www.recordedfuture.com Open in urlscan Pro
104.18.35.90 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Submission: On September 02 via api (September 2nd 2024, 2:14:28 am UTC) from TR — Scanned from US

Summary HTTP 107 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 34 IPs in 3 countries across 24 domains to perform 107 HTTP transactions. The main IP is 104.18.35.90, located in and belongs to CLOUDFLARENET, US. The main domain is www.recordedfuture.com. The Cisco Umbrella rank of the primary domain is 720652.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 7th 2024. Valid for: a year.

This is the only time www.recordedfuture.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	104.18.35.90 104.18.35.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.130.216 151.101.130.216	54113 (FASTLY) (FASTLY)
8	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2607:f8b0:400... 2607:f8b0:4006:81d::2008	15169 (GOOGLE) (GOOGLE)
12	23.34.59.33 23.34.59.33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.44.157 151.101.44.157	54113 (FASTLY) (FASTLY)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d12e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80b::200a	15169 (GOOGLE) (GOOGLE)
2	157.240.241.1 157.240.241.1	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:24f... 2600:9000:24f0:f800:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:8cd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:81e::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:38::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c19::9a	15169 (GOOGLE) (GOOGLE)
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
3	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8c11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	18.195.235.189 18.195.235.189	16509 (AMAZON-02) (AMAZON-02)
1	142.250.80.100 142.250.80.100	15169 (GOOGLE) (GOOGLE)
1	68.67.160.26 68.67.160.26	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48c5	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.204.192.231 52.204.192.231	14618 (AMAZON-AES) (AMAZON-AES)
1	104.19.175.188 104.19.175.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.60.103.254 199.60.103.254	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
107	34

38 104.18.35.90 (None, )

ASN13335 (CLOUDFLARENET, US)

www.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.130.216 (San Francisco, United States)

ASN54113 (FASTLY, US)

cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:81d::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 23.34.59.33 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-34-59-33.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.44.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d12e (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2008 (United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80b::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.241.1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:24f0:f800:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8cd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:38::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c19::9a (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8c11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.235.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.100 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.160.26 (Colonia, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48c5 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.204.192.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-192-231.compute-1.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.175.188 (None, )

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.60.103.254 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	recordedfuture.com www.recordedfuture.com — Cisco Umbrella Rank: 720652 cms.recordedfuture.com go.recordedfuture.com	1 MB
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 12402 c.6sc.co — Cisco Umbrella Rank: 16017 ipv6.6sc.co — Cisco Umbrella Rank: 12823 b.6sc.co — Cisco Umbrella Rank: 6896	24 KB
8	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 4988	150 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 669 www.linkedin.com — Cisco Umbrella Rank: 914 px4.ads.linkedin.com — Cisco Umbrella Rank: 7330	5 KB
5	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 8139 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 8074 track.hubspot.com — Cisco Umbrella Rank: 5359 forms.hubspot.com — Cisco Umbrella Rank: 11636	29 KB
4	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 77 td.doubleclick.net — Cisco Umbrella Rank: 481 stats.g.doubleclick.net — Cisco Umbrella Rank: 252	3 KB
4	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 29612 recordedfuture.matomo.cloud	130 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	306 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 18992	725 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	3 KB
2	google.com analytics.google.com — Cisco Umbrella Rank: 238 www.google.com — Cisco Umbrella Rank: 10	64 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	73 KB
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 951	17 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 8524	925 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 764	705 B
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 11009	92 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5135	25 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5067	19 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 1356	394 B
1	t.co t.co — Cisco Umbrella Rank: 979	622 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5414	1 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 641	31 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1884	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1253	15 KB
107	24

	Domain	Requested by
38	www.recordedfuture.com	www.recordedfuture.com
9	b.6sc.co
8	dev.visualwebsiteoptimizer.com	www.recordedfuture.com
6	cms.recordedfuture.com	www.recordedfuture.com
5	px.ads.linkedin.com	3 redirects snap.licdn.com
3	www.googletagmanager.com	www.recordedfuture.com www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	track.hubspot.com
2	www.facebook.com
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	td.doubleclick.net	www.googletagmanager.com
2	cdn.matomo.cloud	www.recordedfuture.com
2	connect.facebook.net	www.recordedfuture.com connect.facebook.net
2	ssl.google-analytics.com	www.recordedfuture.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
1	go.recordedfuture.com
1	forms.hubspot.com	js.hsleadflows.net
1	perf-na1.hsforms.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	www.google.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	analytics.twitter.com
1	t.co
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	ajax.googleapis.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
107	38

This site contains links to these domains. Also see Links.

Domain
app.recordedfuture.com
go.recordedfuture.com
www.youtube.com
www.facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.recordedfuture.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-07` - `2025-03-08`	a year	crt.sh
cms.recordedfuture.com R10	`2024-07-12` - `2024-10-10`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
upload.video.google.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-11` - `2024-09-09`	3 months	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M03	`2023-10-27` - `2024-11-23`	a year	crt.sh
hs-scripts.com WE1	`2024-07-29` - `2024-10-27`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
*.google.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hs-banner.com WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
hs-analytics.net WE1	`2024-08-09` - `2024-11-07`	3 months	crt.sh
hsleadflows.net WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-08-27` - `2025-02-27`	6 months	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2024-05-21` - `2025-06-19`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-23` - `2025-05-22`	a year	crt.sh
hsforms.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh
go.recordedfuture.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Frame ID: A3BFE9BA24FC66406FDDA2B5F04AA30C
Requests: 103 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1003136084?random=1725243262131&cv=11&fst=1725243262131&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be48s0v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&hn=www.googleadservices.com&frm=0&tiba=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&npa=0&pscdl=noapi&auid=1569903394.1725243262&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 703B3FC146026E87092EC5F4B79D45A3
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-MHTMF48BZH&gacid=564467894.1725243262&gtm=45je48s0v873499763z8830966511za200zb830966511&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1248841301
Frame ID: 43D5974B77ACE7D608C64BEA63F9CC52
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

GreenCharlie Infrastructure Targeting US Political Entities with Advanced Phishing and Malware

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

107
Requests

98 %
HTTPS

52 %
IPv6

24
Domains

38
Subdomains

34
IPs

3
Countries

2341 kB
Transfer

7111 kB
Size

47
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://app.recordedfuture.com/live/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo?utm_campaign=rf-research-top-demo-floating-nav-bar-2024&utm_source=recordedfuture&utm_medium=website&utm_content=rf-research-top-demo-floating-nav-bar-2024&utm_term=rf-research-top-demo-floating-nav-bar-2024
Title: Get a demo

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/2023-state-of-threat-intelligence?utm_campaign=rf-research-left-floating-cta&utm_source=recordedfuture&utm_medium=website&utm_content=rf-research-left-floating-cta&utm_term=rf-research-left-floating-cta
Title: 2023 State of Threat IntelligenceSee how top cybersecurity experts use threat intelligence, where they source it, and their plans to enhance it. Download Now for Free

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf
Title: click here

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.facebook.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://twitter.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.instagram.com/recordedfuture/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1725243262507%26li_adsId%3D3f9923dc-6907-4e5c-bded-b7f05407c169%26url%3Dhttps%253A%252F%252Fwww.recordedfuture.com%252Fresearch%252Fgreencharlie-infrastructure-linked-us-political-campaign-targeting%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK0FkuiozXz8wAAAZGwgwfAtnpfWnngpGtUb162igaCRby3_QZEsalSHGZynZ8MLj3pbhg

107 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request greencharlie-infrastructure-linked-us-political-campaign-targeting Show response
www.recordedfuture.com/research/ 89 KB
17 KB 221ms
139ms Document
text/html 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

1197435f564de6a2e0db3302fc8a9cee513cff938d0d038558c8822d4d7ddd2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

age: 0
cache-control: s-maxage=30, stale-while-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8bc9fc6bee2bdad5-MIA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 02 Sep 2024 02:14:20 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
traceresponse: 00-17f14b9ae301e8473c2ea1ddaacd4f3c-7d17b2ac5b8f9a80-01
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-nextjs-cache: HIT
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0
x-powered-by: Next.js
x-served-by: cache-mia-kmia1760042-MIA

GET
H2 200 brand_logo_long_black_f2ead5b5c6.svg
cms.recordedfuture.com/uploads/ 4 KB
2 KB 128ms
33ms Image
image/svg+xml 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Sun, 18 Aug 2024 03:52:33 GMT
date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
age: 248
traceresponse: 00-17ecb5fc9a3640f7d48cd427c79c2f6d-3c24a9ad7ee3bed3-01
x-cache: HIT
content-length: 1262
x-served-by: cache-mia-kmia1760027-MIA
last-modified: Thu, 10 Mar 2022 10:37:46 GMT
etag: W/"6229d4fa-eab"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 large_greencharlie_infrastructure_linked_us_political_campaign_targeting_07328802cc.webp
cms.recordedfuture.com/uploads/ 31 KB
31 KB 323ms
228ms Image
image/webp 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/large_greencharlie_infrastructure_linked_us_political_campaign_targeting_07328802cc.webp?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c1272d6b62fc1069af0b1d1dc0b5c323aeb0c1aa078cffa61b534fc18a9ff898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
fastly-io-served-by: vpop-kiad7010226
traceresponse: 00-17f14b9af1cb42f1fd500a29a0fe0ba4-091e7284f8c5f0ba-01
age: 0
x-cache: MISS
fastly-io-info: ifsz=31726 idim=1000x375 ifmt=webp ofsz=31726 odim=1000x375 ofmt=webp
fastly-stats: io=1
content-length: 31726
fastly-io-warning: Failed to shrink image
x-served-by: cache-mia-kmia1760027-MIA
etag: "p7Dks/3A51oCVaoKhxOmJv4t5OvHa2r6Oqz+cZfPhzU"
vary: Accept-Encoding
content-type: image/webp
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Mon, 02 Sep 2024 02:19:21 GMT

