urlscan.io logo urlscan.io
SecurityTrails logo

www.rapid7.com Open in urlscan Pro
3.161.82.84  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Submission: On July 04 via api from BY — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 3 countries across 15 domains to perform 85 HTTP transactions. The main IP is 3.161.82.84, located in United States and belongs to AMAZON-02, US. The main domain is www.rapid7.com. The Cisco Umbrella rank of the primary domain is 127570.
TLS certificate: Issued by Amazon RSA 2048 M03 on August 15th 2023. Valid for: a year.
This is the only time www.rapid7.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 27 3.161.82.84 16509 (AMAZON-02)
1 104.18.167.88 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:200... 54113 (FASTLY)
6 104.17.72.206 13335 (CLOUDFLAR...)
1 104.16.92.80 13335 (CLOUDFLAR...)
2 104.17.25.14 13335 (CLOUDFLAR...)
13 13.32.121.30 16509 (AMAZON-02)
3 216.58.206.68 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
7 2606:4700::68... 13335 (CLOUDFLAR...)
2 2001:4860:480... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 34.49.241.189 396982 (GOOGLE-CL...)
85 20
27    3.161.82.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-82-84.fra56.r.cloudfront.net
www.rapid7.com
1    104.18.167.88 (None, )

ASN13335 (CLOUDFLARENET, US)
opt.rapid7.com
3    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
6    104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)
information.rapid7.com
1    104.16.92.80 (None, )

ASN13335 (CLOUDFLARENET, US)
app-sj20.marketo.com
2    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
13    13.32.121.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-30.fra60.r.cloudfront.net
blog.rapid7.com
3    216.58.206.68 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s08-in-f4.1e100.net
www.google.com
1    2a02:26f0:3500:889::13b8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
cdn.optimizely.com
3    2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
7    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2606:4700::6811:c901 (United States)

ASN13335 (CLOUDFLARENET, US)
res.cloudinary.com
1    2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
7    2606:4700::6813:b234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
2    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
1    34.49.241.189 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 189.241.49.34.bc.googleusercontent.com
logx.optimizely.com
Apex Domain
Subdomains		 Transfer
47 rapid7.com
www.rapid7.com — Cisco Umbrella Rank: 127570
opt.rapid7.com — Cisco Umbrella Rank: 709684
information.rapid7.com — Cisco Umbrella Rank: 603468
blog.rapid7.com — Cisco Umbrella Rank: 631042
6 MB
8 gstatic.com
fonts.gstatic.com
www.gstatic.com
327 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 378
130 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 81
318 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 5
988 B
3 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
3 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2355
2 cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 3546
3 KB
2 optimizely.com
cdn.optimizely.com — Cisco Umbrella Rank: 805
logx.optimizely.com — Cisco Umbrella Rank: 1655
80 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268
35 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 653
295 B
1 bing.com
bat.bing.com — Cisco Umbrella Rank: 361
13 KB
1 marketo.com
app-sj20.marketo.com — Cisco Umbrella Rank: 468059
67 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 816
31 KB
0 googleusercontent.com Failed
lh6.googleusercontent.com Failed
85 15
Domain Requested by
27 www.rapid7.com 1 redirects www.rapid7.com
code.jquery.com
13 blog.rapid7.com www.rapid7.com
7 cdn.cookielaw.org www.googletagmanager.com
cdn.cookielaw.org
7 fonts.gstatic.com fonts.googleapis.com
6 information.rapid7.com www.rapid7.com
information.rapid7.com
3 www.googletagmanager.com www.rapid7.com
www.googletagmanager.com
3 www.google.com www.rapid7.com
www.gstatic.com
code.jquery.com
3 fonts.googleapis.com www.rapid7.com
client
2 region1.google-analytics.com www.googletagmanager.com
2 res.cloudinary.com www.rapid7.com
2 cdnjs.cloudflare.com www.rapid7.com
1 logx.optimizely.com cdn.optimizely.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 bat.bing.com www.googletagmanager.com
1 www.gstatic.com www.google.com
1 cdn.optimizely.com opt.rapid7.com
1 app-sj20.marketo.com www.rapid7.com
1 code.jquery.com www.rapid7.com
1 opt.rapid7.com www.rapid7.com
0 lh6.googleusercontent.com Failed www.rapid7.com
85 20
Subject Issuer Validity Valid
www.rapid7.com
Amazon RSA 2048 M03		 2023-08-15 -
2024-09-13		 a year crt.sh
opt.rapid7.com
Cloudflare Inc ECC CA-3		 2023-09-25 -
2024-09-24		 a year crt.sh
upload.video.google.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
information.rapid7.com
E1		 2024-05-19 -
2024-08-17		 3 months crt.sh
app-sj20.marketo.com
Cloudflare Inc ECC CA-3		 2024-03-02 -
2024-12-31		 10 months crt.sh
cdnjs.cloudflare.com
E1		 2024-06-02 -
2024-08-31		 3 months crt.sh
blog.rapid7.com
Amazon RSA 2048 M02		 2024-04-05 -
2025-05-04		 a year crt.sh
*.google.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
cdn.optimizely.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-09-01 -
2024-09-04		 a year crt.sh
*.google-analytics.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.gstatic.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.cloudinary.com
Go Daddy Secure Certificate Authority - G2		 2024-04-23 -
2025-05-25		 a year crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 04		 2024-06-19 -
2024-12-16		 6 months crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2024-03-01 -
2024-12-31		 10 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2023-11-13 -
2024-11-12		 a year crt.sh
logx.optimizely.com
WR3		 2024-05-23 -
2024-08-21		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Frame ID: 19FEA8BDE31E09F64EE1DE9BD33C74A4
Requests: 81 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=1ubs5t646vqd
Frame ID: 1C32517F04203DE3579E097ED3EE4051
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=rcva76bw32pl
Frame ID: 35EC6A2E306E4EE5A3C0CD74A9B20F45
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=rcva76bw32pl
Frame ID: A822DC08C4721034D04905A63878020C
Requests: 1 HTTP requests in this frame

Frame: https://information.rapid7.com/index.php/form/XDFrame
Frame ID: 4FC6B8AF5F683A3664B67B64DDFBC15A
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Fake Update Utilizes New IDAT Loader To Execute StealC and Lumma Infostealers | Rapid7 Blog

Page URL History Show full URLs

  1. https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-... HTTP 301
    https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • optimizely\.com.*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

85
Requests

96 %
HTTPS

58 %
IPv6

15
Domains

20
Subdomains

20
IPs

3
Countries

7522 kB
Transfer

10636 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers HTTP 301
    https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

85 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Redirect Chain
  • https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers
  • https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
108 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
44c801d9e0081f0b1326239a0d7b57aba16f5d64befba9bd7172949684603930
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
private
content-encoding
gzip
content-security-policy
frame-ancestors 'self' https://*.rapid7.com
content-type
text/html; charset=utf-8
date
Thu, 04 Jul 2024 00:41:11 GMT
vary
Accept-Encoding
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-id
YeylRGrbMk91e_1vvrmh4wZJFF1Vfpr433jig4DO8HV8dv_r_L-DEA==
x-amz-cf-pop
FRA56-P10
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

content-length
245
content-security-policy
frame-ancestors 'self' https://*.rapid7.com
content-type
text/html; charset=UTF-8
date
Thu, 04 Jul 2024 00:41:07 GMT
location
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-id
nBeH-Yb19QesUJGDrf6O6oUe5AKLQ8-ZPiPM-5zGJNoW2soulLC2xw==
x-amz-cf-pop
FRA56-P10
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
21485331595
opt.rapid7.com/edge-client/v1/13222550/ 		76 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://opt.rapid7.com/edge-client/v1/13222550/21485331595
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.167.88 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec0bf416c92b08efb33a89a4cc6c188e4bd17adbce829f7d756f2d592227f1ca

