70Z09_FgvspAnTj
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: d5RsS7eB9D1BF9zW/j0idXwCrduC4kkI8NVgWHt62hOaMw/R177xE48gERBgsLPlwIqejJTpLKc=
last-modified: Wed, 07 Dec 2022 15:42:34 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EENyPxGIFNEKpU9KfuEHWf1nS9i0Y4c1Daw7yphLKKVZddvVPFsdNs7d6NHNiOc%2BodKyfBPr%2FZsFwIkxt5ul8uVIOtyboZ8W2nWgLxmapXlod1861e2TyJYMY16TkV9TupHGytKO3eW6qS0uio6d2y%2FyyA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f922a1eda2c23-FRA
x-amz-cf-id: mcRi_493LJ-rwFviy4DmgaMEyncVippcm2E8ofl6Gf2J65pqYWunFw==

GET
H2 200 module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/ 449 B
1 KB 167ms
158ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 1ZWPRY4T8RG5FBX9
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726402031
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 cbb1ad5df105c42cc24cca0b876989aa.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AQN4k9CjDjzeOb4WGe179iRQS2cuvN7I
x-amz-cf-pop: IAD89-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 141
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 6K0VBtV/5SlAb1taN90asHPq5fzkTfPUeUwGYp3puajuy/55zsup7qAFUEik9P06pIXqOUgK3CU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: e93c0ae3-371a-480d-bdd7-d9ba367323dd
last-modified: Wed, 10 May 2023 13:46:43 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bl8j1ljOQOy5iAIYZDqWU9VoNRQb5cfmietQwOTak7vcsgW4xk43D3po4pSWpNblVzOZA73wrxQHtu69WdWp%2BPrPk1%2FmVOVPYlxPgUbQDGF0SI0aIi4cSYl%2Fm%2B8cZcJX75hePFk4GRyIjMd7wQHUtuukjw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7f2f922a1edb2c23-FRA
x-amz-cf-id: 9dgnZP3qdfhNl2347Tf9JOdStAgqkgVNmkOEUlHCIzo6RRCCWsqbPQ==

GET
H2 200 module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/ 449 B
1 KB 152ms
144ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 0WSX39427J1AS112
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726382481
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 b64454e3c1123ac098282f1036154740.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kE2bMXeYWn_ktJqXj7KUhR8Fu5cHi1x4
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 135
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PW5+eWD9+xuuphm0jZbqbs12I5xghMcILTCbUgQxi2xPmBxVBs2q5a6cC6+jJLZGKMXQe6Tng7s=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bf630b5b-dfad-40fb-be66-6907bb0b9973
last-modified: Wed, 10 May 2023 13:46:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F3DuUA%2FU8Bs1lZzCWLuYMo4uyU3ukGU1jj%2FACbsXzbuNRFiEdCAI1a9aAb9TzuAHnUoq01PKbdVfBsg4Otbe%2FjhMoLQr9zDEQYJhHLf3nNUGvWeHZoC7w4MHTZbe%2BMBTNkLIrkz0eBrgLkeuaLrH1IsLkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f922a1edd2c23-FRA
x-amz-cf-id: uuvQbsRPHfQRoKUdPc9CdrHq4khVP5eIig2tHSi4wmDEv8XOJo5d4w==

GET
H2 200 module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/ 449 B
1 KB 145ms
137ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: FZ7AC83PSS98SKD7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683728917797
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: _NB7Ho2f9mjVTOSpgbcz46QGtgjcNPEf
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 134
alt-svc: h3=":443"; ma=86400
x-amz-id-2: VFqhNEo69Eom5zdF27L0BoBqLcEsNE+6NT4gvpsJwKDcqBUCspDQOL27i0/xPUFMy1z6BIDvln4JjkfAEwvByH5rewwErVDf7pCBZOvWyt4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 48b01650-ff18-4237-a242-538decc54d8d
last-modified: Wed, 10 May 2023 14:28:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ZH88yZdDwo07QvvS2UNJIaET7herKHr4%2BPZ22SjTvv02kT7JORaj9YuSUabZ9SMBKAHjvBM9MCzKaOuNW1KGKJfGb4MfLr16MWzX%2Fbe%2FadfeM%2FvtMr%2FD31cPJgjNQC2mrCXFkowP6QN4LXrVL4MGb0P1A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee02c23-FRA
x-amz-cf-id: ML-o27nR3DM5iAcRNOXPn07RaCZMoZxnkpdGul3CDRqf1SxiLLfAxg==

GET
H2 200 footer-redesign-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/ 1 KB
1 KB 154ms
146ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/footer-redesign-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 5630c5d6ce3870273aaf2ed5fe6c2f14.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 1379
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: NV61ACXT1YHN08RR
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: KkIg9v6XZx4VO697E4AlyOGL9YPPr5d0
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: tEhvO/Z5jRl+Gf8EuzGOOmKOn9cOdaiRccBmtJ/VrFNg4roXQ3cFQh6nR5wtRNJUZya2v3udXyI=
last-modified: Fri, 13 Aug 2021 14:58:02 GMT
server: cloudflare
etag: W/"74345f5a0d3875bb7f758b06d4778849"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866681235
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zUDNWw8bDJkKUfqqq8oNwhZmyCDv6E7DJ2bEjaTd2w%2FQciKuTaMDuN4K%2Fg3E%2FNliEDBupJHS8SD6j7JUBHx1a7vxY1WDg1Or0MNYH4pF1tneD27jXrQoJSI%2FYyz74aOmNocYfdljqiUinFejS15psVZipA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee12c23-FRA
x-amz-cf-id: pJ6h0ARVRLTcUJOqbsjXUqt8C_VpyquXBUDxD3z29ygnstfmNmz1fw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/ 126 B
1022 B 159ms
152ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 7X42C64NHK6DKKZ6
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: PENDING
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"d5024537c90d258c2752af5a17a95367"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1684325396009
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ojCcsa3Hbm8KsKBjYnw5U.TUyefQWjmM
x-amz-cf-pop: IAD12-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 121
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jViwf9FZMI3kLz81OlMSSEAWGIfG1h+N5HMjut2XqQyD4f6sd57vNh+/LOTvlzEnwFAGwQi7P7Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 99334791-2074-4d1b-b287-4a3c755b37a1
last-modified: Wed, 17 May 2023 12:09:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=InnAU6TjWs9D04rUJcHNg%2B8kAdNRr6x%2F7Ls9z4FOO82%2FLOsmAQB83Tft2O4OuenCsMTqX%2BGI3Z5Pa%2BufZxOeUOvWRumjrgwJJU5PnJICyPprzbEaqhHgkDtDeNonEm4jy47nv0F1lwNClUsY0qjW2pA2YA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee22c23-FRA
x-amz-cf-id: McaJ-7R67LJK9XZmYCQNRIwGIRwHpUu9pqoObAk1pDUcS76W5xy71w==

GET
H2 200 Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/ 143 KB
25 KB 167ms
159ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 9BY06TDA00GEHJTS
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"3d0f457bdc611022c3f48f57eb877977"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1685359417818
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 6400936fc4525d1c60e3e8fee9d4806e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 139
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 87030c20-b4df-4c9a-a844-9982d6c02ddf
last-modified: Mon, 29 May 2023 11:23:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nYcK%2B28SMZcxl6tOmX%2B9LIFp%2BEmFn7CnV2gAft%2FSHzSnoP76lt2Ne10gl7CmU3BrIjDndiw0JgP8pJMJViX8ZKXXqmM3Ak64U87NkgwxA5sBOHEpSSkjUJr9EWuDGUGpwt2IgwRfdM1qKWSWGDJCojDgEA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-9xkdz
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee42c23-FRA
x-amz-cf-id: EfnvyHcxkM0r5MgmZNSmpahxHbS44buGtkHilNHaDyIqxvzzMKUqGQ==

GET
H2 200 v4.js Show response
play.vidyard.com/embed/ 70 KB
23 KB 100ms
28ms Script
application/javascript 151.101.129.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/embed/v4.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.181 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits: 7
date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 2659
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 23020
x-served-by: cache-fra-eddf8230071-FRA
x-china: 0
last-modified: Mon, 19 Jun 2023 19:37:16 GMT
etag: "4e2f211a0d5f0f0e82bcf94c1f18d11d"
vary: X-China, accept-language, Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 136ms
43ms Script
text/javascript 2a02:26f0:480:f::213:7ecb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ecb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Play /

Resource Hash

6ff2cb75e9629684295d538513cddd941b0bfa7072cd3c6536e6905f6fe921ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn-client-ip-version: IPV6
server: Play
x-li-pop: prod-lor1-x
x-cdn: AKAM
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
x-li-fabric: prod-lor1
cache-control: public, max-age=3600
x-li-proto: http/1.1
content-length: 163643
x-li-uuid: AAYCU84N3oPvKyvJ1Jkb2Q==
expires: Mon, 7 Aug 2023 12:47:02 GMT

GET
H2 200 layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/ 4 KB
2 KB 136ms
69ms Stylesheet
text/css 2606:4700::6812:d0c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1691156845456/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d0c9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 254944
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
x-evy-trace-listener: listener_https
etag: W/"94daf62e7e6df83595c6251fb0c7c055"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1691156846066
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 360d3742-4e44-4d59-b9be-9c67e2e8f82b
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 172
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 360d3742-4e44-4d59-b9be-9c67e2e8f82b
last-modified: Fri, 04 Aug 2023 13:47:27 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kBRHCNmSGJnYhNXBsTILz49kAc1fJB9Xs1oh3%2F5V68lOkVl1G300R%2BbxhnHU0t8MdjxtdLYliJxPFnSl9cHLHZO8iJHkn6MdzD2cDYyFoT8QS%2B7rEx5yxuTlY4p%2F00mNOFzjal5ouAnYQ3ZwjHA%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-8dfbb9f7c-hml5r
cf-ray: 7f2f922a6ead90fe-FRA

GET
H2 200 RL-custom.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/ 12 KB
4 KB 129ms
123ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: KJVA3T8C05FQVQS7
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
etag: W/"87c5bc53e5805378faf6e71727ae7d28"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659964888595
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 b26814b9dbe71dc1916d211eeeec7ffc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: rddr3nP1mNXXwP_ajL22vN12Zg.dfVCT
x-amz-cf-pop: IAD66-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: gpmzJCgpTSh4b1cjRilAWftYbKF5XvB8RyVHN6J3sZGErlMWfrZgyIRbc4NHtVdmuqCH01lEb8g=
last-modified: Mon, 08 Aug 2022 13:21:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dQbGrRcfPRV%2BBg0IuvyftHmKNjrjEQyZsi0taqynILqCaar1iroI6huXU%2BQenXZoSrgA39OsVhnStEGgdeIbwKbYVFdtaQg%2BlkahV6C4KGrt%2BSY0AnVTEYx8FY%2BjylNLmDeSlBhvWfixHYLFoW28Ayw6Ew%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee62c23-FRA
x-amz-cf-id: L7nUqmBM3vzVBbHSBaHxkUde8H6REBKBG6fxxINo6GPLeDvt5P2lcw==

GET
H2 200 site-redesign-june-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/ 11 KB
4 KB 178ms
172ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1689162268961/Redesign_june_2019/Coded_Files/CSS/Modules/site-redesign-june-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: C67VNPFCGTB66AF7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"a6b54e2468e63ef91aa2333794289d8a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1689162269645
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: cM9nJ1gR34B3YQ2cLQTyj7pejlMLYf.6
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: 1474e339-698f-4678-ac49-46d176a69129
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 117
alt-svc: h3=":443"; ma=86400
x-amz-id-2: X7RU/r2YFdcytCOlgM3h5/PV30HyOohS2Xaa5t4y75gPm8QMm1r2rhFCkhlXSZA0DcGrag1V4Rt9F5pg0FstSq+Yz90fCNIJHulrHuua1/Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1474e339-698f-4678-ac49-46d176a69129
last-modified: Wed, 12 Jul 2023 11:44:30 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TTtJeJD6xmYNhlxD7ZpsaQZHKEixMCgknroFP4d%2B3ZUbVrxXQAlvHqvE%2Bxl1jGVaohIrmWuC%2B7vpQbafZpz8eKQ0cOTJ2Zmr1DleyMFfq57KVWQoV1xyIPSiq3SBdRI6%2B7a9%2BFfCTA%2B33y37PtjxtM1knA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-fhfns
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee72c23-FRA
x-amz-cf-id: V1blr6uorwDl5n385W2TrhgZrQ1kZSwtT96BG6jm5T3ARQRqDRqRzw==

GET
H2 200 blog.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/ 3 KB
2 KB 128ms
122ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/blog.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 68fbda872a4e92e0774a97bdd960d43a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 1379
x-amz-cf-pop: IAD55-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: PVBQ3EHJNVZ3DH5B
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: Mz.2Pn4CEDs4ZaIeZ_NrZ0_ijfcT5uxW
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: AdFAJyDDt47mtRTm+i+5mhvXqYtw9R4oSCKHdYAWd98hoxhiv0ezOVUN1dsAJIxIAcj89A31sb0=
last-modified: Fri, 13 Aug 2021 14:58:03 GMT
server: cloudflare
etag: W/"86cceae70fe2cace0184968b3abea7a2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866682656
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QvpJLziuIAZ85S03KtcGR%2F3XMbgDtk5gFxftL%2BuMK%2FdbfMUJc1efq5foK8VKnB7Mmjmeu2Ik9fF1O67ZRLP3ZA%2FDK2CVCmx72PZc55ikEZKlw%2FYIwW5Q9F3lUtcLwxvWXvxTKEShYrB2mJ6JJXdx%2FZcAgA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee82c23-FRA
x-amz-cf-id: ndNi6dzlnwd484cxdvYO2SvfsrFDtE_lpva3vv_rbCYqMwWHz0nWIQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 conversing.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/ 2 KB
2 KB 154ms
149ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/conversing.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: 4X4KE2A77T7GV93R
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"03194bf820a8d747a9c4e33f60a3d8a6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1671120025512
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ezK3yCXod3kovn6QNb0kvlsgyxcpZGDT
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 205
alt-svc: h3=":443"; ma=86400
x-amz-id-2: WbiFu+Pmdufe/JxFuH40A5TiF3ZYLyRL73/W8tmu/416yW4BIZt8vEiPqVM5SfWwBWMrTfuxih4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 588f4faa-b737-4d98-ba47-e71e1d915d41
last-modified: Thu, 15 Dec 2022 16:00:26 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LAbQtFYPZJXLWuAFrnxdffl29l0%2B3JoJa0FMmA9YlRMx6odNktWZHZu4T4dlvJijf6%2BvbR7GjWvZOVoOKelO2EQAwJstZcHOUZmraE%2BKTJ7tEnj4XC7vxu6GbDbI9f96t7n01azuDS%2FetWeD2IN3jtQm%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f922a1ee92c23-FRA
x-amz-cf-id: _0ag2daQDENsXog6Nz7dkHxSkOGz5r1WzcD2N3KkZzhtquiCk1X-rA==

