urlscan.io logo urlscan.io
SecurityTrails logo

www.rewterz.com Open in urlscan Pro
138.197.223.24  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Submission: On February 09 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 3 countries across 18 domains to perform 68 HTTP transactions. The main IP is 138.197.223.24, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is www.rewterz.com.
TLS certificate: Issued by R3 on January 2nd 2022. Valid for: 3 months.
This is the only time www.rewterz.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
37 138.197.223.24 14061 (DIGITALOC...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.236.170.110 14061 (DIGITALOC...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 151.101.2.137 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 162.247.242.20 23467 (NEWRELIC-...)
68 19
37    138.197.223.24 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: www.rewterz.com
www.rewterz.com
2    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    104.236.170.110 (San Francisco, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: app.sirp.io
app.sirp.io
1    2606:4700::6811:d3cc (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
2    2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    2606:4700::6812:14bf (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    2606:4700::6811:82ab (United States)

ASN13335 (CLOUDFLARENET, US)
js.hscollectedforms.net
1    2606:4700::6811:ebcc (United States)

ASN13335 (CLOUDFLARENET, US)
js.usemessages.com
4    2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)
forms.hubspot.com
api.hubspot.com
track.hubspot.com
app.hubspot.com
2    2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubspot.com
1    2606:4700::6810:5905 (United States)

ASN13335 (CLOUDFLARENET, US)
forms.hsforms.com
5    2606:4700::6811:7d2 (United States)

ASN13335 (CLOUDFLARENET, US)
static.hsappstatic.net
1    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
1    2606:4700::6811:f1cc (United States)

ASN13335 (CLOUDFLARENET, US)
cdn2.hubspot.net
2    162.247.242.20 (United States)

ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-8.nr-data.net
bam.nr-data.net
Apex Domain
Subdomains		 Transfer
37 rewterz.com
www.rewterz.com
510 KB
6 hubspot.com
forms.hubspot.com — Cisco Umbrella Rank: 3787
api.hubspot.com — Cisco Umbrella Rank: 5570
track.hubspot.com — Cisco Umbrella Rank: 2675
app.hubspot.com — Cisco Umbrella Rank: 7153
22 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 8439
260 KB
3 gstatic.com
fonts.gstatic.com
48 KB
2 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 612
504 B
2 google.com
www.google.com — Cisco Umbrella Rank: 13
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 42
20 KB
1 hubspot.net
cdn2.hubspot.net — Cisco Umbrella Rank: 7872
2 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 367
15 KB
1 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 5270
481 B
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 6014
22 KB
1 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 5869
25 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2564
16 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2549
20 KB
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2729
995 B
1 sirp.io
app.sirp.io
81 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 96
439 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47
1 KB
68 18
Domain Requested by
37 www.rewterz.com www.rewterz.com
5 static.hsappstatic.net app.hubspot.com
3 api.hubspot.com js.usemessages.com
static.hsappstatic.net
3 fonts.gstatic.com fonts.googleapis.com
2 bam.nr-data.net app.hubspot.com
2 www.google.com www.rewterz.com
2 www.google-analytics.com www.rewterz.com
www.google-analytics.com
1 cdn2.hubspot.net
1 js-agent.newrelic.com app.hubspot.com
1 app.hubspot.com js.usemessages.com
1 track.hubspot.com
1 forms.hsforms.com www.rewterz.com
1 forms.hubspot.com js.hscollectedforms.net
1 js.usemessages.com js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.hs-banner.com js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hs-scripts.com www.rewterz.com
1 app.sirp.io www.rewterz.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.googleapis.com www.rewterz.com
68 21

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
Subject Issuer Validity Valid
www.rewterz.com
R3		 2022-01-02 -
2022-04-02		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-01-10 -
2022-04-04		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-01-10 -
2022-04-04		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
app.sirp.io
RapidSSL RSA CA 2018		 2020-07-03 -
2022-08-02		 2 years crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-04 -
2022-07-03		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-01-10 -
2022-04-04		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2021-06-26 -
2022-06-25		 a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3		 2021-06-10 -
2022-06-09		 a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA H2 2021		 2021-10-06 -
2022-11-07		 a year crt.sh
hubspot.net
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-10 -
2023-02-10		 a year crt.sh

This page contains 2 frames:

Primary Page: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Frame ID: A77F965FE4DEF6B5ED873F2AA4449640
Requests: 56 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 9D5D352EC56F537DA3B60548943E9C70
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Rewterz Threat Alert – Kimsuky APT Group – Active IOCs | | Rewterz

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[\'"][^']+revslider[/\w-]+\.css\?ver=([0-9.]+)[\'"]
  • /revslider/[/\w-]+/js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

68
Requests

100 %
HTTPS

79 %
IPv6

18
Domains

21
Subdomains

19
IPs

3
Countries

1045 kB
Transfer

3186 kB
Size

10
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

68 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
www.rewterz.com/rewterz-news/ 		109 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
56079921a1d7384629e164b07214e18ee1e650d3495c7cdb78a79e0775b0cebf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 09 Feb 2022 00:33:01 GMT
Server
Apache/2.4.29 (Ubuntu)
X-Pingback
https://www.rewterz.com/xmlrpc.php
Link
<https://www.rewterz.com/wp-json/>; rel="https://api.w.org/" <https://www.rewterz.com/?p=14645>; rel=shortlink
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
21614
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3488
date
Tue, 08 Feb 2022 23:34:54 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 09 Feb 2022 01:34:54 GMT
style.min.css
www.rewterz.com/wp-includes/css/dist/block-library/ 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Apr 2020 02:17:50 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"d159-5a478abe6525a-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
7642
styles.css
www.rewterz.com/wp-content/plugins/contact-form-7/includes/css/ 		2 KB
1012 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
811e8960b8f79f14983e30df80a4ccc69d82430ccc0520d2a1a3d1405cfbb2a1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 May 2020 08:24:49 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"6d2-5a6b10fe7204b-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
677
rs6.css
www.rewterz.com/wp-content/plugins/revslider/public/assets/css/ 		55 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.1.2
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
6f3678578e1fcd6df957011ade74254df8311409fd8e039246566c362a686be9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:19:27 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"dc54-59aed5e86336b-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
11829
general.min.css
www.rewterz.com/wp-content/plugins/wp-job-openings/assets/css/ 		38 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/wp-job-openings/assets/css/general.min.css?ver=2.0.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
144ee8fd3d8997d932fe2b5497979e7cde8fda86b41b0c6e32e47faa8e1157e7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Sun, 10 May 2020 18:27:59 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"96c7-5a54f63d7672b-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
6453
style.min.css
www.rewterz.com/wp-content/plugins/wp-job-openings/assets/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/wp-job-openings/assets/css/style.min.css?ver=2.0.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
1da5937ea42239582696f732d7713fb6f901aa8f98d35577bad12bd2ecb9b5fe