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=0, no-cache, no-store, must-revalidate
cf-ray
89db118ffd209bfb-FRA
alt-svc
h3=":443"; ma=86400
all.min.css
www.rapid7.com/includes/css/ 		541 KB
81 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
5bffb19cfe9242c25310ba6318a1f11c013f67de7d0d4bf3aaec9cc8e0a1fd7c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:10 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:49:19 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"80d927f961c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
Q53QpWFC_t-H4kfEVc24hjCiUjdFP_nj3HYmAhOaEOxB0qz3xNBeLw==
x-xss-protection
1; mode=block
page.blog-resources.min.css
www.rapid7.com/includes/css/bundles/pages/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/css/bundles/pages/page.blog-resources.min.css?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
83beb2d136de860d2dc5be2f0ccaa3e8f6c8b3641447a5ac6ee79f5c49f5e4c3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:11 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:55 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"8049603262c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
GSNPHpZjsj_mPdavCsASmdfTnPngM1wQHMq8usxTLXQDnXUgxrXbLA==
x-xss-protection
1; mode=block
block.blog-featured-posts.min.css
www.rapid7.com/includes/css/bundles/blocks/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-featured-posts.min.css?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
07d48253b2a1bf57eab69336d406dd07c1e4ca5f79b3dffc5deb7036aa775d42
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:11 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:46:00 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"0dc8a8261c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
ydpnZm4YhROAYtxPYMveiYBuwFTpuOfA9KJQ8tliy-V6xROrTtPJSQ==
x-xss-protection
1; mode=block
block.blog-single-post.min.css
www.rapid7.com/includes/css/bundles/blocks/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
d230bbe71c0b14f8b3bbfea2a8ab1161b617a495d762f80631727e4d87e2252c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:11 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:54 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"0b3c73162c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
Yp8T6vd2fi4P1N2iG8YXQBc3TJ5tfpXmOJzilJKgAvj4wFtHvp3hxQ==
x-xss-protection
1; mode=block
block.blog-related-posts.min.css
www.rapid7.com/includes/css/bundles/blocks/ 		796 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-related-posts.min.css?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
261a3512eac3020f03e10a49b52dfe3d03cac16be2287fa2ea066f4f280edd84
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:09 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
x-cache
RefreshHit from cloudfront
content-length
796
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jun 2024 13:49:20 GMT
etag
"070c0f961c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
no-cache
accept-ranges
bytes
x-amz-cf-id
DiYZEtFkx8EgbkQ14nmApfgVwj_7-GYOSOtVPNM4cnYnNtXFpb81tA==
css2
fonts.googleapis.com/ 		10 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Mulish:wght@800;900&family=Roboto:wght@300;400;700
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ff9895e1e0159ec83286496ded84606fe97d4f66bafb2ac50f47aa4e81bd2490
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 04 Jul 2024 00:41:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 04 Jul 2024 00:41:15 GMT
jquery-3.6.4.min.js
code.jquery.com/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.4.min.js
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
25253069
x-cache
HIT, HIT
content-length
31011
x-served-by
cache-lga21953-LGA, cache-mxp6949-MXP
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1720053676.573784,VS0,VE0
etag
W/"28feccc0-15ec3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
178, 2405
populateCountryState.js
www.rapid7.com/includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/js/populateCountryState.js
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
86f70df17d2db50839e6ffd22a3a1cbe152db714041146f8129edf72f7f78103
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:11 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:46:02 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"09bc8361c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
O57LpLCtWtg10p8zwXiLoOpI2I8zWCkjhadcKIQRtaEUSLetWGfiOg==
x-xss-protection
1; mode=block
forms2.min.js
information.rapid7.com/js/forms2/js/ 		199 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/js/forms2/js/forms2.min.js
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 30 May 2024 20:57:39 GMT
server
cloudflare
etag
"1540300-31b30-619b21e0856c0"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
89db11907f466a78-TXL
expires
Thu, 04 Jul 2024 04:41:15 GMT
forms2.min.js
app-sj20.marketo.com/js/forms2/js/ 		199 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app-sj20.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
last-modified
Thu, 30 May 2024 20:57:39 GMT
server
cloudflare
etag
"d011fe-31b30-619b21e0856c0"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
89db1191791f2681-TXL
expires
Thu, 04 Jul 2024 04:41:16 GMT
a11y-dark.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/styles/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/styles/a11y-dark.min.css
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb30e0c12d8ad8be9c0c517226ba4ffa88802ce495dada60b6f7494075a8a133
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2344714
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
419
last-modified
Sun, 17 Oct 2021 22:37:02 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"616ca58e-1a3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z6uvJE%2BHWzxv3ObBBZyuj2S8CKIThwGEKajkIj2r8gxs5l2i8M95%2FqybIAdC3nRjbRzEKunKbkmi5jrVfEJx8xt%2F3t8tk%2BnK0T1rEOQyRabiB1ttMlK4XU%2Fltrya1Hi0bwSsVtmg"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
89db118fde518fda-FRA
expires
Tue, 24 Jun 2025 00:41:15 GMT
Rapid7_logo.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
c65ffa9b8e350747e5dec76cbf16729482008fa1b57be07c53d3c509bebcfadd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:10 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:49:18 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"0438ff861c9da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
oxNOQBobv7etOll4311Dj0l3pqHKp6U-VocyEnm6bnyWybA-0wEmTQ==
x-xss-protection
1; mode=block
icon-lock.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 		1 KB
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/icon-lock.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
9904ff6810e17c1ffc108bf92dbee7f8a6318d0c8c58c1d70555d0a3945fb9da
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:10 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:49:18 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"0438ff861c9da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
WrkTyKZHmGYv6bqRQdcVjmAYZe1sXbN6x_wb13r7ov-fRKCRPOybpQ==
x-xss-protection
1; mode=block
Rapid7_logo-short.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 		497 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo-short.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
ac2a270e60c15fdaaf9957f52bab00aaefd32ac7782a62b141c66c2ce3f6369c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:12 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:52 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"086963062c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
content-length
497
x-xss-protection
1; mode=block
x-amz-cf-id
wjfyCynrgPmAw2v3Dphs6a_xYSP7Usf81ie1cnIAirfBLGKcB14CDA==
minerva_blog_image-cf.png
blog.rapid7.com/content/images/2023/09/ 		130 KB
131 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/09/minerva_blog_image-cf.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
d166654b7252063c66c3aa08cf44ebeb63b29aa2fbe06c408004801b8cd94bb2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
133023
Last-Modified
Mon, 11 Sep 2023 13:56:16 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"2079f-18a84875488"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
nTFx1Uevu3gm3EVDIqYi_7t3np0e1_3pnaZT3iHlh97wSqDvwr_kJg==
Screenshot-2023-11-07-at-10.22.04-AM.png
blog.rapid7.com/content/images/2023/11/ 		241 KB
242 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.22.04-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
d8d3007090d651a4e6e6a4f9012e57603c4dc69c7eaba85346891eac7e7dbabe
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 bf791e1829ff18782cd9837fbba03616.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
246848
Last-Modified
Tue, 07 Nov 2023 16:22:08 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"3c440-18baa975f2e"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
95x25AibIRQD46eObqLMU0OMVcQDx_p2iYxSDTitNDV-ZlTZNRDYdg==
Screenshot-2023-11-07-at-10.22.50-AM.png
blog.rapid7.com/content/images/2023/11/ 		298 KB
298 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.22.50-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
db56e6f7a4995919795a439701c66e4f62ce9f395906f1828329a03feac5066b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 6fd3ab2be93b19c970fb371964d46d94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
Miss from cloudfront
Connection
keep-alive
Content-Length
304770
Last-Modified
Tue, 07 Nov 2023 16:23:16 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"4a682-18baa98653a"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
Nh3JcyBl5tMuRyemt_godRXDgfuDqMit-_ryDVzqIl_kkqlxk0pRYQ==
Screenshot-2023-11-07-at-10.25.02-AM.png
blog.rapid7.com/content/images/2023/11/ 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.25.02-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