GET
H2 200 simplelightbox.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/ 5 KB
2 KB 164ms
158ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/simplelightbox.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 1379
x-amz-cf-pop: IAD89-P1
x-amz-request-id: WPZ5SBN1S7NMVMA1
content-encoding: br
x-cache: Miss from cloudfront
x-amz-version-id: Y9o3twj1TmNPLtARM7I8GKUA.atzxWnP
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: kQyRDAImdosMo8wT8pgKTpv7tWbjbnIkXjGbn4j9nsZUhG0EF/sM/OJZstvG9qmgqxLzf3lLMBE=
last-modified: Mon, 30 Sep 2019 10:48:14 GMT
server: cloudflare
etag: W/"9c259f55b65931c5838c0f7cd5f58f93"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1NFfKURS5y4Kqd%2FwH71%2Flnr7tRcHNT6%2BcAH3qY9BPrHAZORNZzzW34%2FLWZryLT2HrL8NArmONM8YBogtR5gaAKHW%2B7DXUcF8ZWz3dIJb0pb5xLoqxmaRhmSW2Jj3sZ2qv6mutOmxf%2B%2FWPL%2BYlnnp6%2Byj9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922a1eea2c23-FRA
x-amz-cf-id: uo8Gv5YQe4kY1BmDhHk-1_ZCQKnflPaEaQ6XLBDp_kRV3VECkDNowg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 tag-list.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/ 834 B
2 KB 124ms
119ms Stylesheet
text/css 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/tag-list.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1379
x-amz-request-id: S1VHDE6JGXN3JXYD
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"d0f8005c0d02f9ea2078b355ed1700b3"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1657723425746
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:26 GMT
strict-transport-security: max-age=31536000
via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: R3vEp_hu.nAXB21yRaHK818uFUl.x7KV
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 190
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 3Dq1Y2qMlgqiNtUVPL+65uXwWaBj4LnCuua8ormEk2DaBBMdFN+obyTt20r73uGpQFRUYJGrsRY=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 9344baa5-4d72-4c73-89e9-139165f9e066
last-modified: Wed, 13 Jul 2022 14:43:46 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=phVxlOAT9eRrAiKnnPBF7g%2BfiJCgUcIA0CnnwnbK0gaMy%2FtXn8CXojTXsMU4ge1cYMUrn4QhJyp5zAMZwzpS%2BzPha1S%2FONEcOORllsFfdSdoqAvH9D2SQT7IgC8Bihbi%2BgeGSLrNDmSoUfgLbBJW25qGIw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7f2f922a1eed2c23-FRA
x-amz-cf-id: 7so4MjhNU6xCo58yEsTXXU4nuSlEep72vC1wUeufDIK20QWXU-AFSg==

GET
H3 200 rl-com-logo.svg
www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/ 3 KB
2 KB 148ms
143ms Image
image/svg+xml 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/rl-com-logo.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 5482351e8bcb93be701264b475dd3018.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
content-security-policy: upgrade-insecure-requests
age: 245946
x-amz-cf-pop: TLV50-C2
x-amz-request-id: Y6Z201APYHMBA3GA
content-encoding: br
edge-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
x-amz-version-id: BUsncvg3SahbgModZfK7dQUIXXLSPFen
x-cache: RefreshHit from cloudfront
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
alt-svc: h3=":443"; ma=86400
x-amz-id-2: p0oZJA2psZII0vVkNybjTB90mgmD1w98My7yJzLiT8xjn8nwBy8SRTbJrguIn8qJiLZCD/gnqw8=
last-modified: Wed, 14 Nov 2018 07:33:54 GMT
server: cloudflare
etag: W/"86ace497147ac2cd02198f3cde44219e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6rWM79VgMm5YifzZSFHD5Dox65sxnr6ClIZcyflH4RUfSt7Wf9%2BMx1tLiQZ%2BGoUGYxvrvKS07qbvY8dncwZYRg2OBEvXvzKy8E7CbplvemD9t%2FK%2FNlbbs1un6oH%2B3Nnb54pct3NldHOmFS81aWSOTCr2eQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922b6fa803e0-FRA
x-amz-cf-id: IlRcYPKT2bRGXPlHnZtwsOVZlSJnA8Ls71xLpYhnldN-d1f_WzEwmQ==
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2

GET
H3 200 karlo_zanki.jpg
www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/ 18 KB
19 KB 177ms
173ms Image
image/jpeg 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/karlo_zanki.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
age: 18670
x-amz-request-id: WSG7FZZ2JEVRK8N0
edge-cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "c40419dee622f0738b5c1f8a5152db50"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 4b69099d64ffa1fbe8adbe1235065a14.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: lfcykLsw0R1YXz10xZ03n4UPI8BPc.OS
x-amz-cf-pop: FRA56-P7
cf-polished: degrade=85, origSize=90381, status=webp_bigger
x-cache: Miss from cloudfront
cache-tag: F-24367560330,FD-8444884887,P-3375217,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 18276
x-amz-id-2: QPNfnTDW/siWySsEvDK8LpdLCArdASfuKI5mdU9WUPCgtlNIwaAFTcm55NHLg+YKu+YG5IVXi7g=
last-modified: Tue, 14 Jan 2020 16:45:17 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a5dxFtkaFUYDUvRa5IZf8UHeIgSfced3AiRYO6qP0ZZC9%2B2V9BGCmRwcaFpnny5or5Q5qHxpqE5kXUQi3j%2BHOMrKGZPE%2Ba53YRR459pENvMPW0g5bJC1spgd6ZIkp7sPWN7ywlaXDKhd31ysifmih1HGow%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f922b6faa03e0-FRA
x-amz-cf-id: 5s5r65dIwevslvm19nxpcd7p8vVy5I_BMAX07bX2GHQxk4oB1ZqGyg==

GET
H3 200 vmconnect-blog-figure1-behaviors.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 52 KB
53 KB 148ms
143ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure1-behaviors.png?width=1455&name=vmconnect-blog-figure1-behaviors.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372092758,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 53054
cf-resized: internal=ok/m q=0 n=928+0 c=1+33 v=2023.7.3 l=53054
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfufej3QaZimVEgmG-b-ZxJre5GKd00Nl93VqLII45DQ:a0a8e391d1e908289a78165d747c52a3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZleMT%2BWRTw52eQ%2FmsW0gqb%2FJZje4eTo%2FbhYJWnOCGnCMYQkkhtgoGFTZidGY9sFfuZz9tKvCkci61%2BK%2BS0tg36FhnJdeJq9Wt0Dy%2FBMB21EPZy%2BLloLPILLiG7iSo4CfKKMh5oEqYveWhq%2FyeYA9A1qzFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fab03e0-FRA

GET
H3 200 vmconnect-blog-figure2-init.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 22 KB
23 KB 211ms
206ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure2-init.png?width=1455&name=vmconnect-blog-figure2-init.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 ade5b31bd02630f0b5fc77309a9d7038.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372335896,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 22832
cf-resized: internal=ok/m q=0 n=704+139 c=0+0 v=2023.7.3 l=22832
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfFt2DVxVAwJfmRRxOIQy60dx2GKd00Nl93VqLII45DQ:7da2d727a22e07f170b074d37a6a926e"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fyvC8QDnx1UDFxpQVF23%2BtIfQJtkSkgfKb7ZKj1JNpWz4p7j78k05kQ9gGoZOmAhbgBRN6fUmcz9A8tH76%2B5Ft7z2CMOLKOH4%2FzWve9jkdARznFb5sU4yuGFUPDQQEVZTX9Vya90moekAp7poC2aAczcrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fac03e0-FRA

GET
H3 200 vmconnect-blog-figure4-loop.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 17 KB
18 KB 212ms
208ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure4-loop.png?width=1455&name=vmconnect-blog-figure4-loop.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 62e7b24ca032b612bb93fa7f3437469c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128374422914,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 17238
cf-resized: internal=ok/h q=0 n=38+104 c=0+0 v=2023.7.3 l=17238
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf_SALb2FHaXCWedM222ZRwjYzGKd00Nl93VqLII45DQ:9d3990287e545845bf5381744ab07eff"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Im9WhMzzFjtMIxTKDMX4w13IfyYFQL5aAS9cua3XdmNEZYcxl%2Bs9jHGt8RU73Mh23q56D%2FOJbwDJjVHC64a%2FpyGl19Caub2pteRkM7xniZ%2B1jzIdKcxiNIQKsmPwWKXlE6PnLQQUKUtVOLTOg654Djap2g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fad03e0-FRA

GET
H3 200 vmconnect-blog-figure5-PyPI_author.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 41 KB
42 KB 213ms
208ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure5-PyPI_author.png?width=1455&name=vmconnect-blog-figure5-PyPI_author.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 fde85e7daa13f95cf6b8f5fa09c62ef6.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128341467472,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 42454
cf-resized: internal=ok/m q=0 n=845+0 c=2+150 v=2023.7.3 l=42454
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf4eAidWT4Kfyr0376G4LYBTEkGKd00Nl93VqLII45DQ:dfca138c459dd0bde26f427b54882fb0"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TG%2BjiNJsY16eG%2BgGQsnpPYIRCYm3maovzjxaqOlQgpRUB42zuGAGxPHhuRn6CEnJqoW5ZWTLDwzefnCwx4iqy1kjGThvJ6gdaJsH6nU6kvhsThd%2FKMmzQ2bZUvn%2FIpk1cqRs9Pnjotcm6Fz%2BTocm05McCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fae03e0-FRA

GET
H3 200 vmconnect-blog-figure6-PyPI_project.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 186 KB
186 KB 243ms
238ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure6-PyPI_project.png?width=1455&name=vmconnect-blog-figure6-PyPI_project.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 d76db2cbee553c8bb2de7fd88a960646.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128374414403,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 189956
cf-resized: internal=ok/h q=0 n=14+103 c=0+0 v=2023.7.3 l=189956
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfFfRcqUYlcTr9pFJWgfYd3pdbGKd00Nl93VqLII45DQ:1cfbe751e2673baa5ce60b4c41060984"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yu1LKV%2FFrTQOhsRs3MPKyh4Lew6883n7%2FBNfoVCjPJCZaO06KEdPLAHWZZygKRIU%2FdSyYI6y%2FfzwkS12if5gtyX2pGWTsppWnG%2FtTXVRhkcamn5948Bm3VRaR4chNyDdLKPscUq1pzs9iYc7wJu6NRDTlg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6faf03e0-FRA

GET
H3 200 vmconnect-blog-figure7-husky_github.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 40 KB
41 KB 274ms
269ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure7-husky_github.png?width=1455&name=vmconnect-blog-figure7-husky_github.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372092759,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 40814
cf-resized: internal=ok/h q=0 n=35+0 c=4+116 v=2023.7.3 l=40814
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cf6mRjUQKEMCNe1MHl4G6669OlGKd00Nl93VqLII45DQ:65453383a0255d7d93786baa4e8ea55e"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3fNS9nRHV58ZZT00JutA4QN%2BGQgPCG94ifgfN%2B3IaT31Gi%2B4rjcbQCuVKiqqkjLja2ETkj0H4ufw1oknGuoiKKls%2BrojgRGCQLD7U95r7CaHd%2FN5k%2B1iN%2FfYFbtFHe3N%2BkcspAuvsPQVn%2FII2slnbUEBjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb003e0-FRA

GET
H3 200 vmconnect-blog-figure8-init_gihub.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 21 KB
21 KB 275ms
271ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure8-init_gihub.png?width=1455&name=vmconnect-blog-figure8-init_gihub.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128373652739,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 21010
cf-resized: internal=ok/h q=0 n=14+158 c=0+0 v=2023.7.3 l=21010
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfs-ifkdVbVAVeuQWW3EQdNzUMGKd00Nl93VqLII45DQ:cbfb25e399f643ee0577249514d1bb1a"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7rk7uSWmvAXScWDEIeDLpXPSUjtTrb%2BDPUsYBjSHcbb2cRuBPstl0VjNqKVdvfaLo%2BZ2teRNkes%2BVsdwFz3DrITJ3zwYhoWvt1nkurdEkWc%2FSDVIi7kfOXW1vhzU4HM9bMgxmkY2eu8e5ERBF3LvYeLC%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb103e0-FRA

GET
H3 200 vmconnect-blog-figure9-VMConnect.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 161 KB
162 KB 276ms
271ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure9-VMConnect.png?width=1455&name=vmconnect-blog-figure9-VMConnect.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a0b7683a1d33d6d186965e831f2de96.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372335897,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 165108
cf-resized: internal=ok/h q=0 n=23+107 c=0+0 v=2023.7.3 l=165108
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfDtEuFLyHnqiI5u-mEeIjwAyrGKd00Nl93VqLII45DQ:b7c5d069ae16571551aedfc140d1cd44"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SCmk7rPfaW8JYP9OHl2UlsvZa3kMW5mkvu9IbuhFM0wEv20qRRlCe%2BlN9k3%2FpBum%2Bz8f812jRFWJKXhOst5S8SuOo5wC21wAsJqTp43SyXCAcTGZqS%2BC1fO2d57NnBJ6MMG8IlSOXoeTCGtFiKAiCMg4Xg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb303e0-FRA