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Sun, 10 May 2020 18:27:59 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"33a5-5a54f63d7672b-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2706
base.css
www.rewterz.com/wp-content/themes/betheme/css/ 		57 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/css/base.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
ab1bcd9efd1e8a6b48bffec44e1a902bf56b14b9c6bf2733e63c9c4f36f27ff6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"e223-59aed242ac05d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
12412
layout.css
www.rewterz.com/wp-content/themes/betheme/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/css/layout.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
caab2844b34d9a5ad18ee9f25c3a1bcc892ab2fa67d279255a73dffd292c5a69

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1d61b-59aed242ac05d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
20303
shortcodes.css
www.rewterz.com/wp-content/themes/betheme/css/ 		134 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/css/shortcodes.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
ee27045d1b3d6c34e7f2cc6445d625e9f74acb7723ca587fa81c1dfa15ca650e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"219bd-59aed242ac05d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
22437
animations.min.css
www.rewterz.com/wp-content/themes/betheme/assets/animations/ 		57 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/assets/animations/animations.min.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
e803d4290c5baec790ecde06d9308c6bf17f967c8232e3651844bfd60dd2a9f5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"e48c-59aed242b1e1d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
5418
jquery.ui.all.css
www.rewterz.com/wp-content/themes/betheme/assets/ui/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/assets/ui/jquery.ui.all.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
d1814382a8f430d8d2cea5b0e19569f887ae8bd265310aa6176422ee3ee87f60

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"48eb-59aed242b1e1d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3347
jplayer.blue.monday.css
www.rewterz.com/wp-content/themes/betheme/assets/jplayer/css/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/assets/jplayer/css/jplayer.blue.monday.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
593998021e5710fcc6797244da4006389ea8a5c15dc3ce7a661685cb36638844

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"266a-59aed242b2dbd-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
2087
responsive.css
www.rewterz.com/wp-content/themes/betheme/css/ 		57 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/css/responsive.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
255058e0679222d012f8dc8c3a788a2eb5e5f295cac9e9852ac144d2f7d7df39

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"e362-59aed242ac05d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
10347
css
fonts.googleapis.com/ 		12 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A1%2C300%2C400%2C400italic%2C500%2C700%2C700italic&ver=5.4.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
efef41820e804a2100709808b914c8a9a4cf35065e7531475359c5da70ddfeed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 08 Feb 2022 23:28:38 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 09 Feb 2022 00:33:02 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 09 Feb 2022 00:33:02 GMT
wp-emoji-release.min.js
www.rewterz.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
956fa56f513e1a8025bc85f9314a1747eb061d434403393591145e4ae898c694

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:04 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"363c-5c00339b59dd9-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=91
Content-Length
4646
collect
www.google-analytics.com/j/ 		4 B
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=50060372&t=pageview&_s=1&dl=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&ul=en-us&de=UTF-8&dt=Rewterz%20Threat%20Alert%20%E2%80%93%20Kimsuky%20APT%20Group%20%E2%80%93%20Active%20IOCs%20%7C%20%7C%20Rewterz&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=2079558441&gjid=2129773071&cid=1336169491.1644366782&tid=UA-2844962-1&_gid=1730139191.1644366782&_r=1&_slc=1&z=671373267
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.rewterz.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 09 Feb 2022 00:33:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.rewterz.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
439 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2844962-1&cid=1336169491.1644366782&jid=2079558441&gjid=2129773071&_gid=1730139191.1644366782&_u=IEBAAAAAAAAAAC~&z=903847265
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.rewterz.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 09 Feb 2022 00:33:02 GMT
content-type
text/plain
access-control-allow-origin
https://www.rewterz.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
style.css
www.rewterz.com/wp-content/themes/betheme-child/ 		209 B
485 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme-child/style.css?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
7d7d1c0e280bf428ece29fcf06aceb930039e8524a81a62860922e3b45497e76

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:07:23 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"d1-59aed3363e4dd-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
151
jquery.js
www.rewterz.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 May 2019 17:08:53 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"17a69-589186fe43340-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
33776
jquery-migrate.min.js
www.rewterz.com/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 May 2016 06:11:28 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"2748-5333ff613c400-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
4014
revolution.tools.min.js
www.rewterz.com/wp-content/plugins/revslider/public/assets/js/ 		147 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/revslider/public/assets/js/revolution.tools.min.js?ver=6.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
45012f93c4cbd739c51f4043a3a1d3c8377272ef606dd39e51a6a81e02dad594

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:19:27 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"24ba4-59aed5e8623cb-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
50582
rs6.min.js
www.rewterz.com/wp-content/plugins/revslider/public/assets/js/ 		263 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.1.2
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
25946407ffe7464efd7ca1123c553ed781409890e0f700b9492f402842e61e08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:19:27 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"41b15-59aed5e8623cb-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
logo_color_small.png
www.rewterz.com/wp-content/uploads/2020/03/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rewterz.com/wp-content/uploads/2020/03/logo_color_small.png
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
22609383a832064e74824c4152795ad7b7ebfdc7aa940c3fe42eb0d4634fa7d6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:04 GMT
Last-Modified
Mon, 09 Mar 2020 15:31:33 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"4c85-5a06db2b17db5"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
19589
advisory-1643957734.jpg
app.sirp.io/uploads/1/advisory/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.sirp.io/uploads/1/advisory/advisory-1643957734.jpg
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.236.170.110 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
app.sirp.io
Software
Apache /
Resource Hash
e1bf58f34b987e2d456fa4cd6ba276dfe73e13c468693df1a819b991ccf01c5c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Last-Modified
Fri, 04 Feb 2022 06:55:34 GMT
Server
Apache
ETag
"14438-5d72bbcc8c506;5d5ec9ea30de7"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
83000
scripts.js
www.rewterz.com/wp-content/plugins/contact-form-7/includes/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
72ebfeb1ce24b152349b7a231f6fc29ff2a2b7a5ede91dcdb80d6b9de1779046

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 May 2020 08:24:49 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"3923-5a6b10fe710ab-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
4039
6553015.js
js.hs-scripts.com/ 		2 KB
995 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/6553015.js?integration=WordPress
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d0bdfae4cb656e89432e63fef2db52612a81997d58810d73c45fb065f807875