c3bbe5bd6f67c80927384d8b7a36f0b12004d473db805ac6cf628f6fca4aef87
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
1675599
Last-Modified
Tue, 07 Nov 2023 16:25:15 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"19914f-18baa9a36a2"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
niHXfAKz49sKQO3jDtYBlkWy7Qd_CdJLLdFLa_q0pLrdb-D3w-qVEQ==
Screenshot-2023-11-07-at-10.25.54-AM.png
blog.rapid7.com/content/images/2023/11/ 		822 KB
822 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.25.54-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
e2419c64b5a072138b4571c9dfaa612be80e4d3baeef696c8b53cd9c842087ee
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
841336
Last-Modified
Tue, 07 Nov 2023 16:25:59 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"cd678-18baa9ae3fa"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
uKIjSxHaUe4MrqRHddFsEKoKzMivxtKkZls6z75LzOf7EP1udd639A==
Screenshot-2023-11-07-at-10.26.38-AM.png
blog.rapid7.com/content/images/2023/11/ 		867 KB
868 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.26.38-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
8eeb6d6aac11fcf7041b7fac8be5cff5a8bab6b18a4cc3443bc66e1808934f07
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
888246
Last-Modified
Tue, 07 Nov 2023 16:26:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"d8db6-18baa9b910a"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
NByGRdSm0V0VhTKdF3ol0iyiwArNDNHjhJ52MwGteFnIARpOMg5mDQ==
Screenshot-2023-11-07-at-10.27.30-AM.png
blog.rapid7.com/content/images/2023/11/ 		711 KB
712 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.27.30-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
78c7caceadd5d2674a384d3d2d26c7f6c95bc0b892df9b580d94ae4baa97369a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
728139
Last-Modified
Tue, 07 Nov 2023 16:27:35 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"b1c4b-18baa9c59f2"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
trA9882ocPhk_XgkxwyTEYlXo4tuYs9O57sSE3BOCGm86PSqc-7F1w==
Screenshot-2023-11-07-at-10.28.26-AM.png
blog.rapid7.com/content/images/2023/11/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.28.26-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
fb483fc8126d5dd7b12c77b8cd2176ec9567a8b62e56dde2ab8f92bc1d15a7f4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 bf791e1829ff18782cd9837fbba03616.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
26445
Last-Modified
Tue, 07 Nov 2023 16:28:29 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"674d-18baa9d2cea"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
tJeJ10zZNCj0pWI8ua_eQ8FDGjQCZEblWbrInzcPRBJ8UdNkylK35g==
CKIeq3iK_IHy2wNzhbU9v_3yVZ-ZI8MFxUWv0m8KDCoe-A_D5GUAeNhj9rFde177LKgK73k6yuwTWVf3A4JJQzbHWtAxWoC_UhulLm9k9TqIhH0uv8lcvgzdgH9Z8TwJI47uq0kIBj9Wb8kl92zeWzU
lh6.googleusercontent.com/ 		0
0
Screenshot-2023-11-07-at-10.29.14-AM.png
blog.rapid7.com/content/images/2023/11/ 		861 KB
862 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.29.14-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
c139bfffcc61675fde914086179dc99d37a9f8a52b34245ac61d92c4f25608e5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:18 GMT
Via
1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
881933
Last-Modified
Tue, 07 Nov 2023 16:29:18 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"d750d-18baa9deda6"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
hI8aD98qXGp5jvhBaU4iBLv3QQBvIEc8z-ZgMe-T_JZDUZ0XRq6rHw==
Screenshot-2023-11-07-at-10.29.57-AM.png
blog.rapid7.com/content/images/2023/11/ 		46 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.29.57-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
8cbb84011f3f2dc41f2da385bc88e6bd084eeaa1ed94d1a26d8592ac34bc96c3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
47309
Last-Modified
Tue, 07 Nov 2023 16:30:01 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"b8cd-18baa9e944a"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
Ro-n6KgWBKWtcHfNZhWYLtWMXkAy4oPy2EyGNcjp2Zasgv1vRbtJPg==
Screenshot-2023-11-07-at-10.30.45-AM.png
blog.rapid7.com/content/images/2023/11/ 		69 KB
70 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.30.45-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
d0e01c354180fc37129a0ea63dd041814428290fbbe3b22866ecece2b56be7da
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
70901
Last-Modified
Tue, 07 Nov 2023 16:30:49 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"114f5-18baa9f4fca"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
C8bY70yniEo3I8qwwyVbAeDup7VFYp29lYxmazLnY0MZi0GcWlecAg==
Screenshot-2023-11-07-at-10.31.33-AM.png
blog.rapid7.com/content/images/2023/11/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/11/Screenshot-2023-11-07-at-10.31.33-AM.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
189a0c040751daec5172415124ecd3934c261955edcd43b0ee434f4094a9a6c5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:18 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
88221
Last-Modified
Tue, 07 Nov 2023 16:31:36 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"1589d-18baaa008a7"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
jWjd6xvfLG4_n4WKB8Yw_wOafMSRDkq4NnYKg08fa9GLTw1bbY9T0Q==
xyU47bkeYKtttXdQ9SCSiGEdH4iQPzVF4GYUfqO1OPVA5Bnt3v3-xdstEcNnxIxSMzoKM6kG1Ds2dZMaJ8xvMQnsFyHSoDPnJ9Sf4iOiAYMFCpSwNmLF_2uhoqBt1TGYDBkw3Z9GqYvvs2KRNFOTXac
lh6.googleusercontent.com/ 		0
0
api.js
www.google.com/recaptcha/ 		1 KB
988 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s08-in-f4.1e100.net
Software
GSE /
Resource Hash
e9e79f253e5553cc1fc63e49e065e9a529d3ebc6864ac3ef1288aa1854d21302
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Thu, 04 Jul 2024 00:41:16 GMT
logo-black.png
www.rapid7.com/includes/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/logo-black.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
b3ba97f3a045ed917586356f411193b4548d91593729bcd31dccac1aa71f2b24
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:10 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
age
1
x-cache
Hit from cloudfront
content-length
1519
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jun 2024 13:49:20 GMT
etag
"070c0f961c9da1:0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
x-amz-cf-id
98MCwqaQg-Oj5nYR4XgTpUlBVcsbSTz0_bUJGXQBFQrqx-6jqKNAZg==
all.min.js
www.rapid7.com/includes/js/ 		260 KB
62 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/js/all.min.js?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
482ca4416575868c1f9c9573ae292d8f491b71ed5f97ef0bdcf7f57edd72c559
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:10 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:49:21 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56-P10
etag
W/"80659fa61c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
x-cache
Miss from cloudfront
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
cache-control
no-cache
x-amz-cf-id
JXru7ptYFMT4focEC1gc4CuiZcXzGzk7TG7t7awd0sO640Qgc0sd3Q==
x-xss-protection
1; mode=block
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/ 		111 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.3.1/highlight.min.js
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0028ae9273d2cecde304fb39566c6cf4b39fa897bbe4b7d2ea5ee944d8f0b079
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:16 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
193468
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
33913
last-modified
Sun, 17 Oct 2021 22:37:02 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"616ca58e-8479"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=an7wWNnQlEdK5HWdCZeRUBHJOHQUKukJhRMpv561AXXmJYbeYpow7ttd7wktEbErppcFpjEOokBBxIrMkqQSzeTx2rP2t7tLjTcrwyhCMMJC67h3gLk5YLLrQ9mXSt5opduOZMHd"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
89db1197fa368fda-FRA
expires
Tue, 24 Jun 2025 00:41:16 GMT
vidyard.min.js
www.rapid7.com/includes/js/bundles/shared/ 		283 B
723 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/js/bundles/shared/vidyard.min.js?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
42654a13059f95ad356ca471088bae32122ac69cc9b99b1323a1425ba93866c5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:11 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:49:21 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"80659fa61c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
application/javascript
cache-control
no-cache
accept-ranges
bytes
content-length
283
x-xss-protection
1; mode=block
x-amz-cf-id
oQraAR2KAnEBCiDtri7_XCTb4djAd8w6pUnayUD5_9o09FiRHXFNdw==
block.blog-tags-list.min.js
www.rapid7.com/includes/js/bundles/blocks/ 		874 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/js/bundles/blocks/block.blog-tags-list.min.js?cb=1719580522500
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
2a2b43f7170d6f56ea9a6617199e00a1621d508f265b447dbb916e87f8c57ba9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:56 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"0e0f83262c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
application/javascript
cache-control
no-cache
accept-ranges
bytes
content-length
874
x-xss-protection
1; mode=block
x-amz-cf-id
JNDxOwE4ZhvpOfqXuZd_uHzcty4EGIWgi9bpSmc5tV4JjiImQCvsPA==
1993_f3d0508710cf3eb6d3a76a46152590457c245646b01e42c45a2ab66890012a1e_tracking.js
cdn.optimizely.com/public/13222550/21485331595/ 		262 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.optimizely.com/public/13222550/21485331595/1993_f3d0508710cf3eb6d3a76a46152590457c245646b01e42c45a2ab66890012a1e_tracking.js
Requested by
Host: opt.rapid7.com
URL: https://opt.rapid7.com/edge-client/v1/13222550/21485331595