GET
H3 200 vmconnect-blog-figure10-vconnector.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 169 KB
170 KB 284ms
280ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure10-vconnector.png?width=1455&name=vmconnect-blog-figure10-vconnector.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128371840411,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 173076
cf-resized: internal=ok/m q=0 n=848+93 c=0+0 v=2023.7.3 l=173076
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cftFp7EBIUJYCcv0x9uuWvalXcGKd00Nl93VqLII45DQ:a3fd118096a03f915ee02d3e659ce71b"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72gCaBIvAGL98DHYZMdaClIsbbVqC2DcKXxZvCL4hCP5FB7baDE3jg0ITHCaYkJgqbp9nsEdT5WDouw8oi1TdqO6yxHxfSkLDx0DwTFasNrcnRglujePVY6WiXXFDu7Vy8iS0IFvnXOFMttK5rYznIg%2FLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb403e0-FRA

GET
H2 200 must-see-sessions-black-hat-2023.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 38 KB
38 KB 155ms
89ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/must-see-sessions-black-hat-2023.jpg?width=480&name=must-see-sessions-black-hat-2023.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-128445232020,P-3375217,FLS-ALL
content-length: 38412
cf-resized: internal=ok/m q=0 n=188+0 c=11+33 v=2023.7.3 l=38412
last-modified: Fri, 04 Aug 2023 17:26:35 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfYumcyN5h7tB9G9kNrISFMtgNzQG3Dz_JuxJXtzypDQ:c2dafc0f4f9381d2204a0799a5f235ec"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922bd8d1037c-FRA

GET
H2 200 Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 21 KB
21 KB 185ms
119ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png?width=480&name=Join-us-at-Bsides%2c-Black-Hat%2c-Def-on.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 776fbf9a4fc4b393f157f9f75dd29a06.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-125626784020,P-3375217,FLS-ALL
content-length: 21380
cf-resized: internal=ok/m q=0 n=350+0 c=6+33 v=2023.7.3 l=21380
last-modified: Thu, 20 Jul 2023 15:32:15 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfKQAtJ6vhYxPAvRVg0GlPAx7QzQG3Dz_JuxJXtzypDQ:b0ec1614a8085e5cb245b7a0f678054a"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922bd8d3037c-FRA

GET
H2 200 air-gap-remote-access-kaspersky.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 44 KB
45 KB 165ms
98ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/air-gap-remote-access-kaspersky.jpg?width=480&name=air-gap-remote-access-kaspersky.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 afd822e99baebd9321fa9aa8f9350e78.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-128135521287,P-3375217,FLS-ALL
content-length: 45536
cf-resized: internal=ok/m q=0 n=210+0 c=11+34 v=2023.7.3 l=45536
last-modified: Thu, 03 Aug 2023 12:49:14 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfKtefQyCYdAtrcIkKJuwm6qaCzQG3Dz_JuxJXtzypDQ:24f11135095e0a03c427cb44e068bda0"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922bd8d5037c-FRA

GET
H3 200 tag.svg
www.reversinglabs.com/hubfs/ 946 B
2 KB 307ms
303ms Image
image/svg+xml 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/tag.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-79211394341,P-3375217,FLS-ALL
age: 45618
x-amz-request-id: 0XDSVNE2B83C562W
x-amz-server-side-encryption: AES256
edge-cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
etag: W/"27594f47645e4d58406fd3cf3d07e0a2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1657811796583
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: aRYhGFr8YswkXmWbJnGhRE6TAiUwxgKw
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: z0FRfJepn9IqVGr/cHlDTnx989NcGHKwJV86KJB8JQZ0e2uKXRcgqujtsoROH6zymHEeL8iKop0=
last-modified: Thu, 14 Jul 2022 15:16:37 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QQePpgw6dMgz4o%2B7RfwTToUn311L3Pj0A9wTDQJ8FYHuW27%2FY%2FwTSNV2i9TKKKCOxhU5%2F99UcRbPtU9vKmwPpMqHIdDFZ7QRhRemWHKGf9xEgro0vsUgGHT7zO%2Bt9IqacNxvqvUoo3jt8dyhf0ENyZhXBA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f922b6fb603e0-FRA
x-amz-cf-id: Ds8PhE1IbTN0tVM5gFNTGE3WS52aXsbxiRmMm_OVQAcDLGGma4S85Q==

GET
H3 200 puzzle.png
www.reversinglabs.com/hs-fs/hubfs/images/ 190 B
1013 B 308ms
304ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/puzzle.png?width=24&name=puzzle.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 f1a22cc8d842b0950e4bd5bda60806f2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80971515058,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 190
cf-resized: internal=ok/m q=0 n=837+0 c=0+0 v=2023.7.3 l=190
last-modified: Wed, 03 Aug 2022 11:16:38 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfTEUp8Ew9ax83YU-aC7YLXg9u1csUNuQbJ8Ycnj_pDQ:e388a2e47cf27a736b1d0bbd369fa3d1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Y2HV7zyGW2v%2B6YXkOGs%2BgbiUf0rvBqliIbI4tvHbKZ9yP4aVX3luwS%2FDvr0gCmSX9iBuEeQfnjaOSNM4TC7TAwsrZbMcjytR4BCZlIZJ9glHTR4kMClenW%2FZ8g8oEcVwhwx0k%2BiybbIpPh%2Btqp%2Bt%2BLehw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb703e0-FRA

GET
H3 200 tag-dev-devsec-ops.png
www.reversinglabs.com/hs-fs/hubfs/images/ 170 B
987 B 308ms
304ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/tag-dev-devsec-ops.png?width=24&name=tag-dev-devsec-ops.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 5cf1e5a040860c85477a2471f3114b6a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-85478930439,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 170
cf-resized: internal=ok/m q=0 n=730+0 c=0+0 v=2023.7.3 l=170
last-modified: Tue, 20 Sep 2022 12:31:04 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfv7c03z3Ffq_nGeIA5yKSc4mh1csUNuQbJ8Ycnj_pDQ:9183b185622ef93c463aaa428f1f5ec1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NrSW9QXHT6QK%2F4LDgkvHragduArhyvWl5q%2Fzy7j9B%2BqAnxxvNcmu6uPrOSfrUXoIgDOeOWKDZvNSTrlrvakt4ScJ0vqOJE5fVfMhhKd3pSm1Zqx2C5X2hOXb6LvCoJEalYO%2Bf1skIQPMXyf5EoXteLxBtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fb803e0-FRA

GET
H3 200 ico-threat-research.png
www.reversinglabs.com/hs-fs/hubfs/images/ 292 B
1 KB 309ms
304ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/ico-threat-research.png?width=24&name=ico-threat-research.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 729d37e21e9ea52922700604dfdaf082.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80135253149,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 292
cf-resized: internal=ok/h q=0 n=26+0 c=0+0 v=2023.7.3 l=292
last-modified: Mon, 25 Jul 2022 15:07:22 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfUSLvJ4c4Cy57IRZiA1hwxqgf1csUNuQbJ8Ycnj_pDQ:e7151140ece53d72171148a7324d4b11"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T9vTLLqF1XB82U4kaYsm18EmM%2Be%2BxLA%2BSL5L9FZPNUs1x196CkahJ%2FKoqdxGqsBiHhKGjzT0S5Gw3%2BeYU8yvdYFU%2FzwFGy2CZMplIAcSIxOe9eu5FxP%2BY2FL81tY4zGyR2P2dCRuSPXhDvuRPejnyzNU4g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fba03e0-FRA

GET
H3 200 alarm.png
www.reversinglabs.com/hs-fs/hubfs/images/ 224 B
1 KB 309ms
305ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/alarm.png?width=24&name=alarm.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517010,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 224
cf-resized: internal=ok/m q=0 n=569+0 c=0+0 v=2023.7.3 l=224
last-modified: Wed, 03 Aug 2022 11:17:23 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf8LPChb5JPnuX8S6grriML_Pq1csUNuQbJ8Ycnj_pDQ:e129885aca10039ee2de1413175bc2d5"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ePNOwJRMABRs4kkzmIE0Pxx82McQJmRkk9WEUf22z8fU2cbZS4jen7Yz4idkGB35fNve9HUkvKsUNEUf9X%2Bgsh2cvy8sNzjQnya%2F%2BKfrT7JokglhjVQ24lxkot0hJ%2BbDqP9enh5sjOluQ1qFoIvdxf1KOg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fbb03e0-FRA

GET
H3 200 terminal.png
www.reversinglabs.com/hs-fs/hubfs/images/ 198 B
1019 B 309ms
305ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/terminal.png?width=24&name=terminal.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 6fa25eadb94abd73b5efc56a89b2d828.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80972444337,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 198
cf-resized: internal=ok/m q=0 n=685+0 c=0+0 v=2023.7.3 l=198
last-modified: Wed, 03 Aug 2022 11:18:30 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf6bMIImIWOdGtWqvTkruXE1Mt1csUNuQbJ8Ycnj_pDQ:df29f53ad31749ce8ebed7c59dfda5a3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RX9IqJkCATu2Dfql0H6JW%2FNCiAhoPnI8gr5r0rG1kEpdmKOaHaA0UMuDxg7Gv89iNO8ncDcF%2FcbUIx8Un4M1H76VXndepFEpUs%2FwZ%2FBVQqumKmwT22Fm3nBzayT2KPQRuqnGw%2F%2FRfZvdKvno9qSzGFpawA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fbd03e0-FRA

GET
H3 200 calendar-three.png
www.reversinglabs.com/hs-fs/hubfs/images/ 222 B
1 KB 309ms
305ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/calendar-three.png?width=24&name=calendar-three.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 ebc2f999559db1a05f6ebf1e799bb574.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517087,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 222
cf-resized: internal=ok/h q=0 n=57+0 c=0+0 v=2023.7.3 l=222
last-modified: Wed, 03 Aug 2022 11:19:08 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfSCUVVewrbUrCezSPDCvLRaq61csUNuQbJ8Ycnj_pDQ:18503effdeb9c9bf3130e4d9c19e5f39"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2DL2tSx%2FsDOWdMewFJIYB3jaRITVQLfWNnb1Mb7WIFqqcU%2BtobTOP9yKCcAa1RKhw3oZ4HxnizIQf3WNJmLQ1R69Ox1de%2FZwpMqYGFkkRvTHck%2FJiim75%2BJDaqWWl8B81%2BOS1zYs%2B9sOTl%2F%2F9Gs5XaHLGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922b6fbf03e0-FRA

GET
H3 200 ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg
www.reversinglabs.com/hubfs/ConversingLabs/ 126 KB
128 KB 310ms
305ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/ConversingLabs/ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
age: 45620
x-amz-request-id: 0PAPW9M00MDEWSJN
x-amz-server-side-encryption: AES256
edge-cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="ConversingLabs-S4E10-Creating-the-Standard-for-Supply-Chain-Risk.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "8edb1e262542561f086a7d70308044f2"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1686228293352
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: dPT6TZvb.kLAJ9gmDvqn5Ei_fgYVy3Sm
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=252204
x-cache: RefreshHit from cloudfront
cache-tag: F-119368537456,FD-69168798251,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 129440
x-amz-id-2: AwupxXKdSxS8jFo/wDXy7IwlIgJhJcgqlynQ33d/ZUAta8GWkxPadqNtWZH+Lm906HQaQvpCDOdgSQ48hbdFsjtrxafpG4MJ82E8akVO2II=
last-modified: Thu, 08 Jun 2023 12:44:54 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Izv4FYCO%2F2GNoOB4bFu4WujcZSyJRYtmZ7c7Z9eIsUb9P0nrIZPEGaHl4Q7B%2FyilclRbPNfvAdMFtjV8rradMrhXYSg8X4W2jD8fCaDYpIMR6cQqx5%2FLw0e07dhsxkn5ja3UAgBB3BYW1AVbwVlBT5eCTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f922b6fc203e0-FRA
x-amz-cf-id: imAp0nZ6xxYh9GkGUWPqSe3DgJ5lxwBHSpTqYVXEadPqqfLzBDLDXg==

GET
H3 200 SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png
www.reversinglabs.com/hubfs/ 458 KB
459 KB 378ms
374ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-128054183304,P-3375217,FLS-ALL
age: 213527
x-amz-request-id: CYC9KF0CVAQ1P9T5
x-amz-server-side-encryption: AES256
edge-cache-tag: F-128054183304,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="SSCS%20Vulns%20vs%20Malware%20v2%20%281%29.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "6fd3531028492e6451288b395ff0aba1"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1691007621369
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: 1gITI7UH1lp9vpl7Goz4qSuO9Ek5JrFZ
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=531429
x-cache: RefreshHit from cloudfront
cache-tag: F-128054183304,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 468664
x-amz-id-2: TXhwwDBzjJP4JIJC7xkFR9K8rMrxYHa7prMpEWq+Q6V0+IL4d7zjD6uKmHzioiJWlqRtU3QwUWgT2Fy2N2r9rKOZYS4jpl7rZmcjbqqXH7Y=
last-modified: Wed, 02 Aug 2023 20:20:22 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2PAspXQm%2FXAIxsnxUmJqWn%2F0xFg4WcEpCekmgdWGmE2Q3ov4xOOjTB2U2pCdtvpQtolXoyqNh0kO8%2FLMXrLRJAExlFkokk4sGhu5J9Gg1AJAU%2BSX60ir8E5aLzX%2FZpVchwnpM%2F9WYO%2Fz2itBHv72kA8%2FTg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f922b6fc403e0-FRA
x-amz-cf-id: S8P50aGiWMOKpsXvOXAEbf37DRWdVy74YKxRL9UDpQ8jOsGWoyfZ7w==