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:03 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
EXPIRED
x-hubspot-correlation-id
bf993554-49a0-4f93-8313-0d03cb86cf95
last-modified
Wed, 09 Feb 2022 00:30:30 GMT
server
cloudflare
x-trace
2BCC239F1F99244FB591358A39C56FAE49AEDB9FFC000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.rewterz.com
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
6da9010cceff83af-MXP
expires
Wed, 09 Feb 2022 00:34:03 GMT
script.min.js
www.rewterz.com/wp-content/plugins/wp-job-openings/assets/js/ 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/plugins/wp-job-openings/assets/js/script.min.js?ver=2.0.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
43ed7685692a12820d9beb61901d18f137e840fd80a85960cd0a3b46dea6dc01

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Sun, 10 May 2020 18:27:59 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"a123-5a54f63d7578a-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
12818
api.js
www.google.com/recaptcha/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LeZMPUUAAAAAAyP4jMxny5YCmdlhV1JYPKHcdl7&ver=3.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers
core.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
194ebae85ff853319e8668f23a4c5bf371a7d9f5d550a40980ab53026ddaaa17

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"f59-5c00339b58e39-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1811
widget.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
1b4f1024fa4887b47765e2ad4db9bc1f6ea96335f77fd44c62b8538d75e7190c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1aab-5c00339b58e39-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
2543
mouse.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
7e8d54d6c6a4ebd0237786d41ff5d205096eda696f2a5b591e074fe94ba3b3af

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"c46-5c00339b59dd9-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
991
sortable.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/sortable.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
9af25ef0d99c5ef2c6f3b595b1716009858fc4bc71838ffcd61706bda396d261

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"60fc-5c00339b58e39-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
6425
tabs.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/tabs.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
b91aab00697781a1fb184945cd6e7602db0d45458fa58a53156110945f2b71be

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"2eec-5c00339b58e39-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
3855
accordion.min.js
www.rewterz.com/wp-includes/js/jquery/ui/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/jquery/ui/accordion.min.js?ver=1.11.4
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
96b656700f9b4784f69af925f46ecc91caa7f444b3168ecbb64afe06f8fc4c99

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"2172-5c00339b59dd9-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
2670
plugins.js
www.rewterz.com/wp-content/themes/betheme/js/ 		188 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/js/plugins.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
86d7face00e310c8bf5209ca56f56726fc95a48b2e39db93bcf2cb9c635a5750

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"2ef49-59aed242ab0bd-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
52892
menu.js
www.rewterz.com/wp-content/themes/betheme/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/js/menu.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
c22005bbdf738de61a4c2ee99c2b3c4fe52f336dfc8aa274860c58c845027d50

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"98d-59aed242ab0bd-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
826
animations.min.js
www.rewterz.com/wp-content/themes/betheme/assets/animations/ 		2 KB
971 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/assets/animations/animations.min.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
602797e80613c3623325594e96463093c626554dff563622e8fbc3e795d283e0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"71e-59aed242b1e1d-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
622
jplayer.min.js
www.rewterz.com/wp-content/themes/betheme/assets/jplayer/ 		51 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/assets/jplayer/jplayer.min.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
c36a1d5b71cce2b22a63e9593f75c0170f2620ed7bbad0bc12739accd84d38ce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"cd96-59aed242b2dbd-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
12713
translate3d.js
www.rewterz.com/wp-content/themes/betheme/js/parallax/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/js/parallax/translate3d.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
f25f13e58a8709b8aa0bd7ebaa2d8f17fdfe165c55ccb8b96d862fe8f8caa90f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1228-59aed242ab0bd-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1499
scripts.js
www.rewterz.com/wp-content/themes/betheme/js/ 		68 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/js/scripts.js?ver=21.4.9.1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
33189ed1c63f103baa23abcf3ba58a132b955a807b2cbc741acbb9011ac4306e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"10efd-59aed242ab0bd-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
14235
comment-reply.min.js
www.rewterz.com/wp-includes/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/comment-reply.min.js?ver=5.4.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
4f00ec40b144121114b6cec693fccc2b51a06ab01fc34defa466467b581a7f2c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"944-5c00339b58e39-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1144
wp-embed.min.js
www.rewterz.com/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-includes/js/wp-embed.min.js?ver=5.4.9
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 13:56:09 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"592-5c00339b59dd9-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
765
mfn-icons.woff
www.rewterz.com/wp-content/themes/betheme/fonts/ 		80 KB
80 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rewterz.com/wp-content/themes/betheme/fonts/mfn-icons.woff?31690507
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/wp-content/themes/betheme/css/base.css?ver=21.4.9.1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.197.223.24 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
www.rewterz.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
559a910060423ed485ddc062a9ab5318859bbfde26be3f73d9b83ac0b9dae677

