www.gdatasoftware.com Open in urlscan Pro
212.23.151.164 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
Submission: On March 18 via api (March 18th 2024, 2:12:52 am UTC) from TR — Scanned from DE

Summary HTTP 27 Redirects Links 29 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 27 HTTP transactions. The main IP is 212.23.151.164, located in Hattingen, Germany and belongs to TMR, DE. The main domain is www.gdatasoftware.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 23rd 2023. Valid for: a year.

This is the only time www.gdatasoftware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
27	212.23.151.164 212.23.151.164		12329 (TMR) (TMR)
27	1

27 212.23.151.164 (Hattingen, Germany)

ASN12329 (TMR, DE)

www.gdatasoftware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	gdatasoftware.com www.gdatasoftware.com	1 MB
27	1

	Domain	Requested by
27	www.gdatasoftware.com	www.gdatasoftware.com
27	1

This site contains links to these domains. Also see Links.

Domain
www.gdata.de
feeds.feedblitz.com
arstechnica.com
learn.microsoft.com
hex-rays.com
www.angusj.com
github.com
ntcore.com
jrsoftware.org
ecma-international.org
en.wikipedia.org
research.openanalysis.net
any.run
twitter.com
www.xing.com
www.linkedin.com
www.facebook.com
reddit.com
de.linkedin.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
*.gdatasoftware.com Sectigo RSA Organization Validation Secure Server CA	`2023-07-23` - `2024-08-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
Frame ID: 2A626D4E3357007538FB49AF29B4F319
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RisePro stealer targets Github users in “gitgub” campaign

Detected technologies

TYPO3 CMS (CMS) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+ href="/?typo3(?:conf|temp)/

Page Statistics

27
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1335 kB
Transfer

1771 kB
Size

1
Cookies

29 Outgoing links

These are links going to different origins than the main page.

URL: https://www.gdata.de/blog

Search URL Search Domain Scan URL

URL: https://feeds.feedblitz.com/GDataSecurityBlog-EN&x=1

Search URL Search Domain Scan URL

URL: https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-malicious-repositories-in-ongoing-attack/
Title: story about malicious Github repositories

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/msi/orca-exe
Title: Orca.exe

Search URL Search Domain Scan URL

URL: https://hex-rays.com/ida-pro/
Title: IDA

Search URL Search Domain Scan URL

URL: https://www.angusj.com/resourcehacker/
Title: ResourceHacker

Search URL Search Domain Scan URL

URL: https://github.com/struppigel/PortexAnalyzerGUI
Title: PortexAnalyzer

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/menurc/rcdata-resource
Title: RC_DATA

Search URL Search Domain Scan URL

URL: https://ntcore.com/?page_id=388
Title: CFF Explorer

Search URL Search Domain Scan URL

URL: https://github.com/horsicq/Detect-It-Easy
Title: Detect-it-Easy

Search URL Search Domain Scan URL

URL: https://jrsoftware.org/isinfo.php
Title: InnoSetup

Search URL Search Domain Scan URL

URL: https://ecma-international.org/publications-and-standards/standards/ecma-335/
Title: Common Language Infrastructure (CLI) specification

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_function
Title: Fowler–Noll–Vo hash 1A

Search URL Search Domain Scan URL

URL: https://research.openanalysis.net/risepro/stealer/config/triage/2023/06/15/risepro.html
Title: RisePro report by OALabs

Search URL Search Domain Scan URL

URL: https://github.com/JustasMasiulis/xorstr
Title: xorstr library

Search URL Search Domain Scan URL

URL: https://github.com/binref/refinery
Title: Binary Refinery

Search URL Search Domain Scan URL

URL: https://any.run/cybersecurity-blog/risepro-malware-communication-analysis/
Title: discovered in November 2023

Search URL Search Domain Scan URL

URL: https://github.com/anyrun/blog-scripts/blob/main/Scripts/RisePro/risepro_tcp_decoder.py
Title: Python script

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=RisePro%20stealer%20targets%20Github%20users%20in%20%E2%80%9Cgitgub%E2%80%9D%20campaign&url=https%3A%2F%2Fwww.gdatasoftware.com%2Fblog%2F2024%2F03%2F37885-risepro-stealer-campaign-github&via=GDATA

Search URL Search Domain Scan URL

URL: https://www.xing.com/spi/shares/new?url=https%3A%2F%2Fwww.gdatasoftware.com%2Fblog%2F2024%2F03%2F37885-risepro-stealer-campaign-github

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&summary=&title=RisePro%20stealer%20targets%20Github%20users%20in%20%E2%80%9Cgitgub%E2%80%9D%20campaign&url=https%3A%2F%2Fwww.gdatasoftware.com%2Fblog%2F2024%2F03%2F37885-risepro-stealer-campaign-github