GET
H3 200 Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg
www.reversinglabs.com/hubfs/ 98 KB
99 KB 314ms
309ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-127116244143,P-3375217,FLS-ALL
age: 45620
x-amz-request-id: DWBEMC3RPDQCKZRR
x-amz-server-side-encryption: AES256
edge-cache-tag: F-127116244143,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="Webpage-Banner-Software-Package-Deconstruction-EP07-1400x732.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "d863474a07d18297d34a6ab8da71a3c8"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1690395688500
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 837a869ba82f4a85a2e5810b11746698.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: p9dFM0KI5I.1lHtGTE3Sw.K9.1pZvEwT
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=254194
x-cache: RefreshHit from cloudfront
cache-tag: F-127116244143,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 100108
x-amz-id-2: P5zw/fxtP8pRYoKAfmmT0n12Dob6PEB/oHRFCsIkeoDUFcZFB5ICQH/yZOeDlrdhzE1ayEOhbhw=
last-modified: Wed, 26 Jul 2023 18:21:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2gHcJeaNZLd9%2FBbvVHRRchKDPEeuviU28d6G6DwYGjZzSJDFms0G%2BF5OG%2FmOXNYqfb6J3tIEJxF1LlMoN6iN%2FZnDDwDbQXK7At9poMLoHGK59y%2FyRYEBc9qNddPws0yOPjT8MNaCEcVqIHR4oK8DxMq9XQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f922b6fc603e0-FRA
x-amz-cf-id: j9MJqxusj4-FemnqMYyppKseF9SXzlETuWMHdh7PcTfote9MCCdCyw==

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/ 85 KB
27 KB 94ms
35ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 330772
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27437
last-modified: Tue, 01 Aug 2023 17:19:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64c93eb8-6b2d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Liq2cijEy0duCD2LZ0DqvASgaGbdnQTpE%2BLcmbXGjxzpsxFeG7PE4KkoZKwlJU%2FRbpVMoewOobk4ldh8bEBXFVBjcT2xdSS3VRRKyIJMcCjgLlFv3Ke0e%2F7%2F1yIihineGlMtHss8L1nzoLQhn09XKJr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f2f922b7ad63a9d-FRA
expires: Sat, 27 Jul 2024 12:37:26 GMT

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.372/ 12 KB
5 KB 103ms
38ms Script
application/javascript 2606:4700::6812:8f65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.372/embed.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8f65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: y7ND9ey1AdjRUW5XrlhHQ1urKE3DE81O
via: 1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 429516
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 20:39:52 GMT
server: cloudflare
etag: W/"fa27a9379786a382617de08f3ae57836"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HwhwsDjGJmb8zrQ1Dt6nUGRjYwSz5SA6lMUcsUHWDK8NdsQfY1T3pvaISzitzzXGZ7%2BSOuWRk58bIiQ2R%2B3Cli%2FG%2F3kyjx3ogEC9h1faK1GDTUoxk5LVcS%2F749aDOLQtZVs1KZrFr%2FKY0mZifKGMf6wT7Ds%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7f2f922bdea79177-FRA
x-amz-cf-id: x9SSSibB880Sb7x3GYCFfJZJmILzZ3iQ47ca5aCEDQ7PjitxHpF5-g==
expires: Tue, 06 Aug 2024 12:37:27 GMT

GET
H3 200 simple-lightbox-min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/ 7 KB
4 KB 110ms
109ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/simple-lightbox-min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 361
x-amz-request-id: H42K3MH7TZVXFF5H
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"d02c339064b8d2b370bc4e18fa6ae421"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 c3d335addde48969fafe25d4064cee80.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: FsEJuIr7CYCWLWb_isdf3JLdbLwDP7p.
x-amz-cf-pop: IAD12-P3
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 253
alt-svc: h3=":443"; ma=86400
x-amz-id-2: h84pfZiqlEUqzWk3B4QyWId8zMJDoF3j4jPsPmK2zkGBSl3nw0TayFcgwDhKxeVxxVo5TJCE+4E=
x-request-id: 13bed4ec-9bf0-4b6e-bca4-8a5fd2a4a053
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 30 Sep 2019 10:48:21 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E56%2BeJxO5ubgqTlYM9wmxW90N6BPHiOMBN2dZ3i46V8NYE43j3X4masO2tMyF4ASBowemyHl5zeXhxi4A0%2FvHfSqkSLVMi8yUytbXMWmBscTDaObm8TF2adQVG%2FaAngwNvDWCudNzpLWMSm3h7%2BhXLHxDw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7f2f922b6f9303e0-FRA
x-amz-cf-id: HVhQ5PMUnqs7Zcwj-8vhwczl-jEJI2QPAl3Zy9hfDABHiQte0CrN_Q==

GET
H3 200 rd-2019-main.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/ 2 KB
2 KB 147ms
141ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/rd-2019-main.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 0920aeb1eced22df07c9ece1cab0a554.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 540
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: P9Z9EB2KXA0A93K0
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-version-id: I5.cidQ.vGRls6iGZkmuPTBztEr2IVdj
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: gODt42Uu0YfMw37/KITt8lHrIS9AHf1TRCTg4TtmdRlhXWo42gBbHH21VJPATnTJLMhtF2zsWmo=
last-modified: Thu, 16 Dec 2021 14:24:59 GMT
server: cloudflare
etag: W/"b2a254916a67659b4df42aa3c333359a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1639664698586
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x78h2W8zNAAuzkKw0XodtUg%2FZt6oo6h4OfSNYuuhsnYmUMVOX4GC2z4kGW9gWJr3JbNnqcctSau7MVWV8X%2Fc50I1MhexIWTdON4x846YYYOeKjdwWgCfLEF5xtKLkblwUfYm1F3xDphImk7A9a%2BfN3A1uw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922b6f9e03e0-FRA
x-amz-cf-id: sMmwSqy0d8ARzooxKQqvzcugi_MbjQT2AYL5KYZnttQ0y0wgzzXJ0g==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 jscookie.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/ 1 KB
2 KB 147ms
142ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/jscookie.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 d591fee4e3f29cf0e3380368d25b4a40.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 540
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: SFE2B5RMS0D1RJVT
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: _PdfjdMgm8.M2DiCSVpcYFrpWe519SIO
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: N/e6zffEKgKpzxpJGudGJLeyc79/wOwUyspgPn2GYHt61kokYZ/SI/oYcftiRFZJ5Ydug8V1SPk=
last-modified: Fri, 10 Apr 2020 04:48:55 GMT
server: cloudflare
etag: W/"93c12b195cd05418a85b4eafc15c92fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gStB8e7YuxN2GfuJ2XQ7Obp5mzvW6ZEJ7VBgdJQ%2BrxGWwlEZLpMYzvbxKv4KVygr3YBg4zvboGLrnsoyhSNeMnfmDlusOK9eSCT9H8NP1nm7hFNJDd3D2lCjCvS%2F76qeUp04NjF0rqCs8fB%2Fu1JVfP6gvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa003e0-FRA
x-amz-cf-id: TXcCPhDY56Klkv4iG0Rywpv56a7ee1XDPUOTOhR88Mjgjgm-UQsCCg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 tiny-slider.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/ 31 KB
14 KB 109ms
103ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/tiny-slider.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 ea3bfccd683c652cb849f6ec1b5606a4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 540
x-amz-cf-pop: IAD89-P1
x-amz-request-id: GBX9DYPXCZJQB6KW
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: a_gzCem69enGGi103.H.X02BRl8OY0mV
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 8YYp1lWEYGHb/Aq5SHvpiMwab+rSVo4cQmgmLrTL2bwKXC5DpWiwSGvnDRn5mX2z6MD54T1+oB4=
last-modified: Wed, 25 Dec 2019 13:47:07 GMT
server: cloudflare
etag: W/"6603e5d1b1eded8b550dc3ef7fbe687d"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Won%2Bwdx9%2FgeJ0jqL2BvI2PtnkWx6kKo0im5RoLNyMfUSD6b%2FTMRzbc4LkQmJHwOLV9gWG3Yql2wkoR%2BX%2Fbo6FuTsB4dphbSi0dE9ahhUI3H%2BFGhbXxNANfGDpaxyGf98l6bPrYbUxSKaJsh4g%2BuqARoAtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa103e0-FRA
x-amz-cf-id: T0P6GCCNYUEpb2--f0NmzO3ui5ImaAPcXP3p9kPfgR9Mc3NpHKzakQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 module_28186900061_StickyBar.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/ 1 KB
2 KB 147ms
142ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/module_28186900061_StickyBar.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 540
x-amz-request-id: 80GNJQM6FRHN4BA8
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"05f529f2d7b3ca476f37bdcf0b96ef7e"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683494323317
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: Dj1AN92dBhP0GYrdJYdEZgTGEMSZDLdS
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 98
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1hy2ztk0sACwGhSaHXYGJTePyK2ElHBN6n6KqLJWX/hSVZLtLds/IPQ+WQYqlA9cxxggdjz4BtA=
x-evy-trace-route-configuration: listener_https/all
x-request-id: f572166f-83a7-408e-93ef-ff2c31e30e6d
last-modified: Sun, 07 May 2023 21:18:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DaP9RRNhJBzXMO7KbwmnfgFGpJfmZ3w95asOzPuL7huUsS4KGOHoVUseJ17ShUKr6NcPWGG2DZHENhfa%2BnsqCGx015PuFqlnDJ%2B319WE3wn3lp7RlwXF2Rz0VfEZQcFqDq0uqeKrnutv4SMj6KZFOMWSzA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa203e0-FRA
x-amz-cf-id: nXR_gmwXMnT_HcUaEkIukORt9QClCbVkQ6HKo-u93_Kum0m6YhmVKQ==

GET
H3 200 micromodal.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/ 5 KB
3 KB 148ms
143ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/micromodal.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 540
x-amz-cf-pop: IAD89-P1
x-amz-request-id: 116AX6Z7AB1R4RZA
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: 3FilIB6THj7cvPLh93UnKYXf5w_lQZsq
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ruzvtkLrgtoV0HEprKnd0ey0zZJOaqFno4Vn/kn1aLJGOoMKqcrtDV0C9IrmyqL8EhM1fvBLBRs=
last-modified: Mon, 30 Sep 2019 10:48:19 GMT
server: cloudflare
etag: W/"84194eded494d011e2828f00329b15c6"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NiwUurTcNBoh4rfZeLAOR%2BAP2gRfp%2Bj%2FXgjx6G%2FCw8odkTwjfsqmeVnd95vI6ifIfRBoYaLUHo3mHc9cFUcNeKQMCPnyCLsE4SdaINvBZH8jAH6dBxn7nA3BPF78VjFZIH6DroQCL6dcDK6X4%2FqkQGCKgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa303e0-FRA
x-amz-cf-id: eFPibRKOod6qPtb1YOn991kQClxbbquEbRKGOy8WRoYb2GowexLhOg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/ 3 KB
2 KB 306ms
301ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 470d4277236d0557f3e42c6bfe9dac78.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 541
x-amz-cf-pop: IAD89-P1
x-amz-request-id: ETTJ496YFRFB5FXR
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: uYaggxrRRLpm1_Oqgp40jmGQ7KENtM4f
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: CXkhl8cNbAP4M6ZvJsA7VdMbHNh7g8gvImIhqK9ZBcMOpZuZwn6MRnWtjwBUPZNR2TL98EVBSoM=
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"c27b7b6ea1f66fa47d64742279aee97a"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=haf90%2FcwnyANPkXTrj507GuHCh1f5fWwrqg%2FRvVpr5oP3w4U9%2FtN2SQaaSPQynN4HZqdZN3bKUjx5RbyHhGHqFTaVi4GZ7d4KOaXOZIu%2BeUt%2FS3zVGsKyT39BkpTUmr1V4L6OuJOca%2FRu8R0tnC2R6p2bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa603e0-FRA
x-amz-cf-id: rSg_KDIi-ct4SqQF0Dypo0fb-X9uuEb5z785-dOUh1XsN_kiaiwMnw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 module_36845096476_Blog_listing_card_grid.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/ 723 B
2 KB 148ms
143ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/module_36845096476_Blog_listing_card_grid.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 362
x-amz-request-id: 49376P20C5N2Z5NJ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"a26b824a33500d5b24e748588dd1c35a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635694467
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 c3af1bb2028605770032345c7c19b7aa.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: vX4VGHX7oLkggy1lxnxWYDLA5rVHVqKM
x-amz-cf-pop: IAD89-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 136
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lIjufGA3ZDty/JYLu572sxuNz17BFUtLeN1DL+Fk3VccVQXeBz49aN972HyHJBYd+XhB3bkzLZg=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 1399d90d-1c8f-4031-8354-294e636578f2
last-modified: Tue, 09 May 2023 12:34:55 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5N4Woy8P%2BuOAuDt%2Fd9hC49my6qN3xzvBVjO%2Bn%2F2wuwe5TnhVSQ71b77HNwUjFKyqLluuv2i2vS6Weywihm1%2BDwx93MJJqZg%2FKe3VukVzEEGPJpzl0Q54IU6Iij3eXoU6HzkfdkO73TuIn5p9EhtJGNjZvg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7f2f922b6fa703e0-FRA
x-amz-cf-id: dG5ZMeH3PBHOC_OcGGrhr0wQXW4oXFDNtYkiI9ZlQ9qTZZTkprqYiw==

GET
H3 200 3375217.js Show response
www.reversinglabs.com/hs/scriptloader/ 3 KB
2 KB 347ms
342ms Script
application/javascript 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/scriptloader/3375217.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