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:889::13b8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f3d0508710cf3eb6d3a76a46152590457c245646b01e42c45a2ab66890012a1e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-meta-pci_enabled
False
x-amz-version-id
05nwvugP.bVqQOltAZZDzTMd8clm6vc7
content-encoding
br
date
Thu, 04 Jul 2024 00:41:17 GMT
strict-transport-security
max-age=15768000
x-amz-request-id
9DD63J29VFK5MBV9
x-amz-server-side-encryption
AES256
x-amz-meta-revision
1993
x-amz-replication-status
COMPLETED
server-timing
cdn-cache; desc=HIT, edge; dur=1, cdn;desc="AkamaiION";dur=0,rtt;desc="40";dur=0,cdnip;desc="2a02:26f0:3500:889::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0, ak_p; desc="1720053677104_388276621_1918305459_39_1563_40_44_146";dur=1
x-amz-id-2
vtbzeqsvpz+JnP9UPE2bIjEAaVowBOUUnevth0Y6RdNhU9xGQu2D8y/3ciBbXT7I+B8WsozYu/U=
last-modified
Mon, 01 Jul 2024 21:04:05 GMT
server
AmazonS3
etag
"ebe23791b8815f371d22ccdd28e2acb6"
vary
Accept-Encoding
access-control-max-age
86400
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
access-control-expose-headers
x-amz-meta-revision
cache-control
public, max-age=315360000, immutable
timing-allow-origin
*
access-control-allow-headers
*
css2
fonts.googleapis.com/ 		11 KB
906 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
42d83450e41e8f068fa4afb9194a54a18715aea5923bb7a8e7381c4554abccb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 04 Jul 2024 00:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 03 Jul 2024 22:51:03 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 04 Jul 2024 00:41:16 GMT
css2
fonts.googleapis.com/ 		2 KB
664 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Mulish:wght@400&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
726ae17a0fb81567b8ec6b892806fb51865914c7e04c7040070cddf76463d5da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 04 Jul 2024 00:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 04 Jul 2024 00:41:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 04 Jul 2024 00:41:16 GMT
gtm.js
www.googletagmanager.com/ 		471 KB
125 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
967d248f9ff67fffdb85724df3b1d19428d227cf24ad616258b81d205e10240b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
127533
x-xss-protection
0
last-modified
Thu, 04 Jul 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 04 Jul 2024 00:41:17 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 21:18:03 GMT
x-content-type-options
nosniff
age
530594
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 21:18:03 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 15:08:18 GMT
x-content-type-options
nosniff
age
120779
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 15:08:18 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/ 		534 KB
212 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 14:03:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38239
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
216123
x-xss-protection
0
last-modified
Sun, 23 Jun 2024 08:01:07 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 03 Jul 2025 14:03:58 GMT
Check.svg
res.cloudinary.com/spiralyze/image/upload/v1698411225/RAPID7/603/ 		263 B
747 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/v1698411225/RAPID7/603/Check.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c901 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e4d7cb0d3c44a8d0288dc03fe7c918dc9065b70df23a137578ae7ab2d1e4d24
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
content-disposition
attachment; filename="Check.svg"
server-timing
cld-cloudflare;dur=17;start=2024-07-04T00:41:17.635Z;desc=hit,rtt;dur=41,content-info;desc="width=40,height=40,bytes=263,o=1;"
content-length
263
last-modified
Fri, 27 Oct 2023 12:53:47 GMT
server
cloudflare
etag
"b92f3237dfd9f914877e2ca1db120d20"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,x-content-type-options
cache-control
public, no-transform, immutable, max-age=2592000
accept-ranges
bytes
cf-ray
89db119d3f471e59-FRA
timing-allow-origin
*
arrow-dropdown.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 		459 B
898 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/arrow-dropdown.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
a8aa8c94d42d57cd377de305aed2169249f6f6bd2fd31b5f1d2671cc1502a1d1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:45:58 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"0af598161c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
content-length
459
x-xss-protection
1; mode=block
x-amz-cf-id
FyIDHV_TMz5knwHl-gGIHyxUnxVAXzMDYZM-JOuYDRnfkNRgVXBccw==
linkedin-mini.png
www.rapid7.com/includes/img/blog/ 		817 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/blog/linkedin-mini.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
44fc485dc1ebae37e5b965b0295dd07e645a2a4065a68b1c2416d0911ac92007
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:56 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"0e0f83262c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
content-length
817
x-xss-protection
1; mode=block
x-amz-cf-id
AwzRwFLAQIZD6j1LXYPDllgI0hiyKfAwezhYdMBUtztLS5blmOQRCg==
twitter-circle-x-black.svg
www.rapid7.com/includes/img/blog/ 		955 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/blog/twitter-circle-x-black.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
edf0e39ce5b5fbe0b1f0d588772d7e028d2ec4274c97233463e4a49074c516fb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:12 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:46:02 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"09bc8361c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
content-length
955
x-xss-protection
1; mode=block
x-amz-cf-id
em6luz4VgH1vlw8NqQuHUvpDoOLMhSuqFNoeFsQ94IYnqbTWMBkxVQ==
facebook-mini.png
www.rapid7.com/includes/img/blog/ 		773 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/blog/facebook-mini.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
652667975f4e5bc9b68363e77211b87c5739566baed70c21fe835d7969995478
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/bundles/blocks/block.blog-single-post.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:47:51 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"801db4c461c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
content-length
773
x-xss-protection
1; mode=block
x-amz-cf-id
JtuuOghDpziO3V6rtU8Co3GTSNNep6O99yGr1LQgnpGKjRtZsd1Q4Q==
search-gray.png
www.rapid7.com/includes/img/ 		533 B
988 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/search-gray.png
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
4b20b79d8999b2516d971378ec1b7a3bb36108838a22d3c6f2e1d9a47dbe7f08
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:17 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
age
1
x-cache
Hit from cloudfront
content-length
533
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jun 2024 13:49:21 GMT
etag
"80659fa61c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
x-amz-cf-id
63mwn_yX0an7AC83gGdCU0bdaMqnR6PhHtR5KNTEmvr3vRsK4PJ_ZA==
linkedin-light.svg
www.rapid7.com/includes/img/ 		514 B
967 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/linkedin-light.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
2dd8e940e47cb067ab22aadfe8ccc4f744ddd724bfac7f058915413ae8974909
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:12 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
x-cache
Hit from cloudfront
content-length
514
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jun 2024 13:50:55 GMT
etag
"8049603262c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
x-amz-cf-id
vo2ipjNaFMG-VrrYt8EYinQOf4jDIQyRdjbIzQGIxO08ycl6s27f1g==
twitter-light-x.svg
www.rapid7.com/includes/img/ 		600 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/twitter-light-x.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
efb5baebac85cf97ef93ef492c1d222862cb3678b9e24ec4b396cfc8cea9edaf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:50:56 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"0e0f83262c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
content-length
600
x-xss-protection
1; mode=block
x-amz-cf-id
oSeuZM7M9cQEYXOu46W6m2wtERSWo2Nxq31FWH1y82Ju6GnFiCHeSw==
facebook-light.svg
www.rapid7.com/includes/img/ 		323 B
760 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/facebook-light.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
8f0a8aeb7295594ad2a432cb24687f3bc9eef6837443f73a5aa7aeea7417e268
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:47:51 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"801db4c461c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
no-cache
accept-ranges
bytes
content-length
323
x-xss-protection
1; mode=block
x-amz-cf-id
sYNQFtUuYDCN8tIm2qPPdsxwO45JCqoPYDwPwSnCbFwFFpuGawHqMg==
instagram-light.svg
www.rapid7.com/includes/img/ 		1 KB
987 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rapid7.com/includes/img/instagram-light.svg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
7d7f64f89927a0c843f4ae2f589c776643aa23ead9ce829bb39c8f3a40d4955d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:41:17 GMT
last-modified
Fri, 28 Jun 2024 13:49:20 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
W/"070c0f961c9da1:0"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
x-cache
Hit from cloudfront
cache-control
no-cache
x-amz-cf-id
gyZ_ka0JO5I7kstsOfSOugjzYGwrn5i6VUOUTqxK1wOSin2H7czStA==
x-xss-protection
1; mode=block
1Ptvg83HX_SGhgqk3wot.woff2
fonts.gstatic.com/s/mulish/v13/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/mulish/v13/1Ptvg83HX_SGhgqk3wot.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Mulish:wght@800;900&family=Roboto:wght@300;400;700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7f0f781820c8de56bd6699ac9570ff90634de4eb5cca7ef4b573bb90619e5a5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 05:15:56 GMT