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.gdatasoftware.com%2Fblog%2F2024%2F03%2F37885-risepro-stealer-campaign-github

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https%3A%2F%2Fwww.gdatasoftware.com%2Fblog%2F2024%2F03%2F37885-risepro-stealer-campaign-github&title=RisePro%20stealer%20targets%20Github%20users%20in%20%E2%80%9Cgitgub%E2%80%9D%20campaign

Search URL Search Domain Scan URL

URL: https://de.linkedin.com/company/g-data-cyberdefense

Search URL Search Domain Scan URL

URL: https://www.facebook.com/gdatasoftwareag

Search URL Search Domain Scan URL

URL: https://twitter.com/GDATA

Search URL Search Domain Scan URL

URL: https://www.instagram.com/gdatacyberdefense

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/GDataSoftwareAG

Search URL Search Domain Scan URL

URL: https://www.gdata.de/help/en/business/HowToArtikel/Virenanalyse/DateiURLAppEinsenden/
Title: Submit a suspicious file, app or URL

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 37885-risepro-stealer-campaign-github Show response
www.gdatasoftware.com/blog/2024/03/ 50 KB
15 KB 53ms
11ms Document
text/html 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

e0eb2d334ba82b20857309a58f3d7891b960f328346b549892066f1772a6ae88

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age: 43200
content-encoding: gzip
content-language: en
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
content-type: text/html; charset=utf-8
date: Mon, 18 Mar 2024 02:12:47 GMT
etag: W/"2f67a2670137afb0127bcd44bf865cef"
expires: Tue, 26 Mar 2024 23:00:00 GMT
pragma: public
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 basic-styles.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/ 133 KB
26 KB 23ms
23ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/basic-styles.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

7ffcdc0c49b5256a7c3792e350854d49994434073a92f766f5fb2c454e8b23c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-2153f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 gcon.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ 14 KB
4 KB 18ms
17ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/gcon.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

de29fa42fdcdbc32e060d8e033322b3d0151f70e82dd08e8c9c9996e6c343dcb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-3806"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 source-sans-pro.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ 1 KB
1 KB 24ms
23ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

12bbeb4a5c75cfa4f290f8da4a9282a835f6704b94917c5bc05d4430aa9b31dd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-51f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 prism.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/ 4 KB
2 KB 22ms
22ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/prism.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

77f9291def17b8ae239f0f5181ad69a3923dbcc7835ba7aaa4cb1d1cb2142211

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-f70"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 menu-2019.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/elements/ 19 KB
5 KB 19ms
19ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/elements/menu-2019.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

3e17d9ffedd7459d58e6c669de912c510574ec762c6c64fa599ed7e660cad7ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-4ae8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 blogpage.css
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/ 15 KB
4 KB 16ms
16ms Stylesheet
text/css 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/assets/blogpage.css?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

e269f4a039beda664bcd9294fe3f36f6ebfdf31dc2c02bee383f47ae67003af8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-3c29"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 logo-for-dark.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/ 3 KB
3 KB 22ms
21ms Image
image/svg+xml 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/logo-for-dark.svg

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

5bd5ebcf03a341e616a7b8361cf09a193e9e4b96fda68c679a6c53a07f5c31bb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-d6f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=3628800
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 DE.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/Flags/ 966 B
2 KB 20ms
20ms Image
image/svg+xml 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/Flags/DE.svg

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

19d66a51d12c87c2c254f61d3dc66f4765bc852b03138e4b38ed5fbc3dd01d19

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-3c6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=3628800
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 G_DATA_Blog_ATesla_Preview_e6638b4e69.jpg
www.gdatasoftware.com/fileadmin/_processed_/b/b/ 4 KB
5 KB 30ms
30ms Image
image/jpeg 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/_processed_/b/b/G_DATA_Blog_ATesla_Preview_e6638b4e69.jpg

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

8b15da1e0bd1935eecff6905899564697c3c434c330d4dd410c9a6270c8b95f8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 14:47:55 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f1bc9b-10ab"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 4267
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 G_DATA_Blog_Ginzo_Preview_c164c82f8d.jpg
www.gdatasoftware.com/fileadmin/_processed_/5/3/ 4 KB
5 KB 31ms
31ms Image
image/jpeg 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/_processed_/5/3/G_DATA_Blog_Ginzo_Preview_c164c82f8d.jpg

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

36cf96f7c1ea5983f2bf4484375ce22e96f5fb05bddf9d0f9ac951dc9fe94ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 14:47:55 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f1bc9b-ffa"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 4090
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 merged-21dd7b0ec8a5750e5ca57449614f4b50.js Show response
www.gdatasoftware.com/typo3temp/assets/compressed/ 394 KB
125 KB 27ms
27ms Script
application/javascript 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3temp/assets/compressed/merged-21dd7b0ec8a5750e5ca57449614f4b50.js?1709530884