483c99901b2a42680f2a3c5540a8c6fefc18ca555e3e318480e88c9ffc863df3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: c46ec7d7-7087-4c06-9107-c5a423003c34
content-encoding: br
x-envoy-upstream-service-time: 4
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c46ec7d7-7087-4c06-9107-c5a423003c34
last-modified: Mon, 07 Aug 2023 12:36:00 GMT
server: cloudflare
x-trace: 2BA975950E8521EE636381B4B2002C8C68E5D99CF1000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-z8kzl
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WOi8IQly5oxwmXPdtUmywfIj1beDlq43TVlQOJVy4dCSbK6%2F920FxjoBA8Yhdy5qyWM3nhtFKLfGD0qNF%2FJbMxtBFjgKgGNIWIoqOlaoUZ94V0nUPUhfRHlwEkpOgFnOcQAO8DeOjIWblkjPtblTewwfbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f922b6fc703e0-FRA
expires: Mon, 07 Aug 2023 12:38:27 GMT

GET
H2 200 cookieinfo.min.js Show response
cookieinfoscript.com/js/ 7 KB
4 KB 106ms
36ms Script
application/x-javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: WRW2NGZ8BC47AZHJ
age: 2284
x-amz-meta-cb-modifiedtime: Mon, 03 Jul 2023 14:52:01 GMT
alt-svc: h3=":443"; ma=86400
x-amz-id-2: kWbveJ95Zv/UAiQk/MWga0YD/uP2KCc+exKmsDmuSQ6lRfwgf95C+GrfghUHMsccr8HAiK2WZ6c=
last-modified: Wed, 05 Jul 2023 10:39:27 GMT
server: cloudflare
etag: W/"d15d93068c1121f63008407d339bd819"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BTdY6BX6hnmBb5zaPQU9uQUtNlmsu1kxuvclQvzI32ikAYG6MCNTmDC1zYfB5MOeJDz4C6c3fhGZ2Sc9xnWTpm%2BRGcUBWexyKYPbK0JI4FkA3a8%2F4FqIXUMpLaQank3vETX0LxNocN%2BH5m6u4xQitAG0CQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: max-age=2678400
cf-ray: 7f2f922bd9b12bbe-FRA

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 5 KB
3 KB 118ms
30ms Script
application/x-javascript 65.9.78.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.78.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-78-118.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Sun, 06 Aug 2023 20:10:51 GMT
Content-Encoding: gzip
Via: 1.1 241b025da3883bdb653910a6da97c0a8.cloudfront.net (CloudFront)
Last-Modified: Tue, 01 Aug 2023 20:10:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: AMS1-C1
Age: 59197
x-amz-server-side-encryption: AES256
ETag: W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: CyAveTvHuZ30Z5ImV0bWgobl7PWygpeuJzHMWG1y9E96UdgT3OqsvQ==

GET
H2 200 hotjar-3176008.js Show response
static.hotjar.com/c/ 10 KB
4 KB 121ms
35ms Script
application/javascript 18.66.192.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.192.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-192-39.muc50.r.cloudfront.net

Software

Resource Hash

2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:37:19 GMT
via: 1.1 eec5ede1fdb15ceb2352a4ebfb155362.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 8
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/ea37d1e0bcd47d6c2f7b79a987e66f2b
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: 6FVZ2cIdGNCZ0oJOkJfKJXmk0EKOW3DSlDmus2pY4x4Ww-e6Q82rGg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 269 KB
92 KB 183ms
63ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02b84e736e3e920b410cee6f35e14cbdefa12c25c6c9258a40537994fc363887

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93760
x-xss-protection: 0
last-modified: Mon, 07 Aug 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 172 KB
47 KB 87ms
29ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 07 Aug 2023 12:37:27 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 47151
x-xss-protection: 0
pragma: public
x-fb-debug: vpqMHuKiChHj6FzdVemumaUwMhVd75bOVvRAcVrK8zmbANH4EqFGguZiT9vxzaIVK4hqfhp2jxslsUL5qjaO9Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 187ms
66ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 07 Aug 2023 12:34:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 modules.92ff9978854791af68a7.js Show response
script.hotjar.com/ 223 KB
55 KB 127ms
39ms Script
application/javascript 18.173.154.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.92ff9978854791af68a7.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.154.13 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-154-13.muc50.r.cloudfront.net

Software

Resource Hash

f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 15:14:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 67b5b59d34e71a36a3955bf957ea9ed2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 336200
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55640
last-modified: Thu, 03 Aug 2023 15:13:59 GMT
etag: "9e14d47807cbae60a1fa1410419e20a1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: UqA51PIz-Kf8PuB61hJ8L5r5QynsiafXTLL5pXyRF0_3HRbN_71nIQ==

GET
H3 200 hero_bg_small_2019.jpg
www.reversinglabs.com/hubfs/images_redesign_2019/ 21 KB
22 KB 198ms
198ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/images_redesign_2019/hero_bg_small_2019.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
age: 213517
x-amz-request-id: QA8X8QDKH7P9XNQQ
edge-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
x-hs-https-only: worker
content-disposition: inline; filename="hero_bg_small_2019.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 2
cf-bgj: imgq:85,h2pri
etag: "1f3df8332048ad0295bff3a1c64cc9a4"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 2
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: a5PUnngJgc3ZEsbtfbAJjo5eXZD8MNrM
x-amz-cf-pop: FRA56-P7
cf-polished: qual=85, origFmt=jpeg, origSize=95096
x-cache: RefreshHit from cloudfront
cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 21652
x-amz-id-2: bR90yqiBJ7Dh9dAqPm1PCyYRStpPFpC6pAebiUQJjEUv7DMavDut9DMDqJdX/XoowM/Spr2H4uY=
last-modified: Sat, 20 Jul 2019 18:01:05 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tc5R%2BeQJKANrEgJBPiQkP8aZ4eEKssgtIjDKoeyZsLiLMxvtn9p2K3ga4eABvMqGzLEOOdq81Tgf4ueBTKnujevRWPtm%2B81npaSIrJ3I9SH%2BKQSNH47mjZ8N3TCB3c9v%2F8ksu5G59YwS72c%2F7mYVcxjyEg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7f2f922c593403e0-FRA
x-amz-cf-id: 9QahqkLMvEtd_FkZ8LYa1FR_USyTXZvlXY5WNql-D1665D9EsLPY4w==

GET
H2 200 Tungsten-Semibold.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 20 KB
20 KB 142ms
77ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Semibold.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 a33954238ddc352c152e2314fffad1ae.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: zHy7ciep2n8U9dRoPSeIZ0ms5UoFs.HW
age: 1129059
x-amz-cf-pop: BRU50-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: 9HES1HN2AB3CW3X4
edge-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: G0rx5jzH1sa0akP/ogiaVC008jTdSMUKBtd+TQzYvdE3eUMlL+H/mOs45mBeWu7B7M/+aTkDvDc=
last-modified: Fri, 10 Apr 2020 04:06:19 GMT
server: cloudflare
etag: W/"c4cba999623da66f241554c075076b87"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb029bce-FRA
x-amz-cf-id: Fn7k_O19RlZ0V5ETRUKNpXbfRXMi6obelJTULutLXaZ0j12c_n4wqQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 174ms
108ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 803246727539350977d724c9e4a027c6.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
age: 383668
x-amz-cf-pop: FRA56-P4
x-amz-request-id: RG8HX3X62PZHM8CN
edge-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-amz-id-2: TyFIgpyp10KkcTyXsymZ1oFAFu8DVWHvxhaQxzR/okrpzKqvjIaSzJCw0J47reCmDXNilueQOds=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"ab8a234e214dd3506e9fada6b6eafdca"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb049bce-FRA
x-amz-cf-id: NidTNyKRAq7Uz5aBhL4CYmDGslcur-o6sJTjfvI4dRA-noJcGGS7Sg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 rl-icons.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/ 4 KB
5 KB 174ms
108ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/rl-icons.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-amz-version-id: 7Fg3.Df2IKZXcjymNQNOrpeZRI7DlXZ.
age: 438326
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-amz-request-id: 51W62WVMKWF50GNG
edge-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: WLgjmiL27XpT+j4kOlFBZaljkpZAJNdPI8Bm7ptfrmh2AHW2E/WDraOtijG65KAiHDmIQHCPuvY=
last-modified: Fri, 24 Apr 2020 14:40:36 GMT
server: cloudflare
etag: W/"97ca286c0b94878b6b2adf44559b6265"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb099bce-FRA
x-amz-cf-id: u8e8rcWlHJx6_nTmuBrUZpaNrwDlIOhf1ls1xIfBHeWXSkWmhTRDPw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 181ms
56ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 02:35:09 GMT
x-content-type-options: nosniff
age: 208938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 02:35:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 195ms
70ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 289835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 04:06:52 GMT

GET
H2 200 TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 174ms
109ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 6165dcc1fdf84ac65e8204c05709f1ca.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age: 437473
x-amz-cf-pop: FRA56-C1
x-amz-request-id: G18NB05HDYX1X3AG
edge-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: cJzZtuWSuhlCuoelcssFG4ItqhdQeWN8yfYZfcScmTY//X4/nEs0cDddUu4fMRqcL1ef5cdbl4c=
last-modified: Tue, 18 Jun 2019 15:58:22 GMT
server: cloudflare
etag: W/"650100235aa1598769f1744ec1674c39"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb089bce-FRA
x-amz-cf-id: wqlmHhz4cw4lQFCQQbttTvLkp1n10kipNB9BgiAMzOCsajNhpaF4tQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 265ms
141ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 15:22:55 GMT
x-content-type-options: nosniff
age: 249272
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 15:22:55 GMT

GET
H2 200 Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 19 KB
19 KB 168ms
103ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 2a3a093b493a82493f3431437cb166ac.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: 8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
age: 1788682
x-amz-cf-pop: FRA56-C1
x-amz-request-id: B8TFZ3GWMHHNY3YD
edge-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: JnmYFgFQF9+rJsdywJ15OXw3AP47TYa8OwD8iFL5+t2t4EpShOsPfYpqi7BFfqQCeNdV7ydwThY=
last-modified: Tue, 18 Jun 2019 15:58:23 GMT
server: cloudflare
etag: W/"e62b1278f1fdeb9765b266aa18905620"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb059bce-FRA
x-amz-cf-id: kx_5axGUre7U4A6ztW55USTT12iC6xsGEEWjTtUJO2K1dcVdO-HVuQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 281ms
157ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 03:37:34 GMT
x-content-type-options: nosniff
age: 291593
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17508
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Aug 2024 03:37:34 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 244ms
120ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sat, 05 Aug 2023 13:37:19 GMT
x-content-type-options: nosniff
age: 169208
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Aug 2024 13:37:19 GMT

GET
H2 200 Tungsten-Light.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 76ms
72ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Light.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: oZWO71JPrAMaAkHUdMvYTNjF0GR2Ck4O
age: 1165526
x-amz-cf-pop: FRA56-P7
x-amz-request-id: 3JTZ5WHANE0C9EBG
edge-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: x/G5VvN/z2SfUZFCg1LDNMQxr9oXVsnn7aQYavzX+Wk6rq5JpV3bHpjU6TRrk7RO00U1t6H3q2g=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"100aa5d32672286f544f73831e764ee1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922ccb069bce-FRA
x-amz-cf-id: TZNApEhWMdnBkfcGYtiJqRK6h57FKJwLu9Pz3eCFa609__XVcIgD0A==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 VMConnect-Blog.jpg
www.reversinglabs.com/hs-fs/hubfs/Blog/ 152 KB
152 KB 91ms
90ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/VMConnect-Blog.jpg?width=1400&height=732&name=VMConnect-Blog.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-127998140035,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 155290
cf-resized: internal=ok/m q=0 n=950+0 c=21+116 v=2023.7.3 l=155290
last-modified: Wed, 02 Aug 2023 12:32:32 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfNOMcKaoDQTmxnUSgND4a2FbXsvDsvdffkG1yWKzcDQ:7a382c8e2e8d51d238303bd14e4a96b4"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p7W5bRlQBIDJQPfCbjO3jFS1K2jpT9upPW92Ct4GQDCSjNl9NntpAeVnrdB4ALWOtIQLaT2Ucx%2B9TW3ggRWqvryXv6dHNI6EzChzSlwK3z25Jkq7x03AS26jx8mBe404QT0eAWEDp06oig8RytddMvdDCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922cd9f403e0-FRA

GET
H3 200 vmconnect-blog-figure3-config.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 39 KB
40 KB 111ms
111ms Image
image/webp 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/vmconnect-blog-figure3-config.png?width=570&height=226&name=vmconnect-blog-figure3-config.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 01e7df96c01c9ecdb1cce1b6595ae260.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-128372297775,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 40172
cf-resized: internal=ok/m q=0 n=712+0 c=0+21 v=2023.7.3 l=40172
last-modified: Fri, 04 Aug 2023 12:08:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfKEFYek-osWhpe5X8gXArZyh18sSmAPwuejBK1TPFDQ:a4db244b42098e0fbad80bc9b9c81d06"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=88IFD%2B8euVFPAqUvumY1n7dPWRChW3eJ%2FCoPNqGvTB7c31fqwU%2FkKNkylSIeFGHlsgVCVvwdNHP6oxW2pBz%2FTc9i5dosOf7s5Qu8RvVwz0xqnzIPpTBfgjtLPkTkSeiU6DU14wFkLxNyOy01MZ9NDKkukQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7f2f922cd9fb03e0-FRA

GET
H2 200 1076912843267184 Show response
connect.facebook.net/signals/config/ 306 KB
87 KB 30ms
30ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1076912843267184?v=2.9.121&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 07 Aug 2023 12:37:27 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 89044
x-xss-protection: 0
pragma: public
x-fb-debug: rLxXtPN0XEePUj0J4FC2MtdmHAcz9e/V6epysVCu1dDwuw9cG9WBaFhPvfcAFcXBcMDy+acfeVxeu8ZBClutCg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 88ms
28ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1076912843267184&ev=Lead&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691411847353&sw=1600&sh=1200&v=2.9.121&r=stable&ec=0&o=30&fbp=fb.1.1691411847352.871911060&it=1691411847201&coo=false&exp=a1&rqm=GET