x-content-type-options
nosniff
age
588321
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30096
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 23:18:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 05:15:56 GMT
rapid7-icon-font.woff2
www.rapid7.com/Areas/Docs/includes/plugins/rapid7-icon-font/fonts/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/Areas/Docs/includes/plugins/rapid7-icon-font/fonts/rapid7-icon-font.woff2
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
04c1c1767e4e114200209ffb70e66b744ddbf113566215117e23cfb600070a36
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/includes/css/all.min.css?cb=1719580522500
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Jun 2024 13:47:48 GMT
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
etag
"05aeac261c9da1:0"
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
application/font-woff
cache-control
no-cache
accept-ranges
bytes
content-length
72104
x-xss-protection
1; mode=block
x-amz-cf-id
BboEgD_wGUlGyyAfFhbiTRxA18PgsS_m-Uv6yDHZ625LFs4x_TpcXQ==
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 21:09:34 GMT
x-content-type-options
nosniff
age
531103
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15752
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 21:09:34 GMT
1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2
fonts.gstatic.com/s/mulish/v13/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/mulish/v13/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Mulish:wght@400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e7fe0edbc32bbda00bdef6dc0241bc78277a37d4ceeab5991c64d11915746b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 14:57:04 GMT
x-content-type-options
nosniff
age
121453
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13508
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 23:29:27 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 14:57:04 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 21:09:32 GMT
x-content-type-options
nosniff
age
531105
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 21:09:32 GMT
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.rapid7.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 14:56:00 GMT
x-content-type-options
nosniff
age
121517
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9628
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 14:56:00 GMT
GettyImages-1128503636-1.jpg
blog.rapid7.com/content/images/2023/08/ 		348 KB
349 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.rapid7.com/content/images/2023/08/GettyImages-1128503636-1.jpg
Requested by
Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-30.fra60.r.cloudfront.net
Software
nginx/1.14.0 (Ubuntu) / Express
Resource Hash
86367af4f598389eab5b4ae3f741af306a83d09d6ef7dc1f2700339b35b57d3e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
frame-ancestors 'self' https://www.rapid7.com
Date
Thu, 04 Jul 2024 00:41:17 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Powered-By
Express
X-Cache
RefreshHit from cloudfront
Connection
keep-alive
Content-Length
356635
Last-Modified
Thu, 31 Aug 2023 21:44:11 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
W/"5711b-18a4d8dc78a"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
X-Amz-Cf-Id
baSVOSb5jH_dIwBeHDOUN5vLfUaYFujv3qAM0HNOqH0iCT_32wqjGg==
getForm
information.rapid7.com/index.php/form/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/index.php/form/getForm?munchkinId=411-NAK-970&form=4144&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&callback=jQuery371012458364087515861_1720053677004&_=1720053677005
Requested by
Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5dc03c1dac3aad562da399430ebf1f3cc0169ac7d55d1d1161c82f6fbd4c89e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
gzip
server
cloudflare
cf-ray
89db119a68126a78-TXL
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
forms2.css
information.rapid7.com/js/forms2/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/js/forms2/css/forms2.css
Requested by
Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
last-modified
Thu, 30 May 2024 20:57:39 GMT
server
cloudflare
etag
"15402fc-3437-619b21e0856c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
89db119ccbce6a78-TXL
content-length
2623
expires
Thu, 04 Jul 2024 04:41:17 GMT
forms2-theme-simple.css
information.rapid7.com/js/forms2/css/ 		826 B
360 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/js/forms2/css/forms2-theme-simple.css
Requested by
Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 30 May 2024 20:57:39 GMT
server
cloudflare
etag
"d011f7-33a-619b21e0856c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
89db119ccbd26a78-TXL
content-length
242
expires
Thu, 04 Jul 2024 04:41:17 GMT
js
www.googletagmanager.com/gtag/ 		303 KB
100 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-XVK5E64NXZ&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f491cd8e416507e8795087dc76a1a50464a36a5d6857def1d024aa22566ff2c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
102678
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 04 Jul 2024 00:41:17 GMT
destination
www.googletagmanager.com/gtag/ 		272 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-1009321688&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ad61d8dcf52625a48e89733e4a0e161cf7900525c04cf4471dad059b92afacb2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
94602
x-xss-protection
0
last-modified
Thu, 04 Jul 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 04 Jul 2024 00:41:17 GMT
bat.js
bat.bing.com/ 		45 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 04 Jul 2024 00:41:17 GMT
last-modified
Thu, 29 Feb 2024 19:58:06 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 7A282153B6C2404AA1933065A927C4EC Ref B: FRA31EDGE0119 Ref C: 2024-07-04T00:41:17Z
etag
"01b4e9c496bda1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13261
anchor
www.google.com/recaptcha/api2/ Frame 1C32 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=1ubs5t646vqd
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s08-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-hPhQstJZ3aazdZoYSx1NQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.rapid7.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-hPhQstJZ3aazdZoYSx1NQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 04 Jul 2024 00:41:17 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
anchor
www.google.com/recaptcha/api2/ Frame 35EC 		0
0
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
022e2f39deba7f332eabe69b27b31d98d4d5f2535116745957a691d1b1ec4cc5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ceCldLDyZN6bSQL6yyKLMg==
age
61149
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6882
x-ms-lease-status
unlocked
last-modified
Mon, 01 Jul 2024 16:41:58 GMT
server
cloudflare
etag
0x8DC99ECB953503A
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
b3b66eb3-701e-0008-02df-cb88f9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db119f384b37d2-FRA
expires
Thu, 04 Jul 2024 07:42:08 GMT
anchor
www.google.com/recaptcha/api2/ Frame A822 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=rcva76bw32pl
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.4.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s08-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Xn3wtJq962ySTS_MLL0vGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.rapid7.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-Xn3wtJq962ySTS_MLL0vGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 04 Jul 2024 00:41:17 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-XVK5E64NXZ&gtm=45je4730v877027019z876010864za200zb76010864&_p=1720053676989&gcs=G100&gcd=13p3pPp2p5&npa=1&dma_cps=-&dma=1&tag_exp=0&cid=180524361.1720053678&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_s=1&sid=1720053677&sct=1&seg=0&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&dt=Fake%20Update%20Utilizes%20New%20IDAT%20Loader%20To%20Execute%20StealC%20and%20Lumma%20Infostealers%20%7C%20Rapid7%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&ep.hit_timestamp=2024-07-04T02%3A41%3A17.598%2B02%3A00&ep.gtm_version_info=GTM-WBTPTVC_372&ep.custom_pagepath=www.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&ep.content_group=%2Fblog%2Fpost%2F%20-%20detection%20and%20response%2Cresearch&up.auth_flag=false&up.customer_flag=false&up.trial_user_flag=false&tfd=5061&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XVK5E64NXZ&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 04 Jul 2024 00:41:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.rapid7.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
XDFrame
information.rapid7.com/index.php/form/ Frame 4FC6 		2 KB
892 B 		Document
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/index.php/form/XDFrame
Requested by
Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b27b9c511b0e0bede3a2af771127be6529198c82c3a4c51f8ad8b23454ad1ccd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.rapid7.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
89db11a19dce6a78-TXL
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 Jul 2024 00:41:18 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
1b23d21a-86ff-483a-b234-d5d6ecbb43e7.json
cdn.cookielaw.org/consent/1b23d21a-86ff-483a-b234-d5d6ecbb43e7/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/1b23d21a-86ff-483a-b234-d5d6ecbb43e7/1b23d21a-86ff-483a-b234-d5d6ecbb43e7.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2880b7b9013570b3dd062b45571c82589f13665b0b3099956b986352aeaf133