GET
H2 200 fonts.css
www.recordedfuture.com/fonts/ 1 KB
443 B 127ms
123ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/fonts.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f14b9aec23b73215c659d26e67cc42-c378b2068e223566-01
x-cache: MISS
content-length: 208
x-served-by: cache-mia-kmia1760092-MIA
last-modified: Thu, 29 Aug 2024 10:00:14 GMT
server: cloudflare
etag: W/"416-1919d9417b0"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6cef5edad5-MIA
x-cache-hits: 0

GET
H2 200 55263b8383f3eae5.css
www.recordedfuture.com/_next/static/css/ 65 KB
14 KB 54ms
52ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d441d3291c595de79459b33a46d24844b8b6d9a8a9cdb17e86d3a462c35df9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
age: 316859
traceresponse: 00-17f02b6c522936f8eefab97fd35ef55c-50984a6e20fd0a95-01
cf-polished: origSize=67063
content-encoding: gzip
x-cache: MISS
x-served-by: cache-mia-kmia1760080-MIA
cf-bgj: minify
last-modified: Thu, 29 Aug 2024 10:06:13 GMT
server: cloudflare
etag: W/"105f7-1919d9995d6"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8bc9fc6cef63dad5-MIA
x-cache-hits: 0

GET
H2 200 1a6394c91d198e5b.css
www.recordedfuture.com/_next/static/css/ 25 KB
6 KB 50ms
48ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/1a6394c91d198e5b.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
age: 1448340
traceresponse: 00-17ec2658c2268c3fe31ce01d8aa943c7-3a3a1595fa57c461-01
cf-polished: origSize=25271
content-encoding: gzip
x-cache: MISS
x-served-by: cache-mia-kmia1760097-MIA
cf-bgj: minify
last-modified: Fri, 16 Aug 2024 07:49:39 GMT
server: cloudflare
etag: W/"62b7-1915a29dfb3"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8bc9fc6cef67dad5-MIA
x-cache-hits: 0

GET
H2 200 webpack-3426fee6118783c6.js Show response
www.recordedfuture.com/_next/static/chunks/ 5 KB
2 KB 68ms
62ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/webpack-3426fee6118783c6.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a5ea319fe4ca5ea7352c79efc625a6e5fa46249dce974f0b38af2940093949c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 316859
traceresponse: 00-17f02b6c5198ebd0493cd836e73b4944-231daed64caf38c3-01
x-cache: MISS
content-length: 2268
x-served-by: cache-mia-kmia1760091-MIA
last-modified: Thu, 29 Aug 2024 10:06:13 GMT
server: cloudflare
etag: W/"1562-1919d9995b7"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fabdad5-MIA
x-cache-hits: 0

GET
H2 200 framework-467b11a89995b152.js Show response
www.recordedfuture.com/_next/static/chunks/ 138 KB
45 KB 51ms
46ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6006496
traceresponse: 00-17d660673fe845ed7ead4a1c825ddab6-84250757f45eadda-01
x-cache: HIT
content-length: 45457
x-served-by: cache-mia-kmia1760021-MIA
last-modified: Wed, 05 Jun 2024 12:55:41 GMT
server: cloudflare
etag: W/"2270d-18fe8783003"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1faddad5-MIA
x-cache-hits: 0

GET
H2 200 main-75bdb96a41ba80f4.js Show response
www.recordedfuture.com/_next/static/chunks/ 113 KB
32 KB 65ms
61ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5467879
traceresponse: 00-17dc8bb648bde67d5586dd577884db5b-6e8eb2a44ede30e3-01
x-cache: HIT
content-length: 33036
x-served-by: cache-mia-kmia1760068-MIA
last-modified: Wed, 26 Jun 2024 11:42:39 GMT
server: cloudflare
etag: W/"1c3b0-190545adba7"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fb0dad5-MIA
x-cache-hits: 0

GET
H2 200 _app-7dce919248be9c19.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 129 KB
40 KB 65ms
60ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/_app-7dce919248be9c19.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4457670
traceresponse: 00-17e17560ac4ea0c6bbec4edda3d72fc7-82042be1eeabfcd9-01
x-cache: MISS
content-length: 40876
x-served-by: cache-mia-kmia1760046-MIA
last-modified: Fri, 12 Jul 2024 11:58:22 GMT
server: cloudflare
etag: W/"20521-190a6cf008c"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fb3dad5-MIA
x-cache-hits: 0

GET
H2 200 769-f95d08d81b193fa5.js Show response
www.recordedfuture.com/_next/static/chunks/ 262 KB
77 KB 67ms
63ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/769-f95d08d81b193fa5.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4457670
traceresponse: 00-17e17560b058f446aff14dda7d2d8b80-d09f2f05a39d75eb-01
x-cache: MISS
content-length: 78499
x-served-by: cache-mia-kmia1760075-MIA
last-modified: Fri, 12 Jul 2024 11:58:22 GMT
server: cloudflare
etag: W/"419c1-190a6cf0019"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fb6dad5-MIA
x-cache-hits: 0

GET
H2 200 129-82bd73d6c6af04c1.js Show response
www.recordedfuture.com/_next/static/chunks/ 37 KB
12 KB 66ms
62ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/129-82bd73d6c6af04c1.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2310551
traceresponse: 00-17e9162bb9fa0ac3a5087b26cdf99de5-12484bfba2555296-01
x-cache: MISS
content-length: 11656
x-served-by: cache-mia-kmia1760033-MIA
last-modified: Tue, 06 Aug 2024 07:51:56 GMT
server: cloudflare
etag: W/"958c-19126ac5d80"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fb7dad5-MIA
x-cache-hits: 0

GET
H2 200 911-ff01f8a62625f045.js Show response
www.recordedfuture.com/_next/static/chunks/ 55 KB
19 KB 67ms
63ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5228678
traceresponse: 00-17dc8bb6496d3b0dae108dcb3c7ac55a-6434f7fda508151f-01
x-cache: HIT
content-length: 18806
x-served-by: cache-mia-kmia1760021-MIA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"ddd2-190545adb81"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fb9dad5-MIA
x-cache-hits: 0

GET
H2 200 81-2528521366cfa8f4.js Show response
www.recordedfuture.com/_next/static/chunks/ 11 KB
5 KB 83ms
79ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/81-2528521366cfa8f4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd0aa2edbf70120a3664d67d62c7be974905b21305d74bf06b58d4570bb81dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5840489
traceresponse: 00-17dc8bb64939adc738014a8980662975-13a0f857874becef-01
x-cache: MISS
content-length: 4641
x-served-by: cache-mia-kmia1760027-MIA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"2cc8-190545adb72"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fbbdad5-MIA
x-cache-hits: 0

GET
H2 200 407-b4466bcdd3b591b7.js Show response
www.recordedfuture.com/_next/static/chunks/ 15 KB
5 KB 65ms
62ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/407-b4466bcdd3b591b7.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6006496
traceresponse: 00-17d3faa4f4cec69540f1ab7aefbff280-569f1147acb5d93d-01
x-cache: HIT
content-length: 5304
x-served-by: cache-mia-kmia1760043-MIA
last-modified: Fri, 24 May 2024 10:39:11 GMT
server: cloudflare
etag: W/"3cad-18faa2ee783"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fbddad5-MIA
x-cache-hits: 0

GET
H2 200 736-c1f7e6c5744174d7.js Show response
www.recordedfuture.com/_next/static/chunks/ 109 KB
26 KB 65ms
62ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/736-c1f7e6c5744174d7.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b7ab22cdfb33b1ca4a7b1042cd5c8b12cabc5df338d2c75c37a8b48a737a6ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4457650
traceresponse: 00-17e1756558371f1a801367e73f66acd1-8c356588dbe70046-01
x-cache: MISS
content-length: 26126
x-served-by: cache-mia-kmia1760034-MIA
last-modified: Fri, 12 Jul 2024 11:58:22 GMT
server: cloudflare
etag: W/"1b2e0-190a6ceffff"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d1fbedad5-MIA
x-cache-hits: 0

GET
H2 200 267-3c1139a567a7670a.js Show response
www.recordedfuture.com/_next/static/chunks/ 48 KB
12 KB 91ms
88ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/267-3c1139a567a7670a.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99acc5b53fc08d35f064f4a74cad6489a12cd70afa4ad2fffe30e32bba220c42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 531577
traceresponse: 00-17ec2658c23f6df5327feb6df94ca67a-8cdac06b1c671f71-01
x-cache: HIT
content-length: 12356
x-served-by: cache-mia-kmia1760070-MIA
last-modified: Fri, 16 Aug 2024 07:49:38 GMT
server: cloudflare
etag: W/"bff5-1915a29dd5e"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d4fd8dad5-MIA
x-cache-hits: 0

GET
H2 200 396-ca1ff50b9eb90f5a.js Show response
www.recordedfuture.com/_next/static/chunks/ 188 KB
38 KB 89ms
86ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/396-ca1ff50b9eb90f5a.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1cb555d7f97ce00f5861b8cc67c0561e36c4ae5969946fca3db1d8a17c44690

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 317664
traceresponse: 00-17f02ab12242ecd013f1fd1fb1a355dc-38e6331b1df0aa4f-01
x-cache: MISS
content-length: 39133
x-served-by: cache-mia-kmia1760089-MIA
last-modified: Thu, 29 Aug 2024 09:58:45 GMT
server: cloudflare
etag: W/"2eefb-1919d92bcf6"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d4fdcdad5-MIA
x-cache-hits: 0

GET
H2 200 %5B%5B...slug%5D%5D-c22abbfca0c0779f.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 6 KB
2 KB 90ms
87ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-c22abbfca0c0779f.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b7f033e2c33bed91168debd669ea61819410bf35c24f1fc3a400c31846d79ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 317664
traceresponse: 00-17f02ab121eeb9fa183da98e78696502-d195f1ca14ad078d-01
x-cache: MISS
content-length: 1982
x-served-by: cache-mia-kmia1760027-MIA
last-modified: Thu, 29 Aug 2024 09:58:45 GMT
server: cloudflare
etag: W/"1698-1919d92bdda"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d4fdedad5-MIA
x-cache-hits: 0