Request headers

Referer
https://www.rewterz.com/wp-content/themes/betheme/css/base.css?ver=21.4.9.1
Origin
https://www.rewterz.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 09 Feb 2022 00:33:03 GMT
Last-Modified
Mon, 30 Dec 2019 15:03:08 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"13e28-59aed242b0e7d"
Content-Type
application/font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
81448
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A1%2C300%2C400%2C400italic%2C500%2C700%2C700italic&ver=5.4.9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.rewterz.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 04 Feb 2022 09:48:03 GMT
x-content-type-options
nosniff
age
398700
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 04 Feb 2023 09:48:03 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A1%2C300%2C400%2C400italic%2C500%2C700%2C700italic&ver=5.4.9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.rewterz.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 02 Feb 2022 17:58:32 GMT
x-content-type-options
nosniff
age
542071
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 02 Feb 2023 17:58:32 GMT
KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu51xIIzI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A1%2C300%2C400%2C400italic%2C500%2C700%2C700italic&ver=5.4.9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.rewterz.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 04 Feb 2022 09:29:12 GMT
x-content-type-options
nosniff
age
399831
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17304
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 04 Feb 2023 09:29:12 GMT
api.js
www.google.com/recaptcha/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LeZMPUUAAAAAAyP4jMxny5YCmdlhV1JYPKHcdl7&ver=3.0
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers
6553015.js
js.hs-analytics.net/analytics/1644366600000/ 		62 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1644366600000/6553015.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6553015.js?integration=WordPress
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1b353d29e7d83a10563bebdba667e7f69d82d2b59741e07a83b6ec402e12f1d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:03 GMT
content-encoding
br
cf-cache-status
HIT
age
152
x-amz-server-side-encryption
AES256
x-amz-request-id
FZ11Z9WWZYHEDARV
x-amz-id-2
A2vEmkjkG6u3n8KeNsPctg5/KKUH0a6haeaKSypiIL8aiCgYggE3qN/R/AHWCn5lUmPyyI4xjGc=
last-modified
Mon, 19 Jul 2021 15:33:20 GMT
server
cloudflare
etag
W/"c40d7b0be8e45a9f5c82cc3cd2ba5b13"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
x-amz-version-id
null
cf-ray
6da9010e0b3759f5-MXP
expires
Wed, 09 Feb 2022 00:35:31 GMT
6553015.js
js.hs-banner.com/ 		60 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/6553015.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6553015.js?integration=WordPress
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b571c07e44f98a07485f7fb4c9aa03cd374cd05c01a2127c7b2862ef7ea70e5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:03 GMT
content-encoding
br
cf-cache-status
HIT
age
152
x-amz-server-side-encryption
AES256
content-type
text/javascript; charset=UTF-8
access-control-max-age
604800
x-amz-request-id
FZ1D7TM09KZ91C9F
x-amz-id-2
Tbi6+NZo5GgGWxrZmTZp67UUIYh6dTvPQDn3FXxs+7lQCbdto07IVGGtfFb9n8YYOZE/hy1fwUg=
timing-allow-origin
*
last-modified
Tue, 08 Feb 2022 23:59:05 GMT
server
cloudflare
etag
W/"82cf362f5edfceaed9bd5892234c9bca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id
9.ZcSxXyGIkx4QPmU8sudeVmD3F5kacQ
access-control-allow-origin
https://www.rewterz.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
cf-ray
6da9010e0ae03757-MXP
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires
Wed, 09 Feb 2022 00:35:31 GMT
collectedforms.js
js.hscollectedforms.net/ 		73 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6553015.js?integration=WordPress
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:82ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e211fbc080dcb010d1cf54917aa2d6b33d4eb70160fd4d5acc2e0b69c3c2286

Request headers

Referer
https://www.rewterz.com/
Origin
https://www.rewterz.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:03 GMT
via
1.1 a7a1b4c19abc42d237405ce4c4069f10.cloudfront.net (CloudFront)
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status
HIT
age
30722
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.268/bundles/project.js&cfRay=6da612fd0d0e9229-IAD
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-encoding
br
cf-ray
6da9010dea9791d1-FRA
last-modified
Thu, 03 Feb 2022 08:24:47 UTC
server
cloudflare
etag
W/"213fdadef61cd5b83aac4307c39a00a4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
paS71p19sxG4lOzv9LEMPGPVe35qdQHS
access-control-allow-origin
*
cache-control
s-maxage=86400, max-age=0
x-hs-cache-status
MISS
x-amz-cf-pop
IAD89-P1
content-type
application/javascript; charset=utf-8
x-amz-cf-id
rPRykB68PP5YCZsgCJrFcRYkIVHre_4e5bOsFR3Bg4Tn3gkQYQckLw==
x-hs-target-asset
collected-forms-embed-js/static-1.268/bundles/project.js
conversations-embed.js
js.usemessages.com/ 		80 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6553015.js?integration=WordPress
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:ebcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43a68281c1d759e7214cb0c6699944953819e5a5bb78777e65fb87fecb6170f6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:03 GMT
via
1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
286
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.9643/bundles/project.js&cfRay=6da8fa12c88c59a1-IAD
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
x-amz-replication-status
COMPLETED
content-encoding
br
last-modified
Tue, 08 Feb 2022 09:27:47 UTC
server
cloudflare
etag
W/"9bc16782e1eac254ba1de1dc1a59c460"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
28vyk6lF2op8UTN0Rmz7WbkS5SVIGQD3
cache-control
max-age=600
x-hs-cache-status
HIT
x-amz-cf-pop
IAD89-P1
cf-ray
6da9010e1ccc375f-MXP
x-amz-cf-id
ALTDsFw-aWvXt-oqThNo93P1XVk6m1FLNXn_NZa8TMTl1mAoq6oV2g==
x-hs-target-asset
conversations-embed/static-1.9643/bundles/project.js
json
forms.hubspot.com/collected-forms/v1/config/ 		115 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/collected-forms/v1/config/json?portalId=6553015&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c10433f7319eb6d8004fa831a042b8a5e126505f0ed9de60eceba149f484de5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.rewterz.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
7e3fe41f-1f1a-46a6-a8e4-fb8df7c717cb
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
180
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=69GcOYRNCi9vbfrBhHV526HwBveuf0vJLXTIxtdP9vY307NZP7NDNNGwG3u0tA%2FIFVNIAb3c8OTnnyTnTrVYBt5Tkps9WO4KYZ4yj8leiysfIe6SSBetzV7Z5X7gi6PwjUlPpyhYguuL6UB%2Bm4He"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.rewterz.com
x-robots-tag
none
access-control-allow-credentials
false
cf-ray
6da9010eebe159dd-MXP
access-control-allow-headers
*
public
api.hubspot.com/livechat-public/v1/message/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=6553015&conversations-embed=static-1.9643&mobile=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&traceId=49a3e1ac623e41be9dd31dc0b31807d4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
x-hubspot-messages-uri
Origin
https://www.rewterz.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
content-type
text/plain; charset=utf-8
content-length
18
cf-ray
6da901110e5359dd-MXP
access-control-allow-origin
https://www.rewterz.com
allow
HEAD,GET,OPTIONS
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
cf-cache-status
DYNAMIC
access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-hubspot-correlation-id
a0a3294b-dfbb-4699-8634-2ee5a1f42453
x-trace
2B645B088AE96F88D4DF099962584FAF04ED79BA0A000000000000000000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iFIApaM1Wf7SsuUncDG8PehLAhv7FMh7lUatXRacGXMwyY6BgnnI%2B7Ligbm3Qp1aSWS7Z5QzZtzpp7baa%2FlBEkMeQ8BrWlsxgPZ2YnZs3kwDmyFlUNkoWROJ5m1oUXNUJowcDef3YZdFMJtTDA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
public
api.hubspot.com/livechat-public/v1/message/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=6553015&conversations-embed=static-1.9643&mobile=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&traceId=49a3e1ac623e41be9dd31dc0b31807d4
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3f8fe8be5315daeeb5d49bdcf7476aa2edc96d1aec2a3b2246d69fe8f614924
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Referer
https://www.rewterz.com/
Accept-Language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
469d9e20-6e26-4060-bd67-8571e0bf9a44
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1339
server
cloudflare
x-trace
2BF83EB1773732B5A6693E0A878A94612CFF5B5D62000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nh%2B3bDUwW2RDtCS5q21ve%2F1g%2BX3krR71CIwhXPEzrJlwFg%2F8UpkZlZlrOA9bimQPcgxGMIQm0oNggClm0spdUesJM4%2BWtf%2FZY8U7w4mATGLAvxLK7w01efe5ItSqPdRXHXiW5tNiaRPuntBodw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.rewterz.com
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
cf-ray
6da901120c9069a3-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
counters.gif
forms.hsforms.com/embed/v3/ 		35 B
481 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1
Requested by
Host: www.rewterz.com
URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-kimsuky-apt-group-active-iocs-10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
ad62f79c-f07d-4d26-ac41-348f6567214d
x-trace
2B28E3F845C77B0A52341D2950D22C17DB24AB604C000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6da90111dea9f93b-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
35
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
967 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1792297217&v=1.1&a=6553015&ct=blog-post&rcu=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&pu=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&t=Rewterz+Threat+Alert+%E2%80%93+Kimsuky+APT+Group+%E2%80%93+Active+IOCs+%7C+%7C+Rewterz&cts=1644366784440&vi=8770e9c62598aa04150024c604fa2f9b&nc=true&ce=false&cc=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
38179c27-97b9-408f-9345-78c240fd8b0c
cf-ray
6da901130b8a59cb-MXP
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yxdot5wNydhOEwQP1xJoRJdXNvi2JUkPCLCMaIq0UyPBLEe2G53xm548L%2BbLlsKFZNNmJx%2BcQoNaC3zZOUQm%2BnSlZ8B93NLZOBkIsilequnPC%2FxZNVS9Izajsq%2Fik4HIPDUhVSbL2Eq3wZlxyPXF"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
x-robots-tag
none
49a3e1ac623e41be9dd31dc0b31807d4
app.hubspot.com/conversations-visitor/6553015/threads/utk/ Frame 9D5D 		45 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87c71630ad19e3ff0e0614c5ffdac90cfdb587a9a365fc82c7e00f92acab5cc9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.rewterz.com/