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 07 Aug 2023 12:37:27 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 177ms
56ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 11:49:45 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2862
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 07 Aug 2023 13:49:45 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 110ms
28ms Script
application/x-javascript 2a02:26f0:480:f::213:7ecd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ecd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Jul 2023 09:07:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=64596
accept-ranges: bytes
content-length: 4862

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 108ms
28ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 site-script.js Show response
cdn.metadata.io/ 6 KB
2 KB 111ms
35ms Script
application/javascript 2600:9000:26db:4800:9:d7d4:1380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.metadata.io/site-script.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:26db:4800:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id: FA0kpUmjH6379n6SM2OzYViu4FNXSGFq
content-encoding: gzip
via: 1.1 f4ef6af6f595152791fb5c57054106ea.cloudfront.net (CloudFront)
date: Mon, 07 Aug 2023 00:09:14 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: MUC50-P3
age: 44928
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 04 Aug 2023 00:07:57 GMT
server: AmazonS3
etag: W/"2963b0a1258588f130235cbdfe809b88"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-amz-cf-id: 8LGbayw_FmQ2WQ7WZF4yYF6JZZhGOzmhXPfIPwBhTjqKuw51lOsDdQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
94 KB 63ms
62ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d70b09c137b590b37ac92fdc7d6501e1beab2d7bcafa9230383cb2dd61aeadd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95844
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/ 43 B
423 B 484ms
124ms Image
image/gif 35.171.143.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.171.143.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-171-143-69.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:37:27 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,cb8c739c057923eb02ec4b49d0978d9f,10.0.0.142,11926,193.32.248.245,,143259284707,1,1691411847.794,0.001,,.,0,0,0.000,0.000,-,0,0,197,136,68,10,34729,,,,,,-,
Content-Type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 68ms
29ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1076912843267184&ev=PageView&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&rl=&if=false&ts=1691411847373&sw=1600&sh=1200&v=2.9.121&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1691411847352.871911060&it=1691411847201&coo=false&exp=a1&rqm=GET

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 07 Aug 2023 12:37:27 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 json Show response
www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/ 16 KB
4 KB 166ms
165ms XHR
application/json 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/json?hs_static_app=forms-embed&hs_static_app_version=1.3512&X-HubSpot-Static-App-Info=forms-embed-1.3512

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0230b6bfd680cadb8d845fbb4e2c1e791a932feb18b9830acabc9e06b93d5173

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-origin-hublet: na1
date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 07f0540b-adf2-4729-a07c-8ee6fd25ec6f
content-encoding: br
x-envoy-upstream-service-time: 13
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 07f0540b-adf2-4729-a07c-8ee6fd25ec6f
server: cloudflare
x-trace: 2BB0BEBC7482DD84F9C17C26A6DF2E4CA644A21286000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-max-age: 180
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-j4dtm
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PamhLXkAaJZQsXYsgb0TMdtOGehlciabmbEa816%2B939DzLMI5z72tz3npIp9Mh2sF60AczjemGU4%2FPD%2BrbBi0UgvE9CFb63%2BboYkp9HzcmazADQmaX0sQtByaUle%2BMoJhsLWKM87aMssQfiB3cQb1W7R7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f922e6c6103e0-FRA
access-control-allow-headers: *
x-robots-tag: none

GET
H2 200 JrRu3vUM8j33QSR7Bwxw Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 252ms
188ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/JrRu3vUM8j33QSR7Bwxw

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

a33e9e7eec5c6cad6813efe83bd80c8886afd9c4f54d2afcb069808fb19f254f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7f2f922edb276973-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok
alt-svc: h3=":443"; ma=86400

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 30ms
30ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4729e565155f59f492b3baa57a57c49f4bf16dbb93b260f6eb3e0c013667554c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:37:27 GMT
content-md5: aO8rybBs+DQZYq2aLbTFeA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1688
x-fb-debug: WVlLLvU8WNgDly9i3SdaZn0n9vknaBwa1D3+0kkU70LBN/joWz9qneJg0IdQw/15f7VOqyrpNWqWhyuiWmYcbw==
x-fb-content-md5: a52e603097191cdabf91edf5df0ff864
cross-origin-opener-policy: same-origin-allow-popups
etag: "0a3b2bfd5654b53cbd75fd799fef3b30"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Mon, 07 Aug 2023 12:47:04 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 182ms
43ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6FA7) /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:37:27 GMT
Content-Encoding: gzip
Age: 269
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27630
Last-Modified: Tue, 24 Jan 2023 21:41:51 GMT
Server: ECS (pab/6FA7)
Etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 540 KB
86 KB 116ms
46ms Script
application/javascript 2606:4700::6811:816e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:816e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 19817
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js&cfRay=7f2dae5e2fec4d67-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"039461df2d1d43031520c7d3a853f79e"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1232/bundle/main/lead-flows-release.js
date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: RIqU3aMZg9szNHjfbC8NSxVkuKgO4.TB
via: 1.1 3d4bfc42e9575ee1f9559241c9e3f464.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: fcf07ae0-52f3-41dd-bf4c-727060a17347
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 6
x-evy-trace-route-configuration: listener_https/all
x-request-id: fcf07ae0-52f3-41dd-bf4c-727060a17347
last-modified: Thu, 03 Aug 2023 01:17:49 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-ksc82
cf-ray: 7f2f922efce54d49-FRA
x-amz-cf-id: Q5dNdzO_oFcq3EsSoP-v7sW0JoHapfgOmGgptAXlM-NF87dwYlkPLg==

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 76 KB
22 KB 117ms
47ms Script
application/javascript 2606:4700::6811:62ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.usemessages.com/conversations-embed.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:62ac , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: ODJS4by7FZvkpoRvjuP9B12j3hHA63aR
via: 1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 231
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13717/bundles/project.js&cfRay=7f2f8c899d9c9046-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 80c2ae06-4364-46a5-a5eb-6c0f4a0beede
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 2
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 80c2ae06-4364-46a5-a5eb-6c0f4a0beede
last-modified: Tue, 01 Aug 2023 04:58:19 UTC
server: cloudflare
etag: W/"99645c9c8dd31a70b2127da46f42c10f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-ksc82
cf-ray: 7f2f922f0de7bc01-FRA
x-amz-cf-id: Flk1mGvbwTcd4tvwDJJijD1kmYd96rKgemRbH19S-UUoB1ayD278Cg==
x-hs-target-asset: conversations-embed/static-1.13717/bundles/project.js

GET
H2 200 3375217.js Show response
js.hs-analytics.net/analytics/1691411700000/ 66 KB
21 KB 103ms
41ms Script
text/javascript 2606:4700::6810:88ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1691411700000/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:88ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: VD9FF3WCPVPMC7CD
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: fcabd029-9a18-43b9-baf9-a49e93db7077
age: 111
x-envoy-upstream-service-time: 19
x-amz-id-2: mp8iu5K/VkHb0rutr/Z7ONFBTPVr81iYy2Y3UAZqqiX6spul1FOXB5rOAVaI7h++uWj2klXYxcE=
x-evy-trace-listener: listener_https
x-request-id: fcabd029-9a18-43b9-baf9-a49e93db7077
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 20 Jul 2023 15:57:16 GMT
server: cloudflare
etag: W/"a3ab9dab97e068beca49a0d2808f012f"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-9vnjb
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7f2f922efbec3a66-FRA
expires: Mon, 07 Aug 2023 12:40:36 GMT

GET
H2 200 3375217.js Show response
js.hs-banner.com/ 60 KB
16 KB 103ms
42ms Script
text/javascript 2606:4700::6812:18c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: bw3Z1oFRilBSp2nJoqwzp68d0FJwmW7g
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: YCB4T2Q968QCXYJV
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
age: 184
x-envoy-upstream-service-time: 34
x-amz-id-2: WxyNIjCFjR5TpNngHSe9JlyJ94K367PL797r3aedc+ni/bf1tSf0z8HitDEIdI3MNKXj8+4NrZI=
x-evy-trace-listener: listener_https
x-request-id: c34f2a8e-4e91-405d-8b17-0e16ddbbbaef
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 31 May 2023 09:21:10 GMT
server: cloudflare
etag: W/"4f3650703a78045f1ac9ea0084ff242e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7f2f922f2e2103f4-FRA
expires: Mon, 07 Aug 2023 12:39:23 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 109ms
38ms Script
application/javascript 2606:4700::6811:6ac7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-encoding: br
age: 179
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.380/bundles/project.js&cfRay=7f2f8dcdfd913630-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"85b7f9af32b27bd6cc93e80bfb2911df"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.380/bundles/project.js
date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: 3rNMTio6eswfsQ6sgXOFNNmyULDAVi34
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 840219a0-4422-42f6-b057-9429cb558e55
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
x-evy-trace-route-configuration: listener_https/all
x-request-id: 840219a0-4422-42f6-b057-9429cb558e55
last-modified: Mon, 10 Jul 2023 09:43:19 UTC
server: cloudflare
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-wd7jg
cf-ray: 7f2f922f4d8d361b-FRA
x-amz-cf-id: Y5P0d7KnTxCmuW1BPKlUpjPM3WfxvtoeXDGguuGsySDLc_4XiW4C7A==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 108ms
40ms Script
application/javascript 2606:4700::6810:78be
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:78be , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-amz-version-id: aAzOiTTzU7.XykyGrcpmeR7PTeB2LyLv
via: 1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 545
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.387/bundles/pixels-release.js&cfRay=7f2f84de2cab9046-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 529e97c1-2ffb-4338-b89c-be0c96b96d5c
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 529e97c1-2ffb-4338-b89c-be0c96b96d5c
last-modified: Tue, 18 Jul 2023 03:27:27 UTC
server: cloudflare
etag: W/"784f994871e489c9943a65326d43e875"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray: 7f2f922f4ec81e49-FRA
x-amz-cf-id: isgKkYV9w_7I5Oigu7_jG0ZwGZqhcjtm6A8jBBNs4zx0R3lpBHKsQw==
x-hs-target-asset: adsscriptloaderstatic/static-1.387/bundles/pixels-release.js

GET
H2 204 has-permission Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
998 B 282ms
220ms Script
text/plain 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 04f1ff0c-499c-42ed-96e3-3e2caaa5b301
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=7f2f922fa9479125&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: 04f1ff0c-499c-42ed-96e3-3e2caaa5b301
server: cloudflare
x-trace: 2BA14DA56AF80301A6F17F4B4CEBB211C843C9D6E6000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-ksc82
x-evy-trace-virtual-host: all
cache-control: max-age=0
access-control-allow-credentials: true
cf-ray: 7f2f922fa9479125-FRA

GET
H2 204 3176008 Show response
vc.hotjar.io/sessions/ 0
258 B 192ms
78ms XHR
text/plain 3.160.212.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/3176008?s=0.25&r=0.16296272128317124
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.92ff9978854791af68a7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.160.212.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-160-212-84.mxp53.r.cloudfront.net
Software: Python/3.8 aiohttp/3.8.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 dde82b0f1eea5eff0024ab2d743df24e.cloudfront.net (CloudFront)
server: Python/3.8 aiohttp/3.8.4
x-amz-cf-pop: MXP53-P3
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: GgOUz3o46C5UFwDpgqC3TXUDPyqiuv-8C5cZCcq1yQZMj7_RBuqEVw==

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 6si.min.js Show response
j.6sc.co/ 48 KB
14 KB 135ms
34ms Script
application/javascript 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jul 2023 16:27:10 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "64b9605e-bf6f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 14190
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 19 KB
19 KB 55ms
55ms Other
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 2a3a093b493a82493f3431437cb166ac.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: 8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
age: 1788682
x-amz-cf-pop: FRA56-C1
x-amz-request-id: B8TFZ3GWMHHNY3YD
edge-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: JnmYFgFQF9+rJsdywJ15OXw3AP47TYa8OwD8iFL5+t2t4EpShOsPfYpqi7BFfqQCeNdV7ydwThY=
last-modified: Tue, 18 Jun 2019 15:58:23 GMT
server: cloudflare
etag: W/"e62b1278f1fdeb9765b266aa18905620"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7f2f922eddfd9bce-FRA
x-amz-cf-id: kx_5axGUre7U4A6ztW55USTT12iC6xsGEEWjTtUJO2K1dcVdO-HVuQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 308 KB
87 KB 60ms
30ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=cd35d2383f802bc59f9d809c0e58770c

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

37fba80f768248b9c3497155b91fac4908a32202d60da17342205a9042374597

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 07 Aug 2023 12:37:27 GMT
content-md5: qSgMXSfI5drqdnlFPWHmug==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88539
x-fb-debug: Bh4FzTFtDLYmzGteFzPYtYW4M+tIODDMl069blYTV391+v4qB5i0grWdE3ZF3A2TCjozQ58YY2QCu/iPPW9bqA==
x-fb-content-md5: 2bb160cd79e0918f289f87ef686a6ccd
cross-origin-opener-policy: same-origin-allow-popups
etag: "49143108c23f55ccef99600413487921"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Tue, 06 Aug 2024 11:18:51 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/ 3 KB
2 KB 218ms
97ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1691411847513&cv=11&fst=1691411847513&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&hn=www.googleadservices.com&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&auid=677148549.1691411847&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f2c11beb683ce4c0f2fe90a6982fe616335450ac71b03144e55bc2dcdca1445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1388
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 98ms
33ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=607552327&_gaz=1&cid=2127950281.1691411848&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1691411847&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 106ms
35ms Ping
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JVM9Z1XQPL&cid=2127950281.1691411848&gtm=45je3820&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 35ms
33ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=607552327&cid=2127950281.1691411848&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1691411847&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Hubspot%20Form%20-%20Listener&_c=1&_et=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 37ms
35ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=607552327&cid=2127950281.1691411848&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=3&sid=1691411847&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=LinkedIn%20Insight&_c=1&_et=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 35ms
34ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=607552327&cid=2127950281.1691411848&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=4&sid=1691411847&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=MetaData%20Script%20Landing%20page%20Conv&_c=1&_et=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 35ms
34ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je3820&_p=607552327&cid=2127950281.1691411848&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=5&sid=1691411847&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&en=Reddit%20Conversion%20Tracking&_c=1&_et=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 218ms
91ms Image
image/gif 2a00:1450:4016:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JVM9Z1XQPL&cid=2127950281.1691411848&gtm=45je3820&aip=1&z=508677257

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4016:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
377 B 120ms
39ms XHR
application/json 2600:9000:26db:800:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:01:18 GMT
content-encoding: gzip
via: 1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 2169
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39449
x-amz-cf-id: 72YHT2wCHoA9QX1RcgxFA8f5n7yHFW_HDKQDK9Ma-FMBn0Ysq9SqWA==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
375 B 119ms
39ms XHR
application/json 2600:9000:26db:800:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:01:18 GMT
content-encoding: gzip
via: 1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 2169
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39449
x-amz-cf-id: l4gTjqVcuds8iWmYeRgcWpXbo3WZksoItR7lg5EG3mFVvkJRh_1NFA==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1691411847570%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&...