GET
H2 200 _buildManifest.js Show response
www.recordedfuture.com/_next/static/Dl1KUrCHz_mI45rskEMHc/ 3 KB
1 KB 89ms
87ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/Dl1KUrCHz_mI45rskEMHc/_buildManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e95b67ce429fea646454c33abc0f671720965f678255dad0b0f42e18387af44f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 316860
traceresponse: 00-17f02b6c5362657c153b07549b0b77e6-2b6affeef05b92a4-01
x-cache: MISS
content-length: 880
x-served-by: cache-mia-kmia1760039-MIA
last-modified: Thu, 29 Aug 2024 10:06:13 GMT
server: cloudflare
etag: W/"b0a-1919d999306"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6d4fe0dad5-MIA
x-cache-hits: 0

GET
H2 200 _ssgManifest.js Show response
www.recordedfuture.com/_next/static/Dl1KUrCHz_mI45rskEMHc/ 229 B
395 B 89ms
87ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/Dl1KUrCHz_mI45rskEMHc/_ssgManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91203e702b388668ba42c7929309e90d45cf23900e4c9c37e8da706dcd1550ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
cf-cache-status: HIT
age: 316860
traceresponse: 00-17f02b6c5389714c9d390320cf7a12d8-4b67da8f2d8a4d5e-01
content-encoding: gzip
x-cache: MISS
x-served-by: cache-mia-kmia1760048-MIA
last-modified: Thu, 29 Aug 2024 10:06:13 GMT
server: cloudflare
etag: W/"e5-1919d999315"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8bc9fc6d4fe1dad5-MIA
x-cache-hits: 0

GET
H2 200 insikt_group_logo_updated_3_300x48_b5390f4ff2.png
cms.recordedfuture.com/uploads/ 2 KB
2 KB 238ms
145ms Image
image/png 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
fastly-io-served-by: vpop-kiad7010211
traceresponse: 00-17f140864cef2816e623d357bb9e0b52-ffa1b078a9b9567e-01
age: 0
x-cache: HIT
fastly-io-info: ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png
fastly-stats: io=1
content-length: 2186
fastly-io-warning: Failed to shrink image
x-served-by: cache-mia-kmia1760027-MIA
etag: "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Sun, 01 Sep 2024 22:56:17 GMT

GET
H2 200 x-social-media-black-icon.svg
www.recordedfuture.com/images/ 456 B
487 B 98ms
97ms Image
image/svg+xml 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/images/x-social-media-black-icon.svg

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
cf-cache-status: MISS
content-encoding: gzip
traceresponse: 00-17f14b9aef82167a1a31773848acf1e9-b120513fae6fde06-01
x-cache: MISS
x-served-by: cache-mia-kmia1760026-MIA
last-modified: Thu, 29 Aug 2024 10:00:14 GMT
server: cloudflare
etag: W/"1c8-1919d9417b0"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8bc9fc6d5ff9dad5-MIA
x-cache-hits: 0

GET
H2 200 Inter-Regular.86422bf3.ttf
www.recordedfuture.com/_next/static/media/ 303 KB
144 KB 50ms
47ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8136236
traceresponse: 00-17cd954e91199623d42ff5ebe4112aaf-47e5000fb15578a0-01
x-cache: HIT
content-length: 147167
x-served-by: cache-mia-kmia1760084-MIA
last-modified: Wed, 08 May 2024 13:11:54 GMT
server: cloudflare
etag: W/"4ba44-18f5854f682"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db89fdad5-MIA
x-cache-hits: 0

GET
H2 200 Inter-Bold.0b1aaf81.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 61ms
57ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8136236
traceresponse: 00-17d1a69ee5098f52fd982fbd01298583-97a8da500d882f90-01
x-cache: HIT
content-length: 157388
x-served-by: cache-mia-kmia1760058-MIA
last-modified: Thu, 16 May 2024 07:29:50 GMT
server: cloudflare
etag: W/"4d2c4-18f804eab94"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db8a2dad5-MIA
x-cache-hits: 0

GET
H2 200 icomoon.ttf
www.recordedfuture.com/icons/fonts/ 6 KB
3 KB 191ms
188ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f14b9af4d58a2b491fd070c73a07d6-5e2d388dff1f6a96-01
x-cache: MISS
content-length: 3235
x-served-by: cache-mia-kmia1760045-MIA
last-modified: Thu, 29 Aug 2024 10:00:14 GMT
server: cloudflare
etag: W/"160c-1919d9417b0"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db8a5dad5-MIA
x-cache-hits: 0

GET
H2 200 Inter-SemiBold.ebaf29e9.ttf
www.recordedfuture.com/_next/static/media/ 308 KB
153 KB 59ms
57ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8136236
traceresponse: 00-17d3dda85bf434b73f10f457b85065a1-e2f8b54810c9bae1-01
x-cache: HIT
content-length: 156755
x-served-by: cache-mia-kmia1760049-MIA
last-modified: Fri, 24 May 2024 10:39:12 GMT
server: cloudflare
etag: W/"4d16c-18faa2eead7"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db8a8dad5-MIA
x-cache-hits: 0

GET
H2 200 Inter-ExtraBold.d19caa02.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 59ms
56ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5198578
traceresponse: 00-17da37b577dbc00746c81d4e7e4408b5-7ae8c7c96e9b8916-01
x-cache: HIT
content-length: 157010
x-served-by: cache-mia-kmia1760086-MIA
last-modified: Fri, 14 Jun 2024 09:31:05 GMT
server: cloudflare
etag: W/"4d52c-190161618d4"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db8abdad5-MIA
x-cache-hits: 0

GET
H2 200 Inter-Medium.6ee661b3.ttf
www.recordedfuture.com/_next/static/media/ 307 KB
152 KB 64ms
62ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5198578
traceresponse: 00-17de6255551310faf74664bd055d8f55-cd3f722070253129-01
x-cache: HIT
content-length: 155503
x-served-by: cache-mia-kmia1760088-MIA
last-modified: Mon, 01 Jul 2024 11:07:22 GMT
server: cloudflare
etag: W/"4cd58-1906dfa5ad9"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc6db8afdad5-MIA
x-cache-hits: 0

GET
H2 200 resource-sidebars Show response
cms.recordedfuture.com/api/ 2 KB
3 KB 223ms
153ms XHR
application/json 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

f529c30b1ce9594797f1290c51550edd0e9036b054b675847e7a0bd372abe701

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Mon, 02 Sep 2024 02:14:21 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-permitted-cross-domain-policies: none
age: 0
traceresponse: 00-17f14b9b060588df05b3e7b982963a8b-ba01d9c45c882442-01
x-powered-by: Strapi <strapi.io>
x-dns-prefetch-control: off
x-cache: MISS
via: 1.1 varnish
content-length: 2099
x-served-by: cache-mia-kmia1760054-MIA
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 resources Show response
cms.recordedfuture.com/api/ 26 KB
26 KB 449ms
381ms XHR
application/json 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][0][$or][0][language][name][$in][0]=English&filters[$and][0][$or][1][language][id][$null]=true&filters[$and][1][$or][0][showFrom][$null]=true&filters[$and][1][$or][1][showFrom][$lte]=2024-09-02T02%3A14%3A21Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

e1b769d1357e0cbb42c673ab492f51db227a23e60a1a8f081c6d98be1c1c407a

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Mon, 02 Sep 2024 02:14:21 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-permitted-cross-domain-policies: none
age: 0
traceresponse: 00-17f14b9b05f1f1478fc01b1ffcc5626e-c9c449025b76b0fe-01
x-powered-by: Strapi <strapi.io>
x-dns-prefetch-control: off
x-cache: MISS
via: 1.1 varnish
content-length: 26840
x-served-by: cache-mia-kmia1760054-MIA
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 favicon.ico
www.recordedfuture.com/ 17 KB
921 B 144ms
143ms Other
image/x-icon 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f14b9b0b316147ff9479093e240af3-c632f421a4fd221b-01
x-cache: MISS
content-length: 676
x-served-by: cache-mia-kmia1760062-MIA
last-modified: Thu, 29 Aug 2024 10:00:14 GMT
server: cloudflare
etag: W/"423e-1919d9417b0"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc700bd4dad5-MIA
x-cache-hits: 0

GET
H2 200 blog.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 45 KB
8 KB 108ms
107ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/blog.json?slug=blog

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07544311928b1e97a977a48c1db7be0970251060f497dcc0508a97a7b4971a33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b8f882431f0d3fa39ce6a96f35-fd94e3f6a786194f-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 7938
x-served-by: cache-mia-kmia1760042-MIA
server: cloudflare
etag: "u4ksbbmd5zzvj"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc700be1dad5-MIA
x-cache-hits: 0

GET
H2 200 careers.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 80 KB
14 KB 115ms
114ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/careers.json?slug=careers

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d334dab41287f78e4750c6e7ae5c8085221cdf45167c21da861f8e30820c07b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b8fa4809eb41b84333c16d1cd6-ed9ef220a3227ecb-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 13932
x-served-by: cache-mia-kmia1760052-MIA
server: cloudflare
etag: "lk3xhuuzc1rd1"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701be2dad5-MIA
x-cache-hits: 0

GET
H2 200 contact.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 54 KB
10 KB 115ms
114ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/contact.json?slug=contact

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75150f7b3145ccae00023a5525a8853c45255763ff69aac22b5363297812844

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b8fa469506d4d550cbf351695a-71d423f04a11d0d7-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 10150
x-served-by: cache-mia-kmia1760023-MIA
server: cloudflare
etag: "10ga4oco2p16sh"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701be3dad5-MIA
x-cache-hits: 0

GET
H2 200 index.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 188 KB
28 KB 49ms
49ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/index.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3d470569293bee05ad1f3b3d492b859bad0b739bd4bf43c02957deda2a06b59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 1567
traceresponse: 00-17f03a60de645da8aeaf94dfbc4d6838-7664962f0fa4b071-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 28792
x-served-by: cache-mia-kmia1760047-MIA
server: cloudflare
etag: "ggwqcwsqns44cx"
vary: Accept-Encoding
content-type: application/json
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701be5dad5-MIA
x-cache-hits: 0