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
content-type
text/html; charset=utf-8
cf-ray
6da901135c1b59cb-MXP
age
1828
cache-control
max-age=600
etag
W/"9137e3dc399c1aafc866d7d2a4eedeb8"
last-modified
Tue, 08 Feb 2022 09:27:47 UTC
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 0501dadffc52b06a0cf6aadc57586acc.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
access-control-allow-credentials
false
content-security-policy-report-only
script-src data: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com 'self' www.hubspot.com *.hs-analytics.net *.hsappstatic.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com js.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net www.googleadservices.com www.googletagmanager.com *.google-analytics.com s.yimg.jp 'unsafe-inline' 'unsafe-eval'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-visitor-ui/static-1.12099/html/index.html&cfRay=6da901135c1b59cb&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F6553015%2Fthreads%2Futk%2F49a3e1ac623e41be9dd31dc0b31807d4%3Fuuid%3D339fe47d9dc740a4b807675dc9c321f2%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Drewterz.com%26inApp53%3Dfalse%26messagesUtk%3D49a3e1ac623e41be9dd31dc0b31807d4%26url%3Dhttps%253A%252F%252Fwww.rewterz.com%252Frewterz-news%252Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fwww.rewterz.com%2F&cfenv=prod&csp=ro
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
x-amz-cf-id
b12amWoJR_v-SJjOlFBdUk7NM5ZBJ7kkvPXtj4mF3OcN1cyWAIwLlA==
x-amz-cf-pop
IAD89-P1
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
tDsJoshhZMEQtPs4Q7n1lmJRBFAIKpbV
x-cache
Hit from cloudfront
x-hs-cache-status
MISS
x-hs-worker-debug-mode
false
server
cloudflare
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.156/ Frame 9D5D 		44 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/head-dlb/static-1.156/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a4651c562bac53f6d33b1d8093551a818571a6b595304ba4813bc7b5d503783
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1269477
x-amz-server-side-encryption
AES256
cf-ray
6da90114aa6f9170-FRA
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
x-amz-replication-status
COMPLETED
access-control-allow-methods
GET
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 12 Aug 2021 03:52:03 GMT
server
cloudflare
etag
W/"92f1fce5bc1b104818f7bb3259fa0317"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RBGjdux42E%2Fgb44xA7BVDxX%2Fwi3k1rzOUVVHnEoKX53h%2Ba1tlpf11WFK6c3%2FT8DjTxNmQwVFwZXIrgP2f%2Fltp50AbN9aRg6Dccg38ngEYIKNWku9e%2F8maLrgEHRpe4giv1RfQPPQDfU5jApheNZMLMUkw9w%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
jswq3j2Kf9rTWaLEvxg.3d09mCkFqVly
access-control-allow-origin
https://app.hubspot.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P2
content-type
application/javascript
x-amz-cf-id
MQmjLEZrT9Rpc02TBMPsxUTq53iEnKxzHiEUJGilr6cKySaoJJHxkA==
expires
Thu, 09 Feb 2023 00:33:04 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.11843/sass/ Frame 9D5D 		20 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.11843/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76e2bca54d321dfd4cebf8797b2c9a81ccb1c0619d4da3a7c53d4e6228c5a61d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
via
1.1 f27399799a88e43e05ddb32625905f37.cloudfront.net (CloudFront)
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
30786
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
text/css
x-amz-replication-status
PENDING
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 15 Nov 2021 19:50:41 GMT
server
cloudflare
etag
W/"370a89ea102d7b437eb549729472631f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ofWlz5LoDBmKDbZO5girhqh5MyP4wwBB0DEkqFJ18lLf8Ygs0mIm2oCClWMOKpQXB0yWFArUVX%2FgMNIAsZge7xB9LjBpC6A06pPti29j%2FsjozMHzfmuhkUjni8KuOTi4HlVtnnS3niJvQnvHD%2FKJvXtnHO0%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
LgyvJN0nZOCplqIYlCYJJ1cibXdW_3K_
cache-control
public, max-age=31536000
x-amz-cf-pop
MXP63-P3
cf-ray
6da90114caaa0f56-MXP
x-amz-cf-id
-rwZfmt0QScCyvjzPKkGCr5V-lJ2c0WRsRMqOS00JTcLq_Ay_34fLw==
expires
Thu, 09 Feb 2023 00:33:04 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.206/ Frame 9D5D 		294 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.206/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0da1aa9fc286445ae603f5ec9db48938afb4c0b899485d2f216c26e17f1ee6f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
via
1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1269480
x-amz-server-side-encryption
AES256
cf-ray
6da90114aa729170-FRA
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
x-amz-replication-status
COMPLETED
access-control-allow-methods
GET
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 21 Jan 2022 23:06:10 GMT
server
cloudflare
etag
W/"d341593506227848d1510aaf56772b56"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xv%2BZQAq3cKjp12MCBukIaxEtjHAcvK3XPUZqj%2BhQGExGPpe0jtBTR%2F7A2tEe904RSrAQZ6U%2B3suRdptfaRzfv759XbbULsD90GtU1qNfEjmg3G8Sj29C83KUJSXKR8rt99v0aG852xB3bZPdBpax42Tkd%2B4%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
CkcDA7ID1zE3E4DnyOynfcisozMRTkKN
access-control-allow-origin
https://app.hubspot.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P2
content-type
application/javascript
x-amz-cf-id
XjI1_esnHFXNEYQYxlPbdpUKxLSsuIa5urW-9cDWuKIspzexFolwTg==
expires
Thu, 09 Feb 2023 00:33:04 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.12099/bundles/ Frame 9D5D 		497 KB
145 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.12099/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72c48f3eacccd47ae3f15b9c75857068f45f7a3a9e3beba622e1e2af8ee41b62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
via
1.1 3ac8e795602d9d156b63546d3d0aaad0.cloudfront.net (CloudFront)
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
116523
x-amz-server-side-encryption
AES256
cf-ray
6da90114aa739170-FRA
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
access-control-allow-methods
GET
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 07 Feb 2022 15:23:50 GMT
server
cloudflare
etag
W/"9d48353aa53c1f5f428c27a7509a8730"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALuW00DZXnKEG2qWGkZQVYSW%2FzC4oBoqELFP1Uh7cKdzAzP5pj60ETrNdz%2B826q0ORBhJg2fxAp6y6FBom1O02uFELR1wrmWlvjua8vIE4g%2Bokgpi9TyERrhmBETk%2FwBjjW%2BGhqIIcoLi9zy7sBTMlrQpXg%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
uPGiPX6LueS9mxMqlg9wBjGMGfjgWT2_
access-control-allow-origin
https://app.hubspot.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
DUS51-P2
content-type
application/javascript
x-amz-cf-id
wWQRuOi2KeuHTaO_cy7b5xuq9B0aaB-Gs0s2XHOzrXwkT_Z5_TQ6YA==
expires
Thu, 09 Feb 2023 00:33:04 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.12074/ Frame 9D5D 		776 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.12074/i18n-data-data-locales-en-us.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f44a7d5049036b72ea34f5840d7b1fd4aa6656a35cab6ee8dcaeb8378dae4f86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 00:33:04 GMT