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

0558df07062ae8f70ff4a2d28780b4996d6731c4d8cfaf770c6d5f70daba60a7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Mon, 04 Mar 2024 05:41:24 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e55f04-6296c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 gd-mainmenu-2019.js Show response
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/JavaScript/ 5 KB
2 KB 20ms
20ms Script
application/javascript 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/JavaScript/gd-mainmenu-2019.js?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

7a7abe196a5d8d760adbec74b6dcf7af2f35c91a06b4e033928ee5c03dfb7e9b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-128e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 gd-guidebook.js Show response
www.gdatasoftware.com/typo3conf/ext/gd_pagenews/Resources/Public/JavaScript/ 2 KB
2 KB 32ms
32ms Script
application/javascript 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gdatasoftware.com/typo3conf/ext/gd_pagenews/Resources/Public/JavaScript/gd-guidebook.js?1709460002

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

eaee182f99fdf2d211c29221098ce1d2a326f78ee7126ce481d0c139e91b0d01

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
etag: W/"65e44a22-955"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=43200
x-xss-protection: 0
expires: Mon, 18 Mar 2024 14:12:47 GMT

GET
H2 200 G_DATA_Blog_Gitgub_Header.jpg
www.gdatasoftware.com/fileadmin/web/general/images/blog/2024/03/ 508 KB
510 KB 21ms
21ms Image
image/jpeg 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/web/general/images/blog/2024/03/G_DATA_Blog_Gitgub_Header.jpg

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

e23b4c5ab16f3b4ab4e956c43e3ff4b1af89f2a458c2a5c4544fb856f235b364

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:28 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b68-7f1d1"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 520657
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 source-sans-pro-v13-latin-ext_latin-regular.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ 25 KB
25 KB 19ms
19ms Font
application/octet-stream 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/source-sans-pro-v13-latin-ext_latin-regular.woff2
Requested by: Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),
Reverse DNS
Software: nginx /
Resource Hash: 72e086ecb5eed26e489b633ce3a7a85522747d8583852bf8756e290fec0f3d3b

Request headers

Referer: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Origin: https://www.gdatasoftware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
etag: "65e44a22-6438"
content-type: application/octet-stream
access-control-allow-origin: https://www.gdatasoftware.com
accept-ranges: bytes
content-length: 25656

GET
H2 200 gcon1-991.ttf
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ 116 KB
117 KB 19ms
19ms Font
application/octet-stream 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/gcon1-991.ttf?w2aerhgm
Requested by: Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/gcon.css?1709460002
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),
Reverse DNS
Software: nginx /
Resource Hash: 5e5d46c22d87bff9d49018172f5764cb39ebcd228577ad17229a7dc67ee65198

Request headers

Referer: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/gcon.css?1709460002
Origin: https://www.gdatasoftware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
etag: "65e44a22-1d0f4"
content-type: application/octet-stream
access-control-allow-origin: https://www.gdatasoftware.com
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 119028
expires: Tue, 18 Mar 2025 02:12:47 GMT

GET
H2 200 source-sans-pro-v13-latin-ext_latin-300.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ 25 KB
25 KB 20ms
20ms Font
application/octet-stream 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/source-sans-pro-v13-latin-ext_latin-300.woff2
Requested by: Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),
Reverse DNS
Software: nginx /
Resource Hash: 9d20a8fc1de189bad815a78bd3a36550412788bc1d8e6f2d7eba6bb18bc901a2

Request headers

Referer: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Origin: https://www.gdatasoftware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
etag: "65e44a22-6474"
content-type: application/octet-stream
access-control-allow-origin: https://www.gdatasoftware.com
accept-ranges: bytes
content-length: 25716

GET
H2 200 source-sans-pro-v13-latin-ext_latin-600.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/ 25 KB
25 KB 19ms
19ms Font
application/octet-stream 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro/source-sans-pro-v13-latin-ext_latin-600.woff2
Requested by: Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),
Reverse DNS
Software: nginx /
Resource Hash: 5b7ade4116e14b315421eb6e4eeabbf1a1c7301a575ee1311fb1659eaaecd6f4

Request headers

Referer: https://www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/source-sans-pro.css?1709460002
Origin: https://www.gdatasoftware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
last-modified: Sun, 03 Mar 2024 10:00:02 GMT
server: nginx
etag: "65e44a22-63b0"
content-type: application/octet-stream
access-control-allow-origin: https://www.gdatasoftware.com
accept-ranges: bytes
content-length: 25520