0
264 B

247ms
171ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJor8H8KaErAAAAAYnQAJxA6GgmH0b2oVuxO5dqddVo4Bsc03U9d1QaryaDzbT7E9EhLsba
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 55A2260D9A574F81A2C98B3C023199D9 Ref B: FRAEDGE1813 Ref C: 2023-08-07T12:37:28Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYCVIJmCKbSIJ1M5TcKZg==

Redirect headers

date: Mon, 07 Aug 2023 12:37:28 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: E4AA6032B3C24DD39E1FA599338538D5 Ref B: FRAEDGE1317 Ref C: 2023-08-07T12:37:28Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1691411847570&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJor8H8KaErAAAAAYnQAJxA6GgmH0b2oVuxO5dqddVo4Bsc03U9d1QaryaDzbT7E9EhLsba
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYCVIJiQw7mUQlxt6XscQ==

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 193ms
126ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1691411847573&id=t2_neftrm6a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=9ccb9a81-313e-4b7c-b5d5-8eaf4e0c2cc7&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
225 B 64ms
63ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=607552327&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&ul=en-us&de=UTF-8&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=480680125&gjid=1126198338&cid=2127950281.1691411848&tid=UA-32828290-1&_gid=1946852831.1691411848&_r=1&_slc=1&gtm=45He3820n81MKL9P8B&z=965033522

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1016 B 220ms
159ms Image
image/gif 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:37:27 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: ee2b4d83-9ad8-43ea-b2fe-50ee9e5d1a0e
x-envoy-upstream-service-time: 7
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ee2b4d83-9ad8-43ea-b2fe-50ee9e5d1a0e
Server: cloudflare
X-Trace: 2B9A4A9BCA6A87F0016CEBB1B4C57D756B119E553B000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-llkhw
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f2f92306db09bbc-FRA

GET
H3 200 widget Show response
www.reversinglabs.com/_hcms/livechat/ 338 B
2 KB 178ms
178ms XHR
application/json 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.13717&mobile=false&messagesUtk=51c33af5b9234583a1220d99eb198146&traceId=51c33af5b9234583a1220d99eb198146

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 932d5d0c-f6c2-43bd-b5a7-545d03bd2a6c
x-envoy-upstream-service-time: 12
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 932d5d0c-f6c2-43bd-b5a7-545d03bd2a6c
server: cloudflare
x-trace: 2BF68AFDF5DBD70499EE1E1FA48854DFB8BFCFA321000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-gtcbx
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t3ecWlAZoWe8GM0%2B3xM4WgcpQjibOGVzNRPsC%2Fwq%2FhVcP4oGHhpPiI8nar0FrCKVUYNJCTvVkEMAbuOvv4BgTicIHW0Q%2FnsacNeNb4FbpZHkiDaJLMggTP%2BLzty0KhTGkmz4fQXKy82NhqbDyQ9rGD4XcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f922fbec603e0-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H/1.1 200
OK counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
1016 B 211ms
147ms Image
image/gif 2606:4700::6811:d6f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:37:27 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 2aebe803-185f-42bd-8f8e-0a13da2a1fb1
x-envoy-upstream-service-time: 1
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2aebe803-185f-42bd-8f8e-0a13da2a1fb1
Server: cloudflare
X-Trace: 2BBE94A05214B862264167FCBFFC2ECD33B64222EF000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f2f92309d4a9295-FRA

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 115 B
1 KB 216ms
147ms XHR
application/json 2606:4700::6811:c9cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=3375217

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 78a976e2-ba80-42a8-908a-966855be7042
content-encoding: br
x-envoy-upstream-service-time: 4
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 78a976e2-ba80-42a8-908a-966855be7042
server: cloudflare
x-trace: 2BF9BD1F63AD432F0C88E747F860F263EBB05E0DA9000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-c5nrx
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qu2%2BCddZ4cWizIeaD7aARHQWTSmUsEWptcUU9pW2liZJw60%2BGohAMpvp90CrtQ4P1sz25dvBAWWE699JjF%2FQi%2FVRfmkYVKkK9fPYxgGY%2B6ewsZZWxXf%2Bv%2BuyJG8IPM5w7LseAF2eEFa0NRfF"}],"group":"cf-nel","max_age":604800}
cf-ray: 7f2f92309ac291e3-FRA
access-control-allow-headers: *

GET
H/1.1 200
OK widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame 104D 320 KB
104 KB 47ms
47ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6FA4) /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 375144
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105435
Content-Type: text/html; charset=utf-8
Date: Mon, 07 Aug 2023 12:37:27 GMT
Etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:13 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (pab/6FA4)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
81 KB 73ms
72ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2313db376493c2972f3066a843bc5d5ffaa4e13fd04aeffea0f4c0fe2e892662

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83005
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
437 B 137ms
136ms XHR
application/json 2606:4700::6811:6ac7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3375217&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d2d02f64-be43-4a99-8300-1514863417c7
x-envoy-upstream-service-time: 1
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d2d02f64-be43-4a99-8300-1514863417c7
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-s8xd8
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 7f2f92306f9a361b-FRA

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 42ms
41ms XHR
text/html 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.reversinglabs.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
314 B 130ms
29ms XHR
text/html 2a02:26f0:480:22::1726:62ed
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 46bf25777096ef50be3de3b3793ee7cf44f9912016c5553cb448844ad5d4003c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.reversinglabs.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a03:1b20:b:f011::4e
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1691411847801_389993773_273288013_24_833_27_0_219";dur=1
content-length: 20
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 238ms
238ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=68c72e04-4314-4fc6-8f77-f1e216274bdf&session=1b6132f2-a3df-4788-8a90-1d732f8f7b70&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2007%20Aug%202023%2012%3A37%3A27%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A37%3A27%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22125cf4892bae30e8b53458235ef53f8d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A37%3A27%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2007%20Aug%202023%2012%3A37%3A27%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=9c7111d7-f043-49ed-8854-aa6eeb270b0c&v=1.1.5

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/970567826/ 42 B
455 B 191ms
70ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970567826/?random=1691411847513&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3573534153&rmt_tld=0&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970567826/ 42 B
154 B 76ms
75ms Image
image/gif 2a00:1450:4016:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970567826/?random=1691411847513&cv=11&fst=1691409600000&bg=ffffff&guid=ON&async=1&gtm=45je3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&frm=0&tiba=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3573534153&rmt_tld=1&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4016:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 104D 869 B
659 B 203ms
144ms Fetch
application/json 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=0201b9490a91244427cb692f27cb72594dd26a28

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-response-time: 116
date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Mon, 07 Aug 2023 12:37:27 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: ffdc175e1fcb4414
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: 6c3e3c651be24469577d0687260f9605c62e37cfe339bdae3786dffa28453c16
content-length: 337

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 0514 0
53 B 29ms
28ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.reversinglabs.com
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.reversinglabs.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 07 Aug 2023 12:37:27 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
1017 B 170ms
158ms Image
image/gif 2606:4700::6811:d3f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d3f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Mon, 07 Aug 2023 12:37:28 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 818cd9da-c681-4c3e-9570-dece38042559
x-envoy-upstream-service-time: 10
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 818cd9da-c681-4c3e-9570-dece38042559
Server: cloudflare
X-Trace: 2B1C3831689F2F75AD200EF8900AFEE2096DF42A25000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-9t4kl
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7f2f92315f219bbc-FRA

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 229ms
228ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=68c72e04-4314-4fc6-8f77-f1e216274bdf&session=1b6132f2-a3df-4788-8a90-1d732f8f7b70&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3Ab%3Af011%3A%3A4e%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20threat%20researchers%20have%20identified%20a%20new%20malicious%20PyPI%20campaign%20that%20includes%20a%20suspicious%20VMConnect%20package%20published%20to%20the%20PyPI%20repo.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&pageViewId=9c7111d7-f043-49ed-8854-aa6eeb270b0c&v=1.1.5

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 34ms
34ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-6H8MZ60CSB&gtm=45je3820&_p=607552327&ul=en-us&sr=1600x1200&cid=2127950281.1691411848&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&dt=VMConnect%3A%20Malicious%20PyPI%20packages%20imitate%20popular%20open%20source%20modules&sid=1691411847&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Aug 2023 12:37:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
94 KB 73ms
73ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-970567826

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

130db69d79e142617cba14a6fd7f2c924ed82e8d3685fed44bfee67f0716406a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95897
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 07 Aug 2023 12:37:27 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 36FC 0
182 B 161ms
46ms Document
text/html 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Mon, 07 Aug 2023 12:37:28 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
607 B 149ms
147ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691411848613&vi=929a8451c2f9e1e07eeb7b271134c493&nc=true&u=60854195.929a8451c2f9e1e07eeb7b271134c493.1691411848605.1691411848605.1691411848605.1&b=60854195.1.1691411848606&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d40feb8d-ddd7-40d5-9027-8db4e73cc5ed
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d40feb8d-ddd7-40d5-9027-8db4e73cc5ed
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aVIaGP2q1Hg4m1Gv9eoaraV4lsRA1li0735n29MZCuVx26IyYd1qTKivPadq%2BxL4rV411e9%2FiCcVm3F4Y6SfLuLFSjyXKUNJyMA8FqRzosVzlHbq9Jp1MurnzgYb89x6qmZ7%2F72Vl7wytUqjrzRY"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-mc94g
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f9235f9d59125-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
440 B 159ms
158ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=1929471b-15f9-4199-9d98-5db8e8c289c5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691411848617&vi=929a8451c2f9e1e07eeb7b271134c493&nc=true&u=60854195.929a8451c2f9e1e07eeb7b271134c493.1691411848605.1691411848605.1691411848605.1&b=60854195.1.1691411848606&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 2db050a4-869c-4340-8dc3-399f20cb1723
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 15
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2db050a4-869c-4340-8dc3-399f20cb1723
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ICYlQen3Yw2Zswa6RAO45Oscg76PocWIUO%2FfKheCRgV5ZJIsk1BOeVP45R9n8kz8D66Gm9JW6jnL8HNPvWsCJVjFle19V%2Bep%2B1c%2BueM%2FFdXIxkNyMHwTBFSzjmf7ceiOAfriPayU6InsbEsZPgjH"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-2c4rt
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f923609e79125-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
439 B 163ms
163ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=1929471b-15f9-4199-9d98-5db8e8c289c5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2246696628&v=1.1&a=3375217&pi=128190968732&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&cpi=128190968732&cgi=5901382633&lpi=128190968732&lvi=128190968732&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules&t=VMConnect%3A+Malicious+PyPI+packages+imitate+popular+open+source+modules&cts=1691411848619&vi=929a8451c2f9e1e07eeb7b271134c493&nc=true&u=60854195.929a8451c2f9e1e07eeb7b271134c493.1691411848605.1691411848605.1691411848605.1&b=60854195.1.1691411848606&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ae931334-a635-4693-a298-14a163d6c329
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 23
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ae931334-a635-4693-a298-14a163d6c329
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B%2BkEivJ6Gm0J%2BBM6XSWUMoAShGCe1doKtiGahfgjU5jhYP9EdwvKnMDV1zLNNfoOPc3Dbaa3Y16JZ4%2BeZDdej0QxAO7jkwamtKXypEjkvXgLmlcZhgHVVOdlupfSOue6zsVIXjKMsuExGbS6HNhz"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-zkwrk
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7f2f923609e89125-FRA
x-robots-tag: none

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 178 B
1 KB 246ms
173ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=929a8451c2f9e1e07eeb7b271134c493&__hstc=60854195.929a8451c2f9e1e07eeb7b271134c493.1691411848605.1691411848605.1691411848605.1&__hssc=60854195.1.1691411848606&contentId=128190968732&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fvmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07798aefac4b07384f081d67086d85ef952443cd6e557b59bc2addac577d01c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 371c4f6f-6be3-4156-9951-f6faf9d22641
content-encoding: br
x-envoy-upstream-service-time: 28
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 371c4f6f-6be3-4156-9951-f6faf9d22641
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mfE77W7EFzD8QROiFJo2H76QaaRCv9cAfr2BeOi331RFNdXe2frQyl5oxhLGdpmD2cf95YusLDVaL73TDhLb6Qr2y%2B0ZVj%2B9jiK9OhCtbtwX0UXOmkcSZWhu%2FmVApQUm%2BEOC5asZmyu6xjaWj0nP"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 7f2f92368a9518c5-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-rgcrk