GET
H2 200 intelligence-cloud.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/platform/ 79 KB
14 KB 82ms
82ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/platform/intelligence-cloud.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44ca4c7eb7fddde144084e11308efa8ce3df7843573eed6d8fbca4ba69d13b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f14310f5402a0282026cdbb64f893b-3c327858657f09ce-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 13857
x-served-by: cache-mia-kmia1760047-MIA
server: cloudflare
etag: "14m5gd03m5e1q3t"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701beadad5-MIA
x-cache-hits: 0

GET
H2 200 outcomes.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 78 KB
13 KB 125ms
125ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/outcomes.json?slug=outcomes

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58ee400996fa0967ffc3946f23e996f346bde398ba335301e65c0e46d78dfdc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b8f959bb0808a0e2cb22a0a1c5-75787ff9eebd6f44-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 13405
x-served-by: cache-mia-kmia1760027-MIA
server: cloudflare
etag: "64bi6has5l1pjr"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701beddad5-MIA
x-cache-hits: 0

GET
H2 200 client-success.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/services-support/ 52 KB
10 KB 108ms
108ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/services-support/client-success.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a190915c7136ee4ac2b8cce089536de318006b64acaf30a1b184febd6c062e9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b8ff6fde302192b42049bf17a2-f318436e43329bf4-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 9742
x-served-by: cache-mia-kmia1760043-MIA
server: cloudflare
etag: "wow1uc1kv515d7"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=3, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701befdad5-MIA
x-cache-hits: 0

GET
H2 200 research.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 56 KB
10 KB 116ms
116ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/research.json?slug=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3ae531b79acc9fdb0eee344e05151eae8be020b4ba91e8359c0e471710e6667

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b90173ac37f2e9e60522470871-74168046c9baa198-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 10052
x-served-by: cache-mia-kmia1760034-MIA
server: cloudflare
etag: "vojx98ki0717uu"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701bf4dad5-MIA
x-cache-hits: 0

GET
H2 200 resources.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 59 KB
10 KB 79ms
77ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/resources.json?slug=resources

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18582a05e5e720a673b3267694b093418b8cee8f58dfcda483d2ca3f6ceee41c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b90519c90c369e8c9433462efb-408e57e06ccb17cb-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 10174
x-served-by: cache-mia-kmia1760028-MIA
server: cloudflare
etag: "13lvhl935r31aow"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc701bf5dad5-MIA
x-cache-hits: 0

GET
H2 200 company.json Show response
www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/ 51 KB
10 KB 138ms
137ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/Dl1KUrCHz_mI45rskEMHc/company.json?slug=company

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ed6198695780d469e7ee9d8ea338fdc2990416e063faaa6a305a3d5a10116b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f034b9065e09ea422ad7dcdd7b317f-f45a80a2a1e392fa-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 9623
x-served-by: cache-mia-kmia1760044-MIA
server: cloudflare
etag: "df5hs57g1k14jh"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=3, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8bc9fc703c19dad5-MIA
x-cache-hits: 0

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 18 KB
7 KB 301ms
223ms XHR
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&vn=2.1&x=true
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gsc1 /
Resource Hash: d8c2ac941f180b36b5c6d0cba0fd71450d9a00e779bfa6b99301bd997459c299

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 google
server: gsc1
etag: W/"1725029651_EA"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://www.recordedfuture.com
cache-control: public, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 324 KB
107 KB 240ms
102ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e2b593a8d043c631057e4f3efaafdd25a9ebea88f443c4f61a5a57164bace124

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109135
x-xss-protection: 0
last-modified: Mon, 02 Sep 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 02 Sep 2024 02:14:21 GMT

GET
H2 200 1a6394c91d198e5b.css Show response
www.recordedfuture.com/_next/static/css/ 25 KB
0 4ms
4ms Fetch
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/1a6394c91d198e5b.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:20 GMT
via: 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
age: 1448340
traceresponse: 00-17ec2658c2268c3fe31ce01d8aa943c7-3a3a1595fa57c461-01
cf-polished: origSize=25271
content-encoding: gzip
x-cache: MISS
x-served-by: cache-mia-kmia1760097-MIA
cf-bgj: minify
last-modified: Fri, 16 Aug 2024 07:49:39 GMT
server: cloudflare
etag: W/"62b7-1915a29dfb3"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8bc9fc6cef67dad5-MIA
x-cache-hits: 0

GET
H2 200 state_of_threat_intelligence_cta_250f58d535.webp
cms.recordedfuture.com/uploads/ 10 KB
10 KB 159ms
158ms Image
image/webp 151.101.130.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/state_of_threat_intelligence_cta_250f58d535.webp?w=640

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1083d5cb2cd087192da0c3af0c597782f089c76c4a49c578dc1426d90e8afd76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
fastly-io-served-by: vpop-kiad7010247
traceresponse: 00-17f12f2aaaa7fa84c2bc15ca4290f1a9-a00de3df58ee1156-01
age: 0
x-cache: MISS
fastly-io-info: ifsz=10050 idim=296x167 ifmt=webp ofsz=10050 odim=296x167 ofmt=webp
fastly-stats: io=1
content-length: 10050
fastly-io-warning: Failed to shrink image
x-served-by: cache-mia-kmia1760027-MIA
etag: "A8YFayL8TtePesviaNtRFPIQnrl6T+YQsML/PINeYek"
vary: Accept-Encoding
content-type: image/webp
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Sun, 01 Sep 2024 17:38:12 GMT

GET
H3 200 worker-e738a30999ba7ab1af5d578729c27194br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 259 KB
63 KB 69ms
34ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-e738a30999ba7ab1af5d578729c27194br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 26b81e3ff0f39f5a95ac58cfe64ac9fe061c8d0861c5838d3eba4b8483fbf8ac

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 10:08:00 GMT
content-encoding: br
cdn_cache_status: hit
age: 230781
x-guploader-uploadid: AHxI1nMFCHKyY_HH1JfPKekR8aJF6R9_U-LBTDCE0SabDBPxGq0Id1UmVuTN6i9U_LX5BM5r7U1jway9pA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64319
last-modified: Fri, 30 Aug 2024 09:32:38 GMT
server: UploadServer
etag: "ed13694b40c8b2a13841201cc1e672e1"
x-goog-hash: crc32c=y4DWLA==, md5=7RNpS0DIsqE4QSAcweZy4Q==
x-goog-generation: 1725010358908971
content-language: en
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
x-goog-stored-content-length: 64319
accept-ranges: bytes

GET
H3 200 va_gq-5babc0fc397f6f7bfdffbe99cf9557e7br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 269 KB
70 KB 85ms
52ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-5babc0fc397f6f7bfdffbe99cf9557e7br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 979642bc5566e55fbfe157d0185f9119b95ce9d337de8e2fa97a0e4cceab3e31

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 10:08:00 GMT
content-encoding: br
cdn_cache_status: hit
age: 230781
x-guploader-uploadid: AHxI1nMYxZPembeqV8Jvu913rJyxWZJ6kt0KaUcANwVtuKdJYm33rc7D20S7XSaZDPLnYeeh37EX5JqiFg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71391
last-modified: Fri, 30 Aug 2024 09:33:09 GMT
server: UploadServer
etag: "73f3c41bd6e2a730ba2181445a454ab9"
x-goog-hash: crc32c=B34pcA==, md5=c/PEG9bipzC6IYFEWkVKuQ==
x-goog-generation: 1725010389034534
content-language: en
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
x-goog-stored-content-length: 71391
accept-ranges: bytes

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
146 B 68ms
58ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=DF5836DC6821096EA6222ED25FD86953A&h=deb99d6ccf2d0264fb3cb9ccac1a42eb&t=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv02c
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

GET
H2 200 64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response
j.6sc.co/j/ 8 KB
3 KB 252ms
66ms Script
application/javascript 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-34-59-33.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-amz-version-id: MbzeuKlSNW9OmZUUgXztIvtYg.jH191L
content-encoding: gzip
date: Mon, 02 Sep 2024 02:14:22 GMT
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 2186
last-modified: Thu, 25 Jul 2024 13:22:42 GMT
server: AmazonS3
etag: "3fdac343b2a409e8e59493c09517ac69"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=1800
accept-ranges: bytes
x-amz-cf-id: hZmMDQqJjp2OJskhjF0HuCcKblMx7YKjtOJtdEhBPV_ylNo8KII8Hg==
expires: Mon, 02 Sep 2024 02:44:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
105 KB 123ms
117ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b7e25db14511a1c5914fe2716168f54d702f6ccaa2809db43d649e4d991fc59f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 107887
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 02 Sep 2024 02:14:21 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 104ms
100ms Script
application/javascript 2607:f8b0:4006:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c6ad99058ceb0e0b0af1d4ea29ac0c075f395afcedf3c51131717c8240223f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95906
x-xss-protection: 0
last-modified: Mon, 02 Sep 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 02 Sep 2024 02:14:21 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 231ms
64ms Script
application/javascript 151.101.44.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.44.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2024 20:58:07 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200117-IAD, cache-nyc-kteb1890078-NYC

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 244ms
66ms Script
application/javascript 2600:141b:1c00:6::17df:d12e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d12e Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=10407
accept-ranges: bytes
content-length: 14628

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 218ms
63ms Script
text/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 02 Sep 2024 02:11:18 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 184
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Mon, 02 Sep 2024 04:11:18 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 219ms
65ms Script
text/javascript 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 00:13:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7250
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Sep 2025 00:13:32 GMT

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 136ms
61ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