via
1.1 8a18f55d51efc3ad7cf529879a3478f4.cloudfront.net (CloudFront)
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
438460
x-amz-server-side-encryption
AES256
cf-ray
6da9011588d75a2b-MXP
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
access-control-allow-methods
GET
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 02 Feb 2022 19:50:12 GMT
server
cloudflare
etag
W/"8fa86c1ec5bf5e984fff15f4f2285880"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B26%2BdPhGRnusznNYO2AYiGnZLDHlURvx2xFXFcM%2Btt8Zu%2Bo5J8tYPgHm2JdNN2feDExb2hP88M7dSMkEWXQuT2AEBY7P6rboFE0UbnnssFNVWzpk6iMwiGT4i62Di0OBd3tzVTZvxRCvakKyNzJGlGNcH2o%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
dkaElanIdqe4GlKaI8V.fTzeZ19rXMCD
access-control-allow-origin
https://app.hubspot.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
MXP63-P3
content-type
application/javascript
x-amz-cf-id
ZWmFEa5STWaHUvnnsSPWMfXNNPZKMlyLMRzAheY4H3oSNgAzpHh_OQ==
expires
Thu, 09 Feb 2023 00:33:04 GMT
nr-spa-1198.min.js
js-agent.newrelic.com/ Frame 9D5D 		38 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1198.min.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8ec272b76ebdf8756da8e60cbec342b26e1e314d223b828e34b02aedea5d6d5a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
etag
"498f8d87fcfe5e90fda6a3ae4c47c6b0"
x-amz-request-id
X82ZCJV29MAD67M9
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
14594
x-amz-id-2
PU+YmtR8Q8LpzvigPhFtbd+hPlOk6X7vmEQ5NOfNLxjQmqubix9FWx6M3Y9EKjxiZ45GqfNfBgU=
x-served-by
cache-hhn4043-HHN
last-modified
Fri, 29 Jan 2021 19:19:10 GMT
server
AmazonS3
x-timer
S1644366785.958861,VS0,VE0
date
Wed, 09 Feb 2022 00:33:04 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
122
favicon.png
cdn2.hubspot.net/hub/6553015/hubfs/ Frame 9D5D 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn2.hubspot.net/hub/6553015/hubfs/favicon.png?width=108&height=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:f1cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8e0fb41befe01f4e802148dbef00a038fc9d040897a65a06e9a2a3526a1876d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-methods
GET
date
Wed, 09 Feb 2022 00:33:05 GMT
via
1.1 040f8a2cdffe1cf7a35d28e06c3ed574.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
54993
cf-polished
origFmt=png, origSize=2701
edge-cache-tag
F-29133801061,P-6553015,FLS-ALL
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="favicon.webp"
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 12
content-length
1294
x-amz-server-side-encryption
AES256
last-modified
Sun, 23 Jan 2022 23:20:29 GMT
server
cloudflare
x-cache
RefreshHit from cloudfront
etag
"96621895ab28aaa76d09ec5cb513d204"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FrdTvwFSyiIXyzrawI3Lxm77b3NjsmtCbE96mTuZmzsnCFStm%2BEWOii0NwJO9glDs2LWGc6zGCl13D9fRffjuOuNvW8rBBRO7x4wpMOtEGPJP51C250KSJ8Um%2FR7Qp6XUb1bIzdTRlbfWtf%2BOmc%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cf-bgj
imgq:85,h2pri
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-cf-pop
IAD89-P1
accept-ranges
bytes
cf-ray
6da901165f3959b3-MXP
x-amz-cf-id
lrv4PUThhteeQHpzcfO_EnI8lC_vbeU05OWNi2yCP-K_y3Ggd9ijDA==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 12
rhumb
api.hubspot.com/cartographer/v1/ Frame 9D5D 		0
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.12099
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.12099/bundles/visitor.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 09 Feb 2022 00:33:05 GMT
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
3e49870f-c85d-41a7-a28a-c79252a47b14
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
604800
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lde8dyZ3i3jMdxvk7qqKqmDPyf%2F5L6sYpq6j5nD2HzdIDKlqVdpJkjjCV2W9VvRlr81eLWqvezGhHAa6arSgRLV411o6uMGeWWvWSGjnne1mkB6pORW340X2P7HGfO0BtBjdjrN4a7ZSF%2FxCaw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-credentials
true
cf-ray
6da901163e7083a6-MXP
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
f9d051f404
bam.nr-data.net/1/ Frame 9D5D 		57 B
322 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/f9d051f404?a=205242107&sa=1&v=1198.fe6ec20&t=Unnamed%20Transaction&rst=491&ck=1&ref=https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4&be=281&fe=418&dc=341&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1644366784512,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:0,%22c%22:0,%22ce%22:0,%22rq%22:10,%22rp%22:192,%22rpe%22:194,%22dl%22:195,%22di%22:341,%22ds%22:341,%22de%22:341,%22dc%22:418,%22l%22:418,%22le%22:419%7D,%22navigation%22:%7B%7D%7D&fp=479&ja=%7B%22nrSnippetVersion%22:%221198%22,%22environment%22:%22prod%22,%22deployed%22:true,%22hublet%22:%22na1%22,%22userAgentRaw%22:%22Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/97.0.4692.71%20Safari/537.36%22,%22supportsPromiseRejectionEvent%22:true,%22deviceMemory%22:8,%22cpuCores%22:4,%22downloadSpeedMbps%22:10,%22effectiveConnectionType%22:%224g%22,%22networkLatencyMs%22:0,%22conditionalPolyfillsInstalled%22:false,%22portalId%22:6553015,%22package%22:%22conversations-visitor-ui%22,%22packageVersion%22:%221.12099%22,%22template%22:%22html/visitor-index.html.jade%22,%22user-online%22:true,%22visibility%22:%22visible%22,%22currentVisibility%22:%22visible%22,%22isEmbeddedInProduct%22:%22false%22,%22reactRhumbVersion%22:%221.6973%22,%22reaganVersion%22:%22react-rhumb%22,%22route%22:%22/%22,%22numReaganChecksStarted%22:1,%22numPreviousReaganChecksAborted%22:0,%22avgDurationBeforePreviousReaganAborts%22:0,%22numPreviousReaganChecksFailed%22:0,%22numPreviousReaganChecksSuccessful%22:0,%22supportsUserTiming%22:true,%22supportsPerformanceTimeline%22:true,%22supportsHighResolutionTime%22:true%7D&jsonp=NREUM.setToken
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.20 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-8.nr-data.net
Software
/
Resource Hash
5e864c2e3f674c60970513411eaeeeafd2d615d842e65ec01d09ccfcb4a7b38d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Cross-Origin-Resource-Policy
cross-origin
Content-Type
text/javascript;charset=iso-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT
f9d051f404
bam.nr-data.net/events/1/ Frame 9D5D 		24 B
182 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/events/1/f9d051f404?a=205242107&sa=1&v=1198.fe6ec20&t=Unnamed%20Transaction&rst=938&ck=1&ref=https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/6553015/threads/utk/49a3e1ac623e41be9dd31dc0b31807d4?uuid=339fe47d9dc740a4b807675dc9c321f2&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=rewterz.com&inApp53=false&messagesUtk=49a3e1ac623e41be9dd31dc0b31807d4&url=https%3A%2F%2Fwww.rewterz.com%2Frewterz-news%2Frewterz-threat-alert-kimsuky-apt-group-active-iocs-10&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.20 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-8.nr-data.net
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://app.hubspot.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type
text/plain