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 251ms
251ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:28 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 224ms
223ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:29 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 241ms
240ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:30 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 243ms
242ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:31 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 245ms
245ms Image
image/gif 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 12:37:32 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.reversinglabs.com/	1970-01-20 13:50:13	Name: __cf_bm Value: CyKxV_nPNKuBIAlL.rXU80hHmARYrQ0V3rxwoiJvGdk-1691411846-0-AQcx7P9whJf3/bjIARVhT3DoG4gfNeBoPAsRZK41NNNr19oI/OumK7JpQkZPIRGzosUxt3i5cMbJItj1LrJwWis=
.www.reversinglabs.com/	1969-12-31 23:59:59	Name: __cfruid Value: e88c41e232722e29b22b3d00856aebf701b5092e-1691411846
.reversinglabs.com/	1970-01-20 15:59:47	Name: _fbp Value: fb.1.1691411847352.871911060
.reversinglabs.com/	1970-01-20 15:59:47	Name: _gcl_au Value: 1.1.677148549.1691411847
.reversinglabs.com/	1970-01-20 22:35:47	Name: _hjSessionUser_3176008 Value: eyJpZCI6ImU4YWRjNjJkLTczMGMtNTExOS1hM2M4LWE1MjRkMjE5YzdjNCIsImNyZWF0ZWQiOjE2OTE0MTE4NDcyNTYsImV4aXN0aW5nIjpmYWxzZX0=
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjFirstSeen Value: 1
.reversinglabs.com/	1970-01-20 13:50:11	Name: _hjIncludedInSessionSample_3176008 Value: 0
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjSession_3176008 Value: eyJpZCI6IjI1NDViNmVmLTllZTktNGRhNi1hZDc1LTFjMDc3ZTAwYTg5NSIsImNyZWF0ZWQiOjE2OTE0MTE4NDc0NDcsImluU2FtcGxlIjpmYWxzZX0=
.reversinglabs.com/	1970-01-20 13:50:13	Name: _hjAbsoluteSessionInProgress Value: 1
.reversinglabs.com/	1970-01-20 23:26:11	Name: _ga_JVM9Z1XQPL Value: GS1.1.1691411847.1.0.1691411847.60.0.0
.reversinglabs.com/	1970-01-20 15:59:47	Name: _rdt_uuid Value: 1691411847572.9ccb9a81-313e-4b7c-b5d5-8eaf4e0c2cc7
.reversinglabs.com/	1970-01-20 23:26:11	Name: _ga Value: GA1.2.2127950281.1691411848
.reversinglabs.com/	1970-01-20 13:51:38	Name: _gid Value: GA1.2.1946852831.1691411848
.reversinglabs.com/	1970-01-20 13:50:11	Name: _gat_UA-32828290-1 Value: 1
.ws.zoominfo.com/	1970-01-20 22:35:47	Name: visitorId Value: adb04b4ffc185f8de2418bba3e572ca78b6c6c26e728961e4263c5d7338eeec1
.zoominfo.com/	1970-01-20 13:50:13	Name: __cf_bm Value: 9zhn24wIwnrxgJrvIlYbKiapjTz0YWxwC0NdZV1y.6c-1691411847-0-ARVAuLFM2QYpXlf1LzBopThS0ynZUQXmWH1/hcB8JGVaZTlfDJu1Akqj0G/xSiz5GXz73EBvBCQ0FsZMLAFvhIc=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: HiHF7T_3Q3Ot1gaHnl5_pMmth6d9WAl7SnWUuIFGsxo-1691411847650-0-604800000
www.reversinglabs.com/	1970-01-20 13:51:38	Name: ln_or Value: eyI5NzY5MjQiOiJkIn0%3D
www.reversinglabs.com/	1970-01-20 23:26:11	Name: _gd_visitor Value: 68c72e04-4314-4fc6-8f77-f1e216274bdf
www.reversinglabs.com/	1970-01-20 13:50:26	Name: _gd_session Value: 1b6132f2-a3df-4788-8a90-1d732f8f7b70
.doubleclick.net/	1970-01-20 13:50:12	Name: test_cookie Value: CheckForPermission
.linkedin.com/	1970-01-20 15:59:47	Name: li_sugr Value: 113187de-21ef-4073-8e4e-f920559278e2
.linkedin.com/	1970-01-20 22:35:47	Name: bcookie Value: "v=2&79fd38c7-b2ca-46ed-8682-918dd81a4673"
.linkedin.com/	1970-01-20 13:51:38	Name: lidc Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2562:u=1:x=1:i=1691411847:t=1691498247:v=2:sig=AQHunX-JgbHyt4P8qsPF8E2NOaaQ6JJ3"
.hubspot.com/	1970-01-20 13:50:13	Name: __cf_bm Value: GJEACNyImf5qdiUEx7sMsvK8CXA78MrsICFBAga1wcQ-1691411847-0-AbPthEIWVUzu+e85dQPPxUsd07a7RjFmKUq/W8q9KfwkLmc5XqjjfL2ARPOeTzIZDDPgqiH47obaFLsOHK94oiY=
.reversinglabs.com/	1970-01-20 23:26:11	Name: _ga_6H8MZ60CSB Value: GS1.2.1691411847.1.0.1691411847.0.0.0
.linkedin.com/	1970-01-20 14:33:23	Name: UserMatchHistory Value: AQJxoRMU9paV8gAAAYnQAJriQqwVw7NTWM0kFKyonmbP_FizjkJOmRNuw-Hb0umuWZ_g3H-QqGayIw
.linkedin.com/	1970-01-20 14:33:23	Name: AnalyticsSyncHistory Value: AQJ5WJRWtug3WwAAAYnQAJrikAidpOjYZOMiCYX9sqJFYGiggUhk9j8uR9IkCoofWXV-eV5R88wrZU01ZZVs-w
.6sc.co/	1970-01-20 23:26:11	Name: 6suuid Value: aad01702a06f010088e5d06455000000f5c21b00
.www.linkedin.com/	1970-01-20 22:35:47	Name: bscookie Value: "v=1&202308071237281ba370ca-79b0-4e79-8008-188446feace5AQGg5ywp1gZzJuYoJgZwtU9TRHG7oLLC"
.linkedin.com/	1970-01-20 18:09:23	Name: li_gc Value: MTswOzE2OTE0MTE4NDg7MjswMjG58qaPtEmDmbmMa8dOAR3/a5VE6TPMgHS9a7cLq/YCxA==
.reversinglabs.com/	1970-01-20 18:09:23	Name: __hstc Value: 60854195.929a8451c2f9e1e07eeb7b271134c493.1691411848605.1691411848605.1691411848605.1
.reversinglabs.com/	1970-01-20 18:09:23	Name: hubspotutk Value: 929a8451c2f9e1e07eeb7b271134c493
.reversinglabs.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.reversinglabs.com/	1970-01-20 13:50:13	Name: __hssc Value: 60854195.1.1691411848606

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
alb.reddit.com
api.hubapi.com
app.hubspot.com
b.6sc.co
c.6sc.co
cdn.linkedin.oribi.io
cdn.metadata.io
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cookieinfoscript.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
platform.linkedin.com
platform.twitter.com
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
syndication.twitter.com
track.hubspot.com
vc.hotjar.io
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.reversinglabs.com
104.244.42.136
13.107.42.14
151.101.1.140
151.101.129.181
18.173.154.13
18.66.192.39
2001:4860:4802:32::36
2600:9000:26db:4800:9:d7d4:1380:93a1
2600:9000:26db:800:2:53b2:240:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:2c40::c73c:67e1
2606:4700::6810:650c
2606:4700::6810:78be
2606:4700::6810:88ce
2606:4700::6811:190e
2606:4700::6811:62ac
2606:4700::6811:6ac7
2606:4700::6811:816e
2606:4700::6811:c9cc
2606:4700::6811:d3f3
2606:4700::6811:d6f3
2606:4700::6812:18c4
2606:4700::6812:8f65
2606:4700::6812:d0c9
2606:4700::6812:f0f
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:80e::2003
2a00:1450:4001:827::200a
2a00:1450:4001:829::2004
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2002
2a00:1450:4001:830::200e
2a00:1450:400c:c0c::9c
2a00:1450:4016:80a::2003
2a02:26f0:480:22::1726:62ed
2a02:26f0:480:f::213:7ecb
2a02:26f0:480:f::213:7ecd
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42:600::396
2a06:98c1:3121::3
3.160.212.84
35.171.143.69
35.71.131.137
65.9.78.118
95.101.111.170
0230b6bfd680cadb8d845fbb4e2c1e791a932feb18b9830acabc9e06b93d5173
02b84e736e3e920b410cee6f35e14cbdefa12c25c6c9258a40537994fc363887
04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd
07798aefac4b07384f081d67086d85ef952443cd6e557b59bc2addac577d01c6
09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
0d8e30adfec247d61be8172549cc16e36bd1eb63859b8e818aa0f9965b4dcaef
0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c
130db69d79e142617cba14a6fd7f2c924ed82e8d3685fed44bfee67f0716406a
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
199a07091795dc18d5f648c8ae6ea323b953a6232f814e35c0217925de105a94
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d
1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70
1a949852daa2fe2be0d5e7dfbf2d0edf71121b49a82b1d82992aa8aa9b7c2d9b
1d4548c03b28521204ab490e46b39179b8fa196998d45215a24602306b662ab5
2313db376493c2972f3066a843bc5d5ffaa4e13fd04aeffea0f4c0fe2e892662
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4
262c51d03e4bdb5c91511e2df131b608a522b7a96c6a89048ceb90084b3402dc
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
29d170b4f372603eff8bafec8eedd2dc57712f5e38b276f31c4a5295eeeb9de3
2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376
2e5436b217fb1a7d9d2365cccfcc95e7483fcba03205c3a216d512302e982d4d
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
37fba80f768248b9c3497155b91fac4908a32202d60da17342205a9042374597
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52
3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d
3dcf5ab0268e05f2e26960055d40e37a5ec0cb225dcc9da43f52967710cea56b
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
46bf25777096ef50be3de3b3793ee7cf44f9912016c5553cb448844ad5d4003c
4729e565155f59f492b3baa57a57c49f4bf16dbb93b260f6eb3e0c013667554c
483c99901b2a42680f2a3c5540a8c6fefc18ca555e3e318480e88c9ffc863df3
48caefba7197eca695349c196a4fb51a5998c8f3bd365988462d71e3c65a4b1d
4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
4fe6def01e693b4ff7f8a5baa5663c2b2eb7a228d7eb28ca379d255b640df211
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
68858bf90cb3efb40b74dc096a0c14d3d7d8df522e30067cbee82f0640af2bab
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250
6e4d408ece6803ecb0c2356f7c16a9e1acdbf01228830ac38274ec1ada687e36
6ff2cb75e9629684295d538513cddd941b0bfa7072cd3c6536e6905f6fe921ff
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
7426c1c0d2289ccde69718bb10ae44a1a6602702194410999afb700e1e580d94
77b1e37a44606f04534b026795250cfb8f06416adbe129533a6d855e9b573f67
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
7f2c11beb683ce4c0f2fe90a6982fe616335450ac71b03144e55bc2dcdca1445
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270
867e2af897e43a15b5cb0cbf905ba563964426f8707d602891643fe039aa2566
86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875
94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2
95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70
96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729
96ea6b1e986879257e104371bf5f0cb0bf2bb9957a1aa73fa9df8be99aeeb157
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
a33e9e7eec5c6cad6813efe83bd80c8886afd9c4f54d2afcb069808fb19f254f
a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2
abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b452e67d0f273f9147920b2ec0783838b1ee33727eb9c6fae0a7cff22bf0ac85
b99e57a180459ef9973b9bb3f41ce4a28c015ac31ec686c087bf21f42d366608
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4
c889e86e6c42fc475d139233bc09a8fe599673cfeebe015bd3083cd1ea994e93
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe
cc3652de6720e88bb9378b09d34a2e807d1706b7a59a2d29903a68fa481759d5
cebbc0e23f1d58a574eab9a677d14629b3aa59a6fbfb0133feb3e03f0e43f754
d09af97ee06f58b7c0e071433e4f08dcfc244e3786639a601e31d3227418473a
d0f80d27eb235c529b6f87057ab7763ab82f8eb2396e8d40df573eb80e5364ec
d57a29c035e1164e865f08b030edaa603ee2a60d806138df4c2975eac83cb08f
d58fcc9b037c7817d2d7565a677f19616b2ca13d2575df0a2c82f4ad60b0ec87
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
d70b09c137b590b37ac92fdc7d6501e1beab2d7bcafa9230383cb2dd61aeadd5
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddb82c84e1cb4f9ed0e23ada938029f0ac7a79f8a8215eee7bd5177726c02c32
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e10ce26ead0eca58cd5346843538415611b745bfd29825322efad56424a4c911
e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc
e600901c3822e2410c8113d763d1f8babb08aab7d06aa1c861be265408cdf649
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb8d8c2427fab53f2c4d0c70d9661c7d33d995e486cdb923b0c6d65b6b4fef19
ec283af1b220ae388d616832c82a2612f2630ac572784dd39b6d2c5b8e81e7aa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c
f54b61a120e0240c98428d76beab031099f4f0379cbc623de071277255088fdc
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f827ec383239317deb9387ea204a9a0089594aaa0a763922e3d85222010531e2
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff5b2a04410456da0a8e7d8a4db3eacf62ab980e163a500b81781ea6c5b0a73b

www.reversinglabs.com Open in urlscan Pro 2606:2c40::c73c:67e1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

151 Requests

99 %HTTPS

77 %IPv6

38 Domains

54 Subdomains

48 IPs

4 Countries

3506 kBTransfer

7049 kBSize

35 Cookies

25 Outgoing links

Redirected requests

151 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:67e1 Public Scan

Screenshot
Live screenshot

Full Image

151
Requests

99 %
HTTPS

77 %
IPv6

38
Domains

54
Subdomains

48
IPs

4
Countries

3506 kB
Transfer

7049 kB
Size

35
Cookies

151 HTTP transactions
1 data transactions