3bb1199d12ae09deeda4466322b863de030594a83fb2166ca26d241b1a9020c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 02 Sep 2024 02:14:22 GMT
document-policy: force-load-at-top
x-fb-server-load: 25
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58936
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=59, rtx=0, c=23, mss=1232, tbw=4315, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: QmYg03iWMF7HjSL0J9AZA8+JrsTOgJX5VCBY39xYcuk8ajbttmpueX5WWVZEP/yYhV2bJfbIw5gRdpRfBRHxdQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 container_nbhoRDM8.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 245 KB
70 KB 305ms
152ms Script
application/javascript 2600:9000:24f0:f800:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f0:f800:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

f4f166786bcc7e3bf5c9e81f67543f21c360c01e444ed0b9ae2fbb6a627a8463

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 00:08:11 GMT
content-encoding: gzip
via: 1.1 c790ffcab27717f283a6e87f31c6d65a.cloudfront.net (CloudFront)
x-amz-version-id: PRAKo5X_9ioIOt7rHAkLKdgkeMnXL5At
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P3
age: 7572
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 01 Aug 2024 15:05:24 GMT
server: CloudFront
etag: W/"01925612e76ab7279832176ad15f8bb5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: xKTMOu6EU2FfD1ZD0QSQPY0TLgsKmmC6ak0Uv-6NndhdAl-NOf3zEQ==

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 202 KB
59 KB 218ms
65ms Script
application/javascript 2600:9000:24f0:f800:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f0:f800:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 00:01:14 GMT
x-amz-version-id: nUcBrzhVy9JMMaAtFkxpvW8b5Jy3nYQT
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 c790ffcab27717f283a6e87f31c6d65a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P3
age: 7989
x-cache: Hit from cloudfront
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 29 Apr 2024 00:09:25 GMT
server: CloudFront
etag: W/"5c359e1fa9398dc7248bc8740cc8eb49"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: bNckysX-q3D_2fAG1mQWNPcj5MCEa6zZgvFm021rTN2lQg_VPSoBBw==

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 2 KB
1 KB 164ms
85ms Script
application/javascript 2606:4700::6810:8cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/252628.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ccf3bf92848e8ce62f85cf1eb839c1622ea1b7e62a2978babd646c0d60aae2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 369288a3-8bab-49a0-8733-613d9f539625
cf-polished: origSize=2008
x-envoy-upstream-service-time: 6
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 369288a3-8bab-49a0-8733-613d9f539625
cf-bgj: minify
last-modified: Mon, 02 Sep 2024 02:14:13 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://therecord.media
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-58bbf9c46c-k66zx
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 8bc9fc738acba658-MIA
expires: Mon, 02 Sep 2024 02:15:52 GMT

GET cabe69bc-8707-4652-a4f2-4a31ede17c9f
https://www.recordedfuture.com/ Frame 0
0

GET
H3 200 nc-348510a436d66e8404c21e8f1b300371br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 9 KB
3 KB 36ms
35ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-348510a436d66e8404c21e8f1b300371br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ae513683c9455328b19b9f4cddc941f33d924719271c8ce6dede78e81ed9c199

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 10:08:00 GMT
content-encoding: br
cdn_cache_status: hit
age: 230781
x-guploader-uploadid: AHxI1nOip1qHduHCXDqFwjfvQ3GF365AMn1VlJ9b7ljQKlN7J7nYFmR6VMJCJlpAjtLcQCrYeAQkeGQ7Hg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3266
last-modified: Fri, 30 Aug 2024 09:33:58 GMT
server: UploadServer
etag: "6943680836c327c80e1e2069101dbfd1"
x-goog-hash: crc32c=hwunLg==, md5=aUNoCDbDJ8gOHiBpEB2/0Q==
x-goog-generation: 1725010438827766
content-language: en
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3266
accept-ranges: bytes

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 59ms
58ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=DF5836DC6821096EA6222ED25FD86953A&s=1725243261&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22en-us%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1725243261963%2C%22tO%22%3A10%2C%22tz%22%3A%22Pacific%2FHonolulu%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1725243261979&v=a9f839968

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:21 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv02c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 28 KB
8 KB 52ms
52ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=880669&settings_type=1&vn=&eventArch=1&uuid=
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gsc1 /
Resource Hash: 25d838e80b18ad4f587ccd7bf51332a22acba07f46bfd47b34f97a035c1f9f55

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:21 GMT
content-encoding: gzip
via: 1.1 google
server: gsc1
etag: W/"1725029651_EA"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/ 5 KB
2 KB 232ms
114ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/?random=1725243262131&cv=11&fst=1725243262131&bg=ffffff&guid=ON&async=1&gtm=45be48s0v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&hn=www.googleadservices.com&frm=0&tiba=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&npa=0&pscdl=noapi&auid=1569903394.1725243262&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

497f9cb295219943c1d41d5c7c2ae9c9106d37163601e436251c6615f7ed4e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2391
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1003136084
td.doubleclick.net/td/rul/ Frame 703B 0
0 264ms
80ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1003136084?random=1725243262131&cv=11&fst=1725243262131&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be48s0v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&hn=www.googleadservices.com&frm=0&tiba=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&npa=0&pscdl=noapi&auid=1569903394.1725243262&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 02 Sep 2024 02:14:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 225ms
77ms Fetch
text/plain 2001:4860:4802:38::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je48s0v873499763z8830966511za200zb830966511&_p=1725243261445&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=564467894.1725243262&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1725243262&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&dt=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1580
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
259 B 216ms
72ms Ping
text/plain 2607:f8b0:4004:c19::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=564467894.1725243262&gtm=45je48s0v873499763z8830966511za200zb830966511&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c19::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 43D5 0
0 152ms
79ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-MHTMF48BZH&gacid=564467894.1725243262&gtm=45je48s0v873499763z8830966511za200zb830966511&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1248841301

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 02 Sep 2024 02:14:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 194163687656043 Show response
connect.facebook.net/signals/config/ 74 KB
15 KB 249ms
237ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/194163687656043?v=2.9.166&r=stable&domain=www.recordedfuture.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

28c3f213120e74d90fb43248b4968b96ee2df73a27a6bde6e59e9273d7c1d312

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 02 Sep 2024 02:14:22 GMT
document-policy: force-load-at-top
x-fb-server-load: 31
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=74, mss=1232, tbw=66953, tp=63, tpl=0, uplat=174, ullat=0
pragma: public
x-fb-debug: rGw0BVWlwevWnwCVWCqqVnFiuacW+f8cEaT/lk2RtAGam0q+4xqnvnFIhOY64IYtSIq1ufZh89Q7VvlF6ocJwA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 80ms
75ms Image
image/gif 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1351224892&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&utmhid=838505114&utmr=-&utmp=%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&utmht=1725243262400&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.564467894.1725243262.1725243262.1725243262.1%3B%2B__utmz%3D93161374.1725243262.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2132601069&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
622 B 176ms
61ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=550a6d7f-423b-4f20-8eda-0aed8cbce175&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2a891f8c-a459-4c33-9bf0-f5a344fd39b2&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-response-time: 7
date: Mon, 02 Sep 2024 02:14:22 GMT
strict-transport-security: max-age=0
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif;charset=utf-8
x-transaction-id: e5225ec81dea62f8
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: b709793d8a54272053f0e66925486c2a0b29169a9b8f2ab4f82164a56534e315
cf-ray: 8bc9fc76fd53a4ec-MIA
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 219ms
55ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=550a6d7f-423b-4f20-8eda-0aed8cbce175&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=2a891f8c-a459-4c33-9bf0-f5a344fd39b2&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-response-time: 11
date: Mon, 02 Sep 2024 02:14:22 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: c2f18947498e4e56
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 5f6aaf09b8088005eb1deec39c3f38d12abcb78473f5be666a09e72c55b75eab
content-length: 43

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 68ms
67ms Script
application/javascript 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

e08bbd8d11326289feff5496edc2ee3d0d7e905fe69ad7612a63dcd6bc6e8313

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Aug 2024 18:33:23 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "66b26c73-10ff6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, proxy-revalidate, max-age=10800
accept-ranges: bytes
content-length: 18711
expires: Mon, 02 Sep 2024 05:14:22 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 83 KB
25 KB 206ms
56ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

059b77025c02623999e7524b737287072bd2dbb42c1652f70a4020338b1e5f21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
age: 249
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1426/bundles/project.js&cfRay=8ba6f563cea443f4-ATL
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"edf91c1320ba2916398ed791b63187bc"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1426/bundles/project.js
date: Mon, 02 Sep 2024 02:14:22 GMT
x-amz-version-id: 7DwgQA9YoOwDB6Raj9_RIwKNzf1Sd5R0
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 8a82c2c4-1a28-4e50-8eb8-a512a4641140
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-request-id: 8a82c2c4-1a28-4e50-8eb8-a512a4641140
last-modified: Wed, 28 Aug 2024 20:01:26 UTC
server: cloudflare
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8Xf3lN6Y%2FWTqKar%2BNqHHdI9RzUValYKfEazShHoDvaitJ5He8MzKcxt0FNniTdruxqL1DEM5eHmh2Jv9%2FSroMTClr5mRvZ36dSqIXjrwfmUiwNl3SGX5YMwWmHMp2owIF4L0GsnT6Rn8TFK"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-rnj86
cf-ray: 8bc9fc7738a1dad1-MIA
x-amz-cf-id: 2lS8_kDn_0dYBjvdvhjA4GO2wtMPfpXChqtZ8jESRum8n0PBgzo0RQ==

GET
H2 200 252628.js Show response
js.hs-banner.com/ 62 KB
19 KB 194ms
44ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
x-amz-version-id: GAPviEB0_qVTRwAgcciO.APQcIZeYu3z
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: PTY3CT489BE8D5B0
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ae4f3d5f-5610-42f6-a588-fbdebbfc0c9c
age: 249
x-envoy-upstream-service-time: 55
x-amz-id-2: v4amifKb+Bc0L/l9A7TzVrmTUltbwgLtkQ7cpSA7FhJLOHlq1AbvUR44nNBTc/OaeTcIiloPxjk=
x-evy-trace-listener: listener_https
x-request-id: ae4f3d5f-5610-42f6-a588-fbdebbfc0c9c
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 26 Jun 2024 15:57:47 GMT
server: cloudflare
etag: W/"c52f58bd4ec4f3ccbcb2164c8210fcc7"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-647fb
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8bc9fc774f081287-MIA
expires: Mon, 02 Sep 2024 02:14:09 GMT