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
13802
content-md5
GSnS3SKJgxkOHCQrz/Hghg==
content-length
1776
x-ms-lease-status
unlocked
last-modified
Fri, 14 Jun 2024 19:02:02 GMT
server
cloudflare
etag
0x8DC8CA47993AAAD
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
fc01b024-a01e-00ab-438d-be4498000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db11a25aa4925f-FRA
expires
Fri, 05 Jul 2024 00:41:18 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		59 B
295 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
accept
application/json
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
89db11a35c8c048b-FRA
access-control-allow-headers
Content-Type
events
logx.optimizely.com/v1/ 		0
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://logx.optimizely.com/v1/events
Requested by
Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/public/13222550/21485331595/1993_f3d0508710cf3eb6d3a76a46152590457c245646b01e42c45a2ab66890012a1e_tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.241.189 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
189.241.49.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 04 Jul 2024 00:41:18 GMT
via
1.1 google
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.rapid7.com
access-control-expose-headers
X-Requested-With,Content-Type,Accept,Origin,X-App-Trace-Id
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
X-Requested-With,Content-Type,Accept,Origin,X-App-Trace-Id,X-Optimizely-Strict
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-request-id
79ac5f7c-9463-443a-9db1-10da6394bdc5
forms2.min.js
information.rapid7.com/js/forms2/js/ Frame 4FC6 		199 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://information.rapid7.com/js/forms2/js/forms2.min.js
Requested by
Host: information.rapid7.com
URL: https://information.rapid7.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://information.rapid7.com/index.php/form/XDFrame
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 30 May 2024 20:57:39 GMT
server
cloudflare
etag
"1540300-31b30-619b21e0856c0"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
89db11907f466a78-TXL
expires
Thu, 04 Jul 2024 04:41:15 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.31.0/ 		334 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe4946db1f133c18e59bde7de4f6e87a50d288f85ec8440451b998e0f3f17e66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
D263R6OySncrpIc5uRH3nQ==
age
30689
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
80955
x-ms-lease-status
unlocked
last-modified
Fri, 11 Mar 2022 07:14:24 GMT
server
cloudflare
etag
0x8DA032EC5D12B02
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
202cb758-301e-0056-1408-7cc86c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db11a3cbf637d2-FRA
en.json
cdn.cookielaw.org/consent/1b23d21a-86ff-483a-b234-d5d6ecbb43e7/fb41beb5-0264-4c54-baff-36834e16400b/ 		111 KB
22 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/1b23d21a-86ff-483a-b234-d5d6ecbb43e7/fb41beb5-0264-4c54-baff-36834e16400b/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5e914e3054ceab821d55af5a8b0303385455c61d8c760262a5e77a8c32a23ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
16275
content-md5
RSG/8Sh8dd9Lz/BHEt1kZw==
content-length
22479
x-ms-lease-status
unlocked
last-modified
Fri, 14 Jun 2024 19:02:03 GMT
server
cloudflare
etag
0x8DC8CA47A4C6707
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
28d07c9b-301e-0026-558d-be083e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db11a47b76925f-FRA
expires
Fri, 05 Jul 2024 00:41:18 GMT
tags
www.rapid7.com/api/blog/ 		12 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/api/blog/tags
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.4.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
1f9516e8a33fad95a5c678151b024f6871eda22cfdb9383084ae4e1569cdfd9c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:14 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
cache-control
no-cache
x-amz-cf-id
KBK8ooRnkoXHek9ygglPFZI_8hzvHXVuFiY5IfIM_p--SO0rExM1VQ==
x-xss-protection
1; mode=block
expires
-1
Rapid7_logo_whiteappe.png
res.cloudinary.com/spiralyze/image/upload/v1611665075/RAPID7/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/v1611665075/RAPID7/Rapid7_logo_whiteappe.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c901 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f0141287e282ce1a704aa0699187a162c78ceeb166cca3b6b5b607eee79b52e
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 00:41:18 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
server-timing
cld-cloudflare;dur=18;start=2024-07-04T00:41:18.817Z;desc=hit,rtt;dur=43,content-info;desc="width=136,height=23;"
content-length
1826
last-modified
Tue, 26 Jan 2021 12:44:36 GMT
server
cloudflare
etag
"895dcd3b484eb556d025094589a5b7e9"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control
public, no-transform, immutable, max-age=2592000
accept-ranges
bytes
cf-ray
89db11a49c091e59-FRA
timing-allow-origin
*
favicon.ico
www.rapid7.com/includes/img/ 		1 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.rapid7.com/includes/img/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.161.82.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-82-84.fra56.r.cloudfront.net
Software
/
Resource Hash
0845ddb5526e7e542efc17fdd6cb9aa9fecb3d32a1bb1f786ec0c41f900f9db4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
frame-ancestors 'self' https://*.rapid7.com
date
Thu, 04 Jul 2024 00:41:13 GMT
x-content-type-options
nosniff
via
1.1 9ceaac5e4cbf8702556b2c925b200af8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P10
age
1
x-cache
Hit from cloudfront
content-length
1150
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jun 2024 13:50:55 GMT
etag
"8049603262c9da1:0"
x-frame-options
SAMEORIGIN
content-type
image/x-icon
cache-control
no-cache
accept-ranges
bytes
x-amz-cf-id
77lvPO8HnCku9yqKtEjSvnqB5zxHyrjVaJPGqw3QAAZhjdowx0zsrA==
otCenterRounded.json
cdn.cookielaw.org/scripttemplates/6.31.0/assets/ 		9 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/otCenterRounded.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea07c75cc70340374feb3872db77d7d5b74e6e8b62fd538f36209b1815ecd3d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
H5sekmzucUF8sFtSeINTKg==
age
86191
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2584
x-ms-lease-status
unlocked
last-modified
Fri, 11 Mar 2022 07:14:14 GMT
server
cloudflare
etag
0x8DA032EBF6EA85E
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
5e4936ed-501e-000d-3f11-1df157000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db11a53bc4925f-FRA
otPcCenter.json
cdn.cookielaw.org/scripttemplates/6.31.0/assets/v2/ 		47 KB
11 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/v2/otPcCenter.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
146697e686c91fde6e30955bc6cba7bfe752c511b2f27545a6938266e49cdfcd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ZpEAbh0BppVJFPu0Tn1v0w==
age
16275
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11558
x-ms-lease-status
unlocked
last-modified
Fri, 11 Mar 2022 07:14:15 GMT
server
cloudflare
etag
0x8DA032EC085471F
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
39a17ec4-001e-004d-4df1-1df66f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
89db11a54bc8925f-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.31.0/assets/ 		21 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42da203fcc4325bd58c8c868e9213def8ca9b8d58e79d68e86c0fd8a5744e72d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Jul 2024 00:41:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
2HSefDmVwJneRQMu6SXIPw==
age
46457
x-ms-lease-status
unlocked
last-modified
Fri, 11 Mar 2022 07:14:31 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
723ca00a-f01e-003b-594e-797c27000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
89db11a54bcc925f-FRA
truncated
/ 		817 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-XVK5E64NXZ&gtm=45je4730v877027019z876010864za200zb76010864&_p=1720053676989&gcs=G100&gcd=13p3pPp2p5&npa=1&dma_cps=-&dma=1&tag_exp=0&cid=180524361.1720053678&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_s=2&sid=1720053677&sct=1&seg=0&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&dt=Fake%20Update%20Utilizes%20New%20IDAT%20Loader%20To%20Execute%20StealC%20and%20Lumma%20Infostealers%20%7C%20Rapid7%20Blog&en=fetch_user_metadata&ep.hit_timestamp=2024-07-04T02%3A41%3A17.598%2B02%3A00&ep.gtm_version_info=GTM-WBTPTVC_372&ep.custom_pagepath=www.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&ep.content_group=%2Fblog%2Fpost%2F%20-%20detection%20and%20response%2Cresearch&_et=174&up.ga_client_id=180524361.1720053678.&tfd=10243&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XVK5E64NXZ&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.rapid7.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 04 Jul 2024 00:41:23 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.rapid7.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lh6.googleusercontent.com
URL
https://lh6.googleusercontent.com/CKIeq3iK_IHy2wNzhbU9v_3yVZ-ZI8MFxUWv0m8KDCoe-A_D5GUAeNhj9rFde177LKgK73k6yuwTWVf3A4JJQzbHWtAxWoC_UhulLm9k9TqIhH0uv8lcvgzdgH9Z8TwJI47uq0kIBj9Wb8kl92zeWzU
Domain
lh6.googleusercontent.com
URL
https://lh6.googleusercontent.com/xyU47bkeYKtttXdQ9SCSiGEdH4iQPzVF4GYUfqO1OPVA5Bnt3v3-xdstEcNnxIxSMzoKM6kG1Ds2dZMaJ8xvMQnsFyHSoDPnJ9Sf4iOiAYMFCpSwNmLF_2uhoqBt1TGYDBkw3Z9GqYvvs2KRNFOTXac
Domain
www.google.com
URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2JFwaAAAAAI4X5Ix2Jxu7lyXDUVm1U3sATX7a&co=aHR0cHM6Ly93d3cucmFwaWQ3LmNvbTo0NDM.&hl=en&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=invisible&cb=rcva76bw32pl