Response headers

Access-Control-Allow-Origin
https://app.hubspot.com
Access-Control-Allow-Credentials
true
Content-Length
24
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| ga object| _wpemojiSettings object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| $ function| jQuery undefined| RS_CacheGS undefined| RS_CacheGS_queue undefined| RS_Cache_define object| punchgs object| _gsScope undefined| GreenSockGlobals undefined| _gsQueue undefined| _gsDefine object| _hsq function| setREVStartSize undefined| recaptcha_script object| wpcf7 object| leadin_wordpress object| awsmJobsPublic object| _hsp object| __hsCollectedFormsDebug object| _paq function| sanitizeKey boolean| _hstc_loaded boolean| _hspb_loaded object| mfn object| twemoji object| wp function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Isotope function| Masonry object| NiceScroll function| Waypoint function| animateElement function| randomClass function| animateOnce function| animateInfinite function| animateEnd string| triggerClasses object| classesArray number| classAmount object| jQuery1124012057430062864083 object| mfnSetup function| fahamTabs function| fahamTabs2 function| fahamTabs3 function| fahamTabs4 object| addComment boolean| hubspot_live_messages_running object| HubSpotConversations boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| _hspb_ran

10 Cookies

Domain/Path Name / Value
.www.rewterz.com/ Name: _ga
Value: GA1.3.1336169491.1644366782
.www.rewterz.com/ Name: _gid
Value: GA1.3.1730139191.1644366782
.www.rewterz.com/ Name: _gat
Value: 1
.rewterz.com/ Name: __hstc
Value: 107359773.8770e9c62598aa04150024c604fa2f9b.1644366784437.1644366784437.1644366784437.1
.rewterz.com/ Name: hubspotutk
Value: 8770e9c62598aa04150024c604fa2f9b
.rewterz.com/ Name: __hssrc
Value: 1
.rewterz.com/ Name: __hssc
Value: 107359773.1.1644366784437
.hubspot.com/ Name: __cf_bm
Value: M2oi2fj43tLolfVacSO1QmT6A2w0seVuaYyL.di6YFQ-1644366784-0-Af+qM8GSF//O7OwFFabAk3nmwUnEM7l4zACcGyEfktBiEoLRzshNjjsBtoq6byuAaO6plGPU14ML0Rp06YzctJI=
.rewterz.com/ Name: messagesUtk
Value: 49a3e1ac623e41be9dd31dc0b31807d4
.nr-data.net/ Name: JSESSIONID
Value: 28eea468a3c9b3c9