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1725243000000/ 69 KB
25 KB 224ms
94ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1725243000000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59fc82d994a33a650be64d5d091a9c951c4e114046bea78c51f3d34771a60831

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: NWT4T2CFY5K4GBQA
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 475d6922-fde0-4fd7-be29-957a3466ebbd
x-envoy-upstream-service-time: 25
x-amz-id-2: 8tMPVCAzSBmnufaZ3a1APiedIH9NhbhcDaoTVjNYZez2k6U2UlVvSicz46G3mhRZ8Hvyq8mhvCM=
x-evy-trace-listener: listener_https
x-request-id: 475d6922-fde0-4fd7-be29-957a3466ebbd
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 23 Aug 2024 13:34:57 GMT
server: cloudflare
etag: W/"977b8413a12b20c958fcddacd7be9248"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-7qpxb
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8bc9fc772edd9aef-MIA
expires: Mon, 02 Sep 2024 02:16:00 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
92 KB 191ms
42ms Script
application/javascript 2606:4700::6812:8c11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8c11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03acc5c7069d79f53c0902c716cc6c6f1463d8ebb87724d39e5cb03f3f9d7890

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
age: 24779
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1436/bundle/main/lead-flows-release.js&cfRay=8b21f060e9532589-MIA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"b6c788efa3b3fd53687b2c92c85a5a5f"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1436/bundle/main/lead-flows-release.js
date: Mon, 02 Sep 2024 02:14:22 GMT
x-amz-version-id: TIDmoMti0Vib7LJNFwT63dnpWuuDUZfu
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 083bc8a9-6cbb-4832-a31c-b9d574a2317f
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-request-id: 083bc8a9-6cbb-4832-a31c-b9d574a2317f
last-modified: Tue, 23 Jul 2024 12:57:23 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-vn9j6
cf-ray: 8bc9fc773b8e288c-MIA
x-amz-cf-id: x94XOQLPs-bR1eoV8Lm4e2UgZRc9kgF8l3JcoCeje2AcXNVTru3tMA==

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
568 B 219ms
88ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 17D783F9F51E4EEABF21924FECB8A7AA Ref B: MIAEDGE1611 Ref C: 2024-09-02T02:14:22Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.recordedfuture.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYhGX/RxFmujuitpaV6vA==

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
764 B 169ms
90ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3869953%2C26800&time=1725243262507&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: gzip
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: CEDB77C8FCD64DFD9C0D847BE1298D49 Ref B: MIA301000101027 Ref C: 2024-09-02T02:14:22Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lva1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYhGX/RyGVVbqJ8RZFUMA==
x-fs-uuid: 000621197fd1c865556ea27c45915430

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharli...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharli...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1725243262507%26li_adsId%3D3f9923dc-6907-4e5c-bded-b7f...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharli...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharl...

0
486 B

454ms
113ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK0FkuiozXz8wAAAZGwgwfAtnpfWnngpGtUb162igaCRby3_QZEsalSHGZynZ8MLj3pbhg
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 7FB28A99251D42E5A076729C01184843 Ref B: MIAEDGE2006 Ref C: 2024-09-02T02:14:23Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYhGX/csV3mM5+hTtuEzQ==

Redirect headers

date: Mon, 02 Sep 2024 02:14:22 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 8AC7E987D06C42F08898FC133D879D42 Ref B: MIAEDGE1611 Ref C: 2024-09-02T02:14:22Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1725243262507&li_adsId=3f9923dc-6907-4e5c-bded-b7f05407c169&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQK0FkuiozXz8wAAAZGwgwfAtnpfWnngpGtUb162igaCRby3_QZEsalSHGZynZ8MLj3pbhg
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYhGX/WLghKRo3QVuUaaQ==

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
179 B 932ms
162ms Ping
text/plain 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2FGreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&idsite=1&rec=1&r=579132&h=16&m=14&s=22&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&_id=&_idn=1&send_image=0&_refts=0&pv_id=seIvLI&pf_net=83&pf_srv=138&pf_tfr=6&pf_dm1=42&pf_dm2=432&pf_onl=0&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.recordedfuture.com
date: Mon, 02 Sep 2024 02:14:23 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Proto,User-Agent

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
297 B 874ms
140ms Script
application/javascript 18.195.235.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=cmFLek&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.195.235.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-235-189.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

3a53765809560542a3cc92fc98de6778d60561b83bcf6e9604ea87980b4b87fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:23 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H3 200 /
www.google.com/pagead/1p-user-list/1003136084/ 42 B
64 B 264ms
89ms Image
image/gif 142.250.80.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1003136084/?random=1725243262131&cv=11&fst=1725242400000&bg=ffffff&guid=ON&async=1&gtm=45be48s0v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&hn=www.googleadservices.com&frm=0&tiba=GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware&npa=0&pscdl=noapi&auid=1569903394.1725243262&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfgLSfFsEGMWmwzMkeMTk8KIeyRjDAMQ&random=3898702956&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
705 B 263ms
77ms XHR
application/json 68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.26 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
an-x-request-uuid: 649a05a5-0017-428e-ab59-b2904f1dd5d5
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
198 B 105ms
83ms XHR
text/html 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-34-59-33.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
314 B 252ms
64ms XHR
text/html 2600:141b:1c00:2e::17d1:48c5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48c5 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:550:1d05:1::13
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1725243262688_399550033_750739412_12_554_60_100_219";dur=1
content-length: 19
expires: Mon, 02 Sep 2024 02:14:22 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 558ms
69ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&rl=&if=false&ts=1725243262672&sw=1600&sh=1200&v=2.9.166&r=stable&ec=0&o=4126&fbp=fb.1.1725243262658.357144991178463584&cs_est=true&ler=empty&cdl=API_unavailable&it=1725243262362&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=60, rtx=0, c=10, mss=1297, tbw=2799, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 02 Sep 2024 02:14:23 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 612ms
126ms Image
image/png 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&rl=&if=false&ts=1725243262672&sw=1600&sh=1200&v=2.9.166&r=stable&ec=0&o=4126&fbp=fb.1.1725243262658.357144991178463584&cs_est=true&ler=empty&cdl=API_unavailable&it=1725243262362&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Mon, 02 Sep 2024 02:14:23 GMT
document-policy: force-load-at-top
x-fb-server-load: 38
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7409863392493579846", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=60, rtx=0, c=10, mss=1297, tbw=3112, tp=-1, tpl=-1, uplat=52, ullat=0
pragma: no-cache
x-fb-debug: mYnBSPy3ypi1V5wBEBZ7+poa0Y5oV9UtmY9J57zJ17sKbItivB+Ppjmw24CAu9eftat9j9NSa4KVFatVtDlO5g==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7409863392493579846"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 95 B
1 KB 113ms
100ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e2e97cd7-e2ab-4163-bdf9-65fdcfdd46d9
content-encoding: br
x-envoy-upstream-service-time: 16
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e2e97cd7-e2ab-4163-bdf9-65fdcfdd46d9
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3zQUpk2y4Dr0y9CoWjl6O8GxsSjFK45je087Utu3gH1tYqw6oEgAFmjteSKZ9llNJ%2BJbq6F1VLNvQN3FAzWggcW03N0HjEHclvpbA%2BzDVMz%2Fm3OXwjXC%2BXzrLi7K6z6Xe9i2jbMmTQmYEgtiAPy%2B9cJpiAvfZ9b1%2FQ%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8bc9fc78398ddad1-MIA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-nhc9k

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
647 B 624ms
101ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=880384190&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&t=GreenCharlie+Infrastructure+Targeting+US+Political+Entities+with+Advanced+Phishing+and+Malware&cts=1725243262756&vi=37c0ec0c208db50759ca4ff6a9d9e0c9&nc=true&u=57501621.37c0ec0c208db50759ca4ff6a9d9e0c9.1725243262738.1725243262738.1725243262738.1&b=57501621.1.1725243262738&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 04c95bc4-fc33-4d43-8826-7bf87c9355c4
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 15
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 04c95bc4-fc33-4d43-8826-7bf87c9355c4
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iU%2BvhRkpfTjqhJznYc4KUR%2BJcK%2FPBVffbyzQk2t7D3Oyf8M0Lhb29hxj%2BNXqipvxx0OcT2fZhmxFtUSiqoAcD9X2%2FOWVdoNFgdpBWYEQPiNeQfCGUV5eMZ%2BAdxEREjiE8vptY4MMIT58waf7wvYZ"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-2mn4j
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8bc9fc7b9c0e7444-MIA
x-robots-tag: none

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 752 B
725 B 240ms
100ms XHR
application/json 52.204.192.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.192.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-192-231.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f81adda81400ac25299a4b08cae10843fb173dbeead94cf0fddb9e2c83f7cdce

Request headers

Referer: https://www.recordedfuture.com/
Authorization: Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
X-6s-CustomID: WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba

Response headers

x-trace-id: 1516752458455186713
date: Mon, 02 Sep 2024 02:14:23 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: us-east-1a
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 402

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 145ms
72ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:22 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 151ms
79ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:22 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 148ms
78ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A13%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:22 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:22 GMT

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
925 B 449ms
86ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: e5da6d24-a04b-475e-b806-2c1e5333d99b
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e5da6d24-a04b-475e-b806-2c1e5333d99b
last-modified: Mon, 02 Sep 2024 02:14:23 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-lmlwk
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8bc9fc7b48db31e4-MIA