Verdicts & Comments Add Verdict or Comment

141 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 undefined| event object| fence object| sharedStorage object| gIp object| dataLayer object| optimizely object| optimizelyEdge function| $ function| jQuery function| initCountry function| updateCountryData object| MktoForms2 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data undefined| _ string| DATALAYER_OBJECT_NAME function| referrerOverride function| sendCampaignData function| initNewOptimizelyIntegration function| initOptimizelyIntegration function| _typeof2 string| detectedCountryIso object| detectedStateIso string| detectedContinent function| yall function| alphabetizeOptions function| _typeof string| selectedCountryDialCode string| selectedCountryIso object| selectedStateIso string| thisDomain boolean| hasGeolocationResult undefined| pageLang function| detectCountry function| defaultDataRegion function| localizeContent string| recapchaResponse function| tog function| getCookie function| initializeForms function| validateInput function| showError function| clearErrors number| isValid function| validateForm function| loadStep1 function| loadStep2 function| isPhone function| isNumeric function| trim function| isValidUrl function| trimEmail function| isValidEmail function| validateCompanyEmail function| validateFields function| formReseter function| _callMarketo function| _callNetsuiteFreemium function| _callSalesforceFreemium function| _callPlatform function| _callPlatformCustomer undefined| productList undefined| $toggleItem undefined| $dropdownItem undefined| a undefined| dataId function| updateValues function| ensureGuidValue function| generateGUID function| resetVideo function| initBgLazyLoad function| r7ExpansionHandler function| getUrlParameter function| heightMatchWidth function| populatePricingDropdown function| setFrequency function| setPlanPrices function| setFormOffset object| Foundation object| CoreUtils object| Box function| onImagesLoaded object| MediaQuery object| Motion object| Nest function| Timer object| Triggers function| Abide function| Accordion function| AccordionMenu function| Drilldown function| Dropdown function| DropdownMenu function| Equalizer function| Interchange function| Magellan function| OffCanvas function| Orbit function| ResponsiveMenu function| ResponsiveToggle function| Reveal function| Slider function| SmoothScroll function| Sticky function| Tabs function| Toggler function| Tooltip function| ResponsiveAccordionTabs object| default function| List function| ScrollReveal function| LazyLoad object| sr function| gtag object| hljs object| recaptcha object| closure_lm_34941 object| gaGlobal function| addCaptchaScript function| UET function| UET_init function| UET_push object| uetq object| OneTrustStub function| OptanonWrapper string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| Optanon object| OneTrust