2 Console Messages

Source Level URL
Text
network error URL: https://www.google.com/recaptcha/api.js?render=6LeZMPUUAAAAAAyP4jMxny5YCmdlhV1JYPKHcdl7&ver=3.0
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://www.google.com/recaptcha/api.js?render=6LeZMPUUAAAAAAyP4jMxny5YCmdlhV1JYPKHcdl7&ver=3.0
Message:
Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubspot.com
app.hubspot.com
app.sirp.io
bam.nr-data.net
cdn2.hubspot.net
fonts.googleapis.com
fonts.gstatic.com
forms.hsforms.com
forms.hubspot.com
js-agent.newrelic.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.usemessages.com
static.hsappstatic.net
stats.g.doubleclick.net
track.hubspot.com
www.google-analytics.com
www.google.com
www.rewterz.com
104.236.170.110
138.197.223.24
151.101.2.137
162.247.242.20
2606:4700::6810:5905
2606:4700::6811:46b0
2606:4700::6811:7d2
2606:4700::6811:82ab
2606:4700::6811:d3cc
2606:4700::6811:ebcc
2606:4700::6811:f1cc
2606:4700::6812:14bf
2606:4700::6813:9a53
2606:4700::6813:9b53
2a00:1450:4001:802::2003
2a00:1450:4001:80f::2004
2a00:1450:4001:811::200e
2a00:1450:4001:82b::200a
2a00:1450:400c:c08::9a
0b571c07e44f98a07485f7fb4c9aa03cd374cd05c01a2127c7b2862ef7ea70e5
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d0bdfae4cb656e89432e63fef2db52612a81997d58810d73c45fb065f807875
144ee8fd3d8997d932fe2b5497979e7cde8fda86b41b0c6e32e47faa8e1157e7
194ebae85ff853319e8668f23a4c5bf371a7d9f5d550a40980ab53026ddaaa17
1a4651c562bac53f6d33b1d8093551a818571a6b595304ba4813bc7b5d503783
1b4f1024fa4887b47765e2ad4db9bc1f6ea96335f77fd44c62b8538d75e7190c
1da5937ea42239582696f732d7713fb6f901aa8f98d35577bad12bd2ecb9b5fe
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
22609383a832064e74824c4152795ad7b7ebfdc7aa940c3fe42eb0d4634fa7d6
255058e0679222d012f8dc8c3a788a2eb5e5f295cac9e9852ac144d2f7d7df39
25946407ffe7464efd7ca1123c553ed781409890e0f700b9492f402842e61e08
33189ed1c63f103baa23abcf3ba58a132b955a807b2cbc741acbb9011ac4306e
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
43a68281c1d759e7214cb0c6699944953819e5a5bb78777e65fb87fecb6170f6
43ed7685692a12820d9beb61901d18f137e840fd80a85960cd0a3b46dea6dc01
45012f93c4cbd739c51f4043a3a1d3c8377272ef606dd39e51a6a81e02dad594
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4c10433f7319eb6d8004fa831a042b8a5e126505f0ed9de60eceba149f484de5
4f00ec40b144121114b6cec693fccc2b51a06ab01fc34defa466467b581a7f2c
559a910060423ed485ddc062a9ab5318859bbfde26be3f73d9b83ac0b9dae677
56079921a1d7384629e164b07214e18ee1e650d3495c7cdb78a79e0775b0cebf
593998021e5710fcc6797244da4006389ea8a5c15dc3ce7a661685cb36638844
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5e211fbc080dcb010d1cf54917aa2d6b33d4eb70160fd4d5acc2e0b69c3c2286
5e864c2e3f674c60970513411eaeeeafd2d615d842e65ec01d09ccfcb4a7b38d
602797e80613c3623325594e96463093c626554dff563622e8fbc3e795d283e0
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f3678578e1fcd6df957011ade74254df8311409fd8e039246566c362a686be9
72c48f3eacccd47ae3f15b9c75857068f45f7a3a9e3beba622e1e2af8ee41b62
72ebfeb1ce24b152349b7a231f6fc29ff2a2b7a5ede91dcdb80d6b9de1779046
76e2bca54d321dfd4cebf8797b2c9a81ccb1c0619d4da3a7c53d4e6228c5a61d
7d7d1c0e280bf428ece29fcf06aceb930039e8524a81a62860922e3b45497e76
7e8d54d6c6a4ebd0237786d41ff5d205096eda696f2a5b591e074fe94ba3b3af
811e8960b8f79f14983e30df80a4ccc69d82430ccc0520d2a1a3d1405cfbb2a1
86d7face00e310c8bf5209ca56f56726fc95a48b2e39db93bcf2cb9c635a5750
87c71630ad19e3ff0e0614c5ffdac90cfdb587a9a365fc82c7e00f92acab5cc9
8ec272b76ebdf8756da8e60cbec342b26e1e314d223b828e34b02aedea5d6d5a
956fa56f513e1a8025bc85f9314a1747eb061d434403393591145e4ae898c694
96b656700f9b4784f69af925f46ecc91caa7f444b3168ecbb64afe06f8fc4c99
9af25ef0d99c5ef2c6f3b595b1716009858fc4bc71838ffcd61706bda396d261
a0da1aa9fc286445ae603f5ec9db48938afb4c0b899485d2f216c26e17f1ee6f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
ab1bcd9efd1e8a6b48bffec44e1a902bf56b14b9c6bf2733e63c9c4f36f27ff6
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b91aab00697781a1fb184945cd6e7602db0d45458fa58a53156110945f2b71be
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c22005bbdf738de61a4c2ee99c2b3c4fe52f336dfc8aa274860c58c845027d50
c36a1d5b71cce2b22a63e9593f75c0170f2620ed7bbad0bc12739accd84d38ce
caab2844b34d9a5ad18ee9f25c3a1bcc892ab2fa67d279255a73dffd292c5a69
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d1814382a8f430d8d2cea5b0e19569f887ae8bd265310aa6176422ee3ee87f60
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e1b353d29e7d83a10563bebdba667e7f69d82d2b59741e07a83b6ec402e12f1d
e1bf58f34b987e2d456fa4cd6ba276dfe73e13c468693df1a819b991ccf01c5c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f8fe8be5315daeeb5d49bdcf7476aa2edc96d1aec2a3b2246d69fe8f614924
e803d4290c5baec790ecde06d9308c6bf17f967c8232e3651844bfd60dd2a9f5
ee27045d1b3d6c34e7f2cc6445d625e9f74acb7723ca587fa81c1dfa15ca650e
efef41820e804a2100709808b914c8a9a4cf35065e7531475359c5da70ddfeed
f25f13e58a8709b8aa0bd7ebaa2d8f17fdfe165c55ccb8b96d862fe8f8caa90f
f44a7d5049036b72ea34f5840d7b1fd4aa6656a35cab6ee8dcaeb8378dae4f86
f8e0fb41befe01f4e802148dbef00a038fc9d040897a65a06e9a2a3526a1876d