POST
H3 200 t
dev.visualwebsiteoptimizer.com/events/ 0
36 B 83ms
58ms Ping
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=a9f839968&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-tar
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/greencharlie-infrastructure-linked-us-political-campaign-targeting
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv02c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 02 Sep 2024 02:14:22 GMT
content-encoding: gzip
via: 1.1 google
server: gnv02c
access-control-allow-methods: GET, POST
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-headers: X-Device-User-Agent, Vwo-X-Forwarded-For
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 163ms
134ms XHR
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=37c0ec0c208db50759ca4ff6a9d9e0c9&__hstc=57501621.37c0ec0c208db50759ca4ff6a9d9e0c9.1725243262738.1725243262738.1725243262738.1&__hssc=57501621.1.1725243262738&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab1c792e4806daccce502952deaf039f2c9e1f09291f7df352f7d58d28c6950f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8afdeb82-5e42-4887-8416-27ecb2da43ad
x-envoy-upstream-service-time: 37
content-length: 1083
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8afdeb82-5e42-4887-8416-27ecb2da43ad
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-r7j8d
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=38ou%2FMtE0bmgOutRckAmYXoiUMC6I%2B91Fugd4pCndwJUYJ4w20938kriHGSa7y9%2FNpT1uebWKC26%2BGKeevvl3xQBVc093bddxZBed%2FHsahoOvZNw0rglXx5pO2BrAK%2BNAuo%2BtNhs97RmGtttWWbb"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8bc9fc795b09dad1-MIA

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 571ms
62ms Preflight 52.204.192.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.192.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-192-231.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Mon, 02 Sep 2024 02:14:23 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: us-east-1a
x-trace-id: 5560686675080041765

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 233ms
99ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=880384190&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&t=GreenCharlie+Infrastructure+Targeting+US+Political+Entities+with+Advanced+Phishing+and+Malware&cts=1725243263148&vi=37c0ec0c208db50759ca4ff6a9d9e0c9&nc=true&u=57501621.37c0ec0c208db50759ca4ff6a9d9e0c9.1725243262738.1725243262738.1725243262738.1&b=57501621.1.1725243262738&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Mon, 02 Sep 2024 02:14:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a111add3-cd6e-4777-b4f1-59c01e52c035
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 11
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a111add3-cd6e-4777-b4f1-59c01e52c035
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bzztt3ZghYywHarjdsPQLza9gZc6z%2BeWB8gqwlHfcBVoa0TCc7LJ0mhFuVv0eoRh87lS4hb5QNEzRL3ruw8cm7WLiROXqt%2Bp1L71wPifK0vvkyJRNNTLtP8j29SWURzzyC6Hg4jLwgtAvqCYuO56"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-4v7zb
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8bc9fc7b9c127444-MIA
x-robots-tag: none

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 109ms
77ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A22%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:23 GMT

GET
H3 200 iphone-cd1.jpg
go.recordedfuture.com/hubfs/ 83 KB
85 KB 199ms
75ms Image
image/webp 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.recordedfuture.com/hubfs/iphone-cd1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-99167145604,P-252628,FLS-ALL
age: 530559
x-amz-request-id: 80QMY306WHYJH1BY
x-amz-server-side-encryption: AES256
edge-cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="iphone-cd1.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
etag: "f5c3d1b581a50e5c3637310137a43f0e"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1674144065940
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Mon, 02 Sep 2024 02:14:24 GMT
strict-transport-security: max-age=31536000
via: 1.1 ab5bcbd8c5b6d1e18d99563cef1a3042.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx
x-amz-cf-pop: MIA3-P2
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=229013
x-cache: RefreshHit from cloudfront
cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 85082
x-amz-id-2: QIsyvuX0TCi98VMDhmx7h8TB0/+sqY7TCnKOXcOQXmAJpnbdisWizpBssSFQrKvxW+SDM6xV8Hw=
last-modified: Thu, 19 Jan 2023 16:01:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8plq7LTXMa%2By0mCwAAFZxkCtOqlqOkAy4AaHD7Wmi5tDvMuUCmkFiadyxibYu8gLcUN%2FlaLSGpL4134TesNPwHlbHw222tc7lqiNMc96m4UQagXZ02%2BXRT8FfQSRXvJyErAdV570TA%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8bc9fc81cb7874a0-MIA
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: jvtp-cHvYqB0yemcnwOLrbRhYYeN9Xar1Obud3f0wwMldgeP46V2cQ==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 75ms
74ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:24 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:24 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 77ms
76ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A23%20GMT%22%2C%22timeSpent%22%3A%221022%22%2C%22totalTimeSpent%22%3A%222028%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:24 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 74ms
74ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A24%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223028%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:25 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:25 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 76ms
68ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224029%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:26 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 77ms
77ms Image
image/gif 23.34.59.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=54479189-6b10-45f2-823e-b87da85e59b1&session=6e2b0a47-ffe2-470d-8b45-434baf3c4096&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2002%20Sep%202024%2002%3A14%3A26%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225029%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20GreenCharlie%E2%80%99s%20expanding%20cyber%20threat%20against%20US%20political%20and%20government%20entities.%20Learn%20how%20this%20Iran-nexus%20group%20uses%20advanced%20phishing%20techniques%20and%20malware%20like%20GORBLE%20and%20POWERSTAR.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GreenCharlie%20Infrastructure%20Targeting%20US%20Political%20Entities%20with%20Advanced%20Phishing%20and%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fgreencharlie-infrastructure-linked-us-political-campaign-targeting&pageViewId=dae8a154-50f2-44ff-8e3d-3b6bef26e077&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.23

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.34.59.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-34-59-33.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 02 Sep 2024 02:14:27 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 02 Sep 2024 02:14:27 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.recordedfuture.com
URL: blob:https://www.recordedfuture.com/cabe69bc-8707-4652-a4f2-4a31ede17c9f

Verdicts & Comments Add Verdict or Comment

132 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

47 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.recordedfuture.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ji9CBK9bdqm5UlsGX9IE_vn1w3VZZMxjQA4wXGvc_po-1725243260889-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 08:01:05	Name: _vwo_uuid_v2 Value: DF5836DC6821096EA6222ED25FD86953A\|deb99d6ccf2d0264fb3cb9ccac1a42eb
.recordedfuture.com/	1970-01-21 01:23:39	Name: _gcl_au Value: 1.1.1569903394.1725243262
.recordedfuture.com/	1970-01-21 08:00:00	Name: _vwo_uuid Value: DF5836DC6821096EA6222ED25FD86953A
.recordedfuture.com/	1970-01-21 01:23:39	Name: _vwo_ds Value: 3%241725243261%3A57.86118345%3A%3A
.recordedfuture.com/	1970-01-20 23:14:05	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.recordedfuture.com/	1970-01-21 01:38:03	Name: _vis_opt_s Value: 1%7C
.recordedfuture.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.recordedfuture.com/	1970-01-21 08:50:03	Name: _ga Value: GA1.1.564467894.1725243262
.recordedfuture.com/	1970-01-21 08:50:03	Name: __utma Value: 93161374.564467894.1725243262.1725243262.1725243262.1
.recordedfuture.com/	1969-12-31 23:59:59	Name: __utmc Value: 93161374
.recordedfuture.com/	1970-01-21 03:36:51	Name: __utmz Value: 93161374.1725243262.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.doubleclick.net/	1970-01-20 23:14:04	Name: test_cookie Value: CheckForPermission
.recordedfuture.com/	1970-01-20 23:14:03	Name: __utmt_sfga Value: 1
.recordedfuture.com/	1970-01-20 23:14:05	Name: __utmb Value: 93161374.1.10.1725243262
.t.co/	1970-01-21 08:50:03	Name: muc_ads Value: cb09da24-7d71-4d55-8ade-8dc423628a9b
.t.co/	1970-01-20 23:14:05	Name: __cf_bm Value: oDGCrC5zA3GtMAFm_AcHtme0LbSScjdONOkbozfJ2ho-1725243262-1.0.1.1-CJXQi3DYo0XRCmmEyIQ2JsUrZb9uUzSigrHLBQ9OYF3B_djVgGEEyOLje0ZBlx8xZIQlHy9skERgAPmOrYu4NQ
.twitter.com/	1970-01-21 08:50:03	Name: personalization_id Value: "v1_DCUE3JOzK+CJd/VNXSHh3w=="
.recordedfuture.com/	1970-01-21 01:23:39	Name: _fbp Value: fb.1.1725243262658.357144991178463584
.linkedin.com/	1970-01-21 01:23:39	Name: li_sugr Value: 2c91969d-5415-47ff-965f-d93523a43624
.linkedin.com/	1970-01-21 07:59:39	Name: bcookie Value: "v=2&2e2121f7-6988-4b1c-89db-9c2e39f1908f"
.linkedin.com/	1970-01-20 23:15:29	Name: lidc Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3413:u=1:x=1:i=1725243262:t=1725329662:v=2:sig=AQHc8UNjEUAMI-F9EbOc0Cjm0UjmBnbu"
.recordedfuture.com/	1970-01-21 03:33:15	Name: __hstc Value: 57501621.37c0ec0c208db50759ca4ff6a9d9e0c9.1725243262738.1725243262738.1725243262738.1
.recordedfuture.com/	1970-01-21 03:33:15	Name: hubspotutk Value: 37c0ec0c208db50759ca4ff6a9d9e0c9
.recordedfuture.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.recordedfuture.com/	1970-01-20 23:14:05	Name: __hssc Value: 57501621.1.1725243262738
.linkedin.com/	1970-01-20 23:57:15	Name: UserMatchHistory Value: AQL9gUc6dbSpYAAAAZGwgwcEHZOqFll4MEKlqpXPhtKLgqhzvcRpH7O61K4OarHtxpF9P-RFY2rPMg
.linkedin.com/	1970-01-20 23:57:15	Name: AnalyticsSyncHistory Value: AQJf810rD6zHrAAAAZGwgwcE-YkwiVUmFlTASy4nnBz0qGrmFo6ElY6wytT7-w0I6L991VF1-j0mjMq49eeN5g
.adnxs.com/	1970-01-21 08:50:03	Name: receive-cookie-deprecation Value: 1
www.recordedfuture.com/	1970-01-21 08:50:03	Name: _gd_visitor Value: 54479189-6b10-45f2-823e-b87da85e59b1
www.recordedfuture.com/	1970-01-20 23:14:17	Name: _gd_session Value: 6e2b0a47-ffe2-470d-8b45-434baf3c4096
www.recordedfuture.com/	1970-01-20 23:24:08	Name: _an_uid Value: 0
.www.linkedin.com/	1970-01-21 07:59:39	Name: bscookie Value: "v=1&2024090202142283825cb2-6c68-44b4-827c-2fcf23acd2f7AQE_dYughfcqwt351PfN7dbXKFJWJpoX"
.hsforms.com/	1970-01-20 23:14:05	Name: __cf_bm Value: DD1mmslYS1Awz6P4CjQHY8t3cAJu7Xl53_RLNSePF6Q-1725243263-1.0.1.1-Ho1bZ96zVHdgHeJWz6GpfdMFHvEfQrRDgRFIkQk0gjStUce6R6CHsUHtC2vMnjLc4NkViVqgZ8d0RI0J.pqCfQ
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 1roqrL9oZpXZT8.SAhuevir550jchinIOeox9_IYKvo-1725243263300-0.0.1.1-604800000
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: aCczVrYoVO44eNK2iUS.XnHotUGG_BSIIgzq4mwrulk-1725243263371-0.0.1.1-604800000
.hubspot.com/	1970-01-20 23:14:05	Name: __cf_bm Value: TfJpt.Z14GQQ60TWKbej0Por4JSCBsQn.IZPFxt7kEE-1725243263-1.0.1.1-rIWP6WxnMjMCuIvyHlonF2OeSumV4DoxTjp79WLkcUttIWjWKoL4ZWnUNoLkF0yy.LlGkXnC4DGnljY6PjCBIQ
.recordedfuture.com/	1970-01-21 08:50:03	Name: _ga_MHTMF48BZH Value: GS1.1.1725243262.1.0.1725243263.59.0.0
.go.recordedfuture.com/	1970-01-20 23:14:05	Name: __cf_bm Value: AphBJzw7rFAMSdI8jXracIt.nAi7eVO7fxJyGTAjGoE-1725243264-1.0.1.1-5GJkUx8dFnDhd83yV_pNm_iBqec5kSzC_9iAo2hU6ErYXXxE46JanQ14c1wRINnTMpEXBwRQVrdCSExnZno0Ig
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: __cfruid Value: a754e4283c716496d9bf7e4b75e67994e5522574-1725243264
.recordedfuture.com/	1970-01-20 23:15:29	Name: source Value: (direct)
.recordedfuture.com/	1970-01-20 23:15:29	Name: medium Value: (none)
.recordedfuture.com/	1970-01-20 23:15:29	Name: content Value: undefined
.recordedfuture.com/	1970-01-20 23:15:29	Name: keyword Value: undefined
.recordedfuture.com/	1970-01-20 23:15:29	Name: campaign Value:
.recordedfuture.com/	1970-01-20 23:15:29	Name: landing_page Value: /research/greencharlie-infrastructure-linked-us-political-campaign-targeting
.recordedfuture.com/	1970-01-20 23:15:29	Name: conversion_page Value: /research/greencharlie-infrastructure-linked-us-political-campaign-targeting