7 Cookies

Domain/Path Name / Value
www.rapid7.com/ Name: r7-session
Value: iuimgykrlflilgte1xx1ndcg
.rapid7.com/ Name: r7-lr
Value: lang-detect-notify
.information.rapid7.com/ Name: __cf_bm
Value: G9NglBzJU6IRlU9F6ZeCZNLKWoU5SEaI6dKmnfETz5M-1720053675-1.0.1.1-AAbNuuItyiocfJj2VZUM6NmThv0D7Cc5vJFCfqkYiLetXZQ5yU3TJ4UlC.lwcCrj3LmyxikYlhjaeg8hUHLZ8Q
.app-sj20.marketo.com/ Name: __cf_bm
Value: 9l_qto72LYG5B3AZGaBYs6NtiaD3tNcYVqwCaMfVM0g-1720053676-1.0.1.1-qCbbNb6ULwDjXHmLpXgTk9LcSr4i8c2XEAuzp3cHRy4ny6hn58gKaaLudCY9fvwt5rADXKw6kTahZ7myUk_9TQ
.rapid7.com/ Name: optimizelyEndUserId
Value: oeu1720053675518r0.36779875835843523
information.rapid7.com/ Name: BIGipServersj20web-nginx-app_https
Value: !fXMfV48WO9EMDCYRgS7A5F9dNDOAZNkQ1PfpRQmaNCKz//nuYPqvJB5A4BLu8/wLsTeB8PdsyrBp2OI=
.rapid7.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Thu+Jul+04+2024+02%3A41%3A19+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=6.31.0&isIABGlobal=false&hosts=&consentId=db2ef3d3-5c0e-4ec8-a955-a9ae6842485e&interactionCount=0&landingPath=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2023%2F08%2F31%2Ffake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers%2F&groups=C0001%3A1%2CC0005%3A0%2CC0004%3A0%2CC0002%3A0%2CC0003%3A0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app-sj20.marketo.com
bat.bing.com
blog.rapid7.com
cdn.cookielaw.org
cdn.optimizely.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
information.rapid7.com
lh6.googleusercontent.com
logx.optimizely.com
opt.rapid7.com
region1.google-analytics.com
res.cloudinary.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.rapid7.com
lh6.googleusercontent.com
www.google.com
104.16.92.80
104.17.25.14
104.17.72.206
104.18.167.88
13.32.121.30
2001:4860:4802:32::36
216.58.206.68
2606:4700:4400::ac40:9b77
2606:4700::6811:c901
2606:4700::6813:b234
2620:1ec:c11::237
2a00:1450:4001:811::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82b::2003
2a00:1450:4001:831::2008
2a02:26f0:3500:889::13b8
2a04:4e42:200::649
3.161.82.84
34.49.241.189
0028ae9273d2cecde304fb39566c6cf4b39fa897bbe4b7d2ea5ee944d8f0b079
022e2f39deba7f332eabe69b27b31d98d4d5f2535116745957a691d1b1ec4cc5
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
04c1c1767e4e114200209ffb70e66b744ddbf113566215117e23cfb600070a36
07d48253b2a1bf57eab69336d406dd07c1e4ca5f79b3dffc5deb7036aa775d42
0845ddb5526e7e542efc17fdd6cb9aa9fecb3d32a1bb1f786ec0c41f900f9db4
0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a
146697e686c91fde6e30955bc6cba7bfe752c511b2f27545a6938266e49cdfcd
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
189a0c040751daec5172415124ecd3934c261955edcd43b0ee434f4094a9a6c5
1f9516e8a33fad95a5c678151b024f6871eda22cfdb9383084ae4e1569cdfd9c
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
261a3512eac3020f03e10a49b52dfe3d03cac16be2287fa2ea066f4f280edd84
2a2b43f7170d6f56ea9a6617199e00a1621d508f265b447dbb916e87f8c57ba9
2dd8e940e47cb067ab22aadfe8ccc4f744ddd724bfac7f058915413ae8974909
42654a13059f95ad356ca471088bae32122ac69cc9b99b1323a1425ba93866c5
42d83450e41e8f068fa4afb9194a54a18715aea5923bb7a8e7381c4554abccb7
42da203fcc4325bd58c8c868e9213def8ca9b8d58e79d68e86c0fd8a5744e72d
44c801d9e0081f0b1326239a0d7b57aba16f5d64befba9bd7172949684603930
44fc485dc1ebae37e5b965b0295dd07e645a2a4065a68b1c2416d0911ac92007
482ca4416575868c1f9c9573ae292d8f491b71ed5f97ef0bdcf7f57edd72c559
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
4b20b79d8999b2516d971378ec1b7a3bb36108838a22d3c6f2e1d9a47dbe7f08
5bffb19cfe9242c25310ba6318a1f11c013f67de7d0d4bf3aaec9cc8e0a1fd7c
5f0141287e282ce1a704aa0699187a162c78ceeb166cca3b6b5b607eee79b52e
652667975f4e5bc9b68363e77211b87c5739566baed70c21fe835d7969995478
726ae17a0fb81567b8ec6b892806fb51865914c7e04c7040070cddf76463d5da
78c7caceadd5d2674a384d3d2d26c7f6c95bc0b892df9b580d94ae4baa97369a
7d7f64f89927a0c843f4ae2f589c776643aa23ead9ce829bb39c8f3a40d4955d
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
7e4d7cb0d3c44a8d0288dc03fe7c918dc9065b70df23a137578ae7ab2d1e4d24
7f0f781820c8de56bd6699ac9570ff90634de4eb5cca7ef4b573bb90619e5a5d
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
83beb2d136de860d2dc5be2f0ccaa3e8f6c8b3641447a5ac6ee79f5c49f5e4c3
86367af4f598389eab5b4ae3f741af306a83d09d6ef7dc1f2700339b35b57d3e
86f70df17d2db50839e6ffd22a3a1cbe152db714041146f8129edf72f7f78103
8cbb84011f3f2dc41f2da385bc88e6bd084eeaa1ed94d1a26d8592ac34bc96c3
8eeb6d6aac11fcf7041b7fac8be5cff5a8bab6b18a4cc3443bc66e1808934f07
8f0a8aeb7295594ad2a432cb24687f3bc9eef6837443f73a5aa7aeea7417e268
967d248f9ff67fffdb85724df3b1d19428d227cf24ad616258b81d205e10240b
9904ff6810e17c1ffc108bf92dbee7f8a6318d0c8c58c1d70555d0a3945fb9da
9e7fe0edbc32bbda00bdef6dc0241bc78277a37d4ceeab5991c64d11915746b9
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a8aa8c94d42d57cd377de305aed2169249f6f6bd2fd31b5f1d2671cc1502a1d1
ac2a270e60c15fdaaf9957f52bab00aaefd32ac7782a62b141c66c2ce3f6369c
ad61d8dcf52625a48e89733e4a0e161cf7900525c04cf4471dad059b92afacb2
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b27b9c511b0e0bede3a2af771127be6529198c82c3a4c51f8ad8b23454ad1ccd
b3ba97f3a045ed917586356f411193b4548d91593729bcd31dccac1aa71f2b24
c139bfffcc61675fde914086179dc99d37a9f8a52b34245ac61d92c4f25608e5
c3bbe5bd6f67c80927384d8b7a36f0b12004d473db805ac6cf628f6fca4aef87
c65ffa9b8e350747e5dec76cbf16729482008fa1b57be07c53d3c509bebcfadd
cb30e0c12d8ad8be9c0c517226ba4ffa88802ce495dada60b6f7494075a8a133
d0e01c354180fc37129a0ea63dd041814428290fbbe3b22866ecece2b56be7da
d166654b7252063c66c3aa08cf44ebeb63b29aa2fbe06c408004801b8cd94bb2
d230bbe71c0b14f8b3bbfea2a8ab1161b617a495d762f80631727e4d87e2252c
d8d3007090d651a4e6e6a4f9012e57603c4dc69c7eaba85346891eac7e7dbabe
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db56e6f7a4995919795a439701c66e4f62ce9f395906f1828329a03feac5066b
e2419c64b5a072138b4571c9dfaa612be80e4d3baeef696c8b53cd9c842087ee
e2880b7b9013570b3dd062b45571c82589f13665b0b3099956b986352aeaf133
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e79f253e5553cc1fc63e49e065e9a529d3ebc6864ac3ef1288aa1854d21302
ea07c75cc70340374feb3872db77d7d5b74e6e8b62fd538f36209b1815ecd3d6
ec0bf416c92b08efb33a89a4cc6c188e4bd17adbce829f7d756f2d592227f1ca
edf0e39ce5b5fbe0b1f0d588772d7e028d2ec4274c97233463e4a49074c516fb
efb5baebac85cf97ef93ef492c1d222862cb3678b9e24ec4b396cfc8cea9edaf
f3d0508710cf3eb6d3a76a46152590457c245646b01e42c45a2ab66890012a1e
f491cd8e416507e8795087dc76a1a50464a36a5d6857def1d024aa22566ff2c9
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5dc03c1dac3aad562da399430ebf1f3cc0169ac7d55d1d1161c82f6fbd4c89e
f5e914e3054ceab821d55af5a8b0303385455c61d8c760262a5e77a8c32a23ba
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fb483fc8126d5dd7b12c77b8cd2176ec9567a8b62e56dde2ab8f92bc1d15a7f4
fe4946db1f133c18e59bde7de4f6e87a50d288f85ec8440451b998e0f3f17e66
ff9895e1e0159ec83286496ded84606fe97d4f66bafb2ac50f47aa4e81bd2490