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
analytics.google.com
analytics.twitter.com
b.6sc.co
c.6sc.co
cdn.matomo.cloud
cms.recordedfuture.com
connect.facebook.net
cta-service-cms2.hubspot.com
dev.visualwebsiteoptimizer.com
epsilon.6sense.com
forms.hubspot.com
go.recordedfuture.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
recordedfuture.matomo.cloud
secure.adnxs.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
td.doubleclick.net
track.hubspot.com
www.facebook.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.recordedfuture.com
www.recordedfuture.com
104.18.35.90
104.19.175.188
104.244.42.131
13.107.42.14
142.250.176.194
142.250.80.100
151.101.130.216
151.101.44.157
157.240.241.1
162.159.140.229
18.195.235.189
199.60.103.254
2001:4860:4802:38::181
23.34.59.33
2600:141b:1c00:2e::17d1:48c5
2600:141b:1c00:6::17df:d12e
2600:9000:24f0:f800:c:7d55:b3c0:93a1
2606:4700:4400::ac40:9310
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:8cd1
2606:4700::6811:afc9
2606:4700::6812:8c11
2607:f8b0:4004:c19::9a
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80b::200a
2607:f8b0:4006:81d::2008
2607:f8b0:4006:81e::2002
2620:1ec:21::14
2a03:2880:f112:182:face:b00c:0:25de
34.96.102.137
52.204.192.231
68.67.160.26
03acc5c7069d79f53c0902c716cc6c6f1463d8ebb87724d39e5cb03f3f9d7890
059b77025c02623999e7524b737287072bd2dbb42c1652f70a4020338b1e5f21
07544311928b1e97a977a48c1db7be0970251060f497dcc0508a97a7b4971a33
0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd
0ed6198695780d469e7ee9d8ea338fdc2990416e063faaa6a305a3d5a10116b8
1083d5cb2cd087192da0c3af0c597782f089c76c4a49c578dc1426d90e8afd76
1197435f564de6a2e0db3302fc8a9cee513cff938d0d038558c8822d4d7ddd2d
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
18582a05e5e720a673b3267694b093418b8cee8f58dfcda483d2ca3f6ceee41c
1b7ab22cdfb33b1ca4a7b1042cd5c8b12cabc5df338d2c75c37a8b48a737a6ff
1b7f033e2c33bed91168debd669ea61819410bf35c24f1fc3a400c31846d79ec
1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183
1d441d3291c595de79459b33a46d24844b8b6d9a8a9cdb17e86d3a462c35df9e
25d838e80b18ad4f587ccd7bf51332a22acba07f46bfd47b34f97a035c1f9f55
26b81e3ff0f39f5a95ac58cfe64ac9fe061c8d0861c5838d3eba4b8483fbf8ac
28c3f213120e74d90fb43248b4968b96ee2df73a27a6bde6e59e9273d7c1d312
2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3a53765809560542a3cc92fc98de6778d60561b83bcf6e9604ea87980b4b87fe
3a5ea319fe4ca5ea7352c79efc625a6e5fa46249dce974f0b38af2940093949c
3bb1199d12ae09deeda4466322b863de030594a83fb2166ca26d241b1a9020c1
3c6ad99058ceb0e0b0af1d4ea29ac0c075f395afcedf3c51131717c8240223f9
3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa
43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44ca4c7eb7fddde144084e11308efa8ce3df7843573eed6d8fbca4ba69d13b97
4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5
494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a
497f9cb295219943c1d41d5c7c2ae9c9106d37163601e436251c6615f7ed4e3b
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
58ee400996fa0967ffc3946f23e996f346bde398ba335301e65c0e46d78dfdc9
59fc82d994a33a650be64d5d091a9c951c4e114046bea78c51f3d34771a60831
5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636
5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef
5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082
712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f
735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b
7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa
91203e702b388668ba42c7929309e90d45cf23900e4c9c37e8da706dcd1550ff
979642bc5566e55fbfe157d0185f9119b95ce9d337de8e2fa97a0e4cceab3e31
99acc5b53fc08d35f064f4a74cad6489a12cd70afa4ad2fffe30e32bba220c42
9ccf3bf92848e8ce62f85cf1eb839c1622ea1b7e62a2978babd646c0d60aae2e
a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3
a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070
a190915c7136ee4ac2b8cce089536de318006b64acaf30a1b184febd6c062e9a
a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab1c792e4806daccce502952deaf039f2c9e1f09291f7df352f7d58d28c6950f
ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae513683c9455328b19b9f4cddc941f33d924719271c8ce6dede78e81ed9c199
b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca
b7e25db14511a1c5914fe2716168f54d702f6ccaa2809db43d649e4d991fc59f
c1272d6b62fc1069af0b1d1dc0b5c323aeb0c1aa078cffa61b534fc18a9ff898
c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4
d334dab41287f78e4750c6e7ae5c8085221cdf45167c21da861f8e30820c07b1
d3ae531b79acc9fdb0eee344e05151eae8be020b4ba91e8359c0e471710e6667
d8c2ac941f180b36b5c6d0cba0fd71450d9a00e779bfa6b99301bd997459c299
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd0aa2edbf70120a3664d67d62c7be974905b21305d74bf06b58d4570bb81dc7
dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2
e08bbd8d11326289feff5496edc2ee3d0d7e905fe69ad7612a63dcd6bc6e8313
e1b769d1357e0cbb42c673ab492f51db227a23e60a1a8f081c6d98be1c1c407a
e1cb555d7f97ce00f5861b8cc67c0561e36c4ae5969946fca3db1d8a17c44690
e2b593a8d043c631057e4f3efaafdd25a9ebea88f443c4f61a5a57164bace124
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e95b67ce429fea646454c33abc0f671720965f678255dad0b0f42e18387af44f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8
f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225
f3d470569293bee05ad1f3b3d492b859bad0b739bd4bf43c02957deda2a06b59
f4f166786bcc7e3bf5c9e81f67543f21c360c01e444ed0b9ae2fbb6a627a8463
f529c30b1ce9594797f1290c51550edd0e9036b054b675847e7a0bd372abe701
f75150f7b3145ccae00023a5525a8853c45255763ff69aac22b5363297812844
f81adda81400ac25299a4b08cae10843fb173dbeead94cf0fddb9e2c83f7cdce
f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.recordedfuture.com Open in urlscan Pro 104.18.35.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

107 Requests

98 %HTTPS

52 %IPv6

24 Domains

38 Subdomains

34 IPs

3 Countries

2341 kBTransfer

7111 kBSize

47 Cookies

9 Outgoing links

Redirected requests

107 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.recordedfuture.com Open in urlscan Pro
104.18.35.90 Public Scan

Screenshot
Live screenshot

Full Image

107
Requests

98 %
HTTPS

52 %
IPv6

24
Domains

38
Subdomains

34
IPs

3
Countries

2341 kB
Transfer

7111 kB
Size

47
Cookies

107 HTTP transactions
0 data transactions