GET
H2 200 GDATA_RisePro_fabfilter_crack_6c3201cb81.png
www.gdatasoftware.com/fileadmin/_processed_/f/7/ 100 KB
101 KB 21ms
20ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/_processed_/f/7/GDATA_RisePro_fabfilter_crack_6c3201cb81.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

2b6d2a4d02ca3679ab025879962d0f8738c25858693c1e76d780a1978b880ee3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:02:55 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16bbf-18f5a"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 102234
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_vuescan_crack_4ff8cfbbda.png
www.gdatasoftware.com/fileadmin/_processed_/4/6/ 89 KB
91 KB 33ms
32ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/_processed_/4/6/GDATA_RisePro_vuescan_crack_4ff8cfbbda.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

6a6862da716a66741766c94c7aec632a1f772f8c5e0860843ccc2e7a0afa58e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:02:55 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16bbf-16581"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 91521
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_Orca.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 27 KB
28 KB 19ms
18ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_Orca.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

322b88ecc485486c626af1961147450474c1c97048ae43547d0fe5333e9cc168

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:12 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b58-6b1a"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 27418
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_bloated.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 97 KB
99 KB 20ms
19ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_bloated.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

cb5faac10f736b11b94aeb79c7a9f4fb99f3b2a1b0ac08e5ca5a49d7e478dab5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:13 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b59-185c7"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 99783
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_NET_streamstable.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 25 KB
26 KB 19ms
19ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_NET_streamstable.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

63afc17a9a03684722e95291d72b5217f00a295a54d34a7b66cc4419654c986a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:14 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b5a-651d"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 25885
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_ModuleRef_table.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 26 KB
27 KB 20ms
20ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_ModuleRef_table.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

d42cfade3d58d658e7e38a98572a735d4d8548d0b458dde7a7e7b8f6fd00d85d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:15 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b5b-6973"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 26995
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_FNVhashing.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 31 KB
32 KB 29ms
28ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_FNVhashing.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

0972357d7e0cfbae238187b6a2d759701c22cbf5f1eb62ec3b7b61b20b6e6067

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:16 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b5c-7ca4"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 31908
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

GET
H2 200 GDATA_RisePro_decryptstackstring.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/ 25 KB
26 KB 19ms
18ms Image
image/png 212.23.151.164
TMR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2024/03/GDATA_RisePro_decryptstackstring.png

Requested by

Host: www.gdatasoftware.com
URL: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

212.23.151.164 Hattingen, Germany, ASN12329 (TMR, DE),

Reverse DNS

Software

nginx /

Resource Hash

19ed0d35c2ed6fe85f30a033671fbd915df862517a7f233ca953f91b4288a67e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gdatasoftware.com/blog/2024/03/37885-risepro-stealer-campaign-github
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 02:12:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs *.gdata.de *.consentmanager.net www.paypal.com *.criteo.com *.criteo.net *.onfastspring.com *.saferpay.com www.youtube-nocookie.com www.google.com www.google.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
last-modified: Wed, 13 Mar 2024 09:01:17 GMT
server: nginx
referrer-policy: no-referrer-when-downgrade
etag: "65f16b5d-63d7"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 25559
x-xss-protection: 0
expires: Mon, 29 Apr 2024 02:12:47 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.gdatasoftware.com/	1970-01-20 19:13:34	Name: GDS_utm Value: {"utm_medium":"","utm_source":"","utm_campaign":"","utm_content":"","utm_term":""}

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .gdata.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata-advancedanalytics.com .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com; frame-src 'self' gdata.jobbase.io player.captivate.fm gdata.onlyfy.jobs .gdata.de .consentmanager.net www.paypal.com .criteo.com .criteo.net .onfastspring.com .saferpay.com www.youtube-nocookie.com www.google.com www.google.de .gdata.ch .gdata.fr .gdata.at .gdata.nl .gdata.it .gdata.be .gdata.es .gdata.pt .gdatasoftware.co.uk .gdatasoftware.com .gdata-software.com .gdata-advancedanalytics.de .gdata.co.jp .gdata-china.com .gdata-hongkong.com .inventorofantivirus.com www.awin1.com *.doubleclick.net bid.g.doubleclick.net tpc.googlesyndication.com fbanalytics.org m.youtube.com player.vimeo.com gdata.jobbase.io gdata-a.akamaihd.net; report-uri https://www.gdatasoftware.com/__cspreporting__
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.gdatasoftware.com
212.23.151.164
0558df07062ae8f70ff4a2d28780b4996d6731c4d8cfaf770c6d5f70daba60a7
0972357d7e0cfbae238187b6a2d759701c22cbf5f1eb62ec3b7b61b20b6e6067
12bbeb4a5c75cfa4f290f8da4a9282a835f6704b94917c5bc05d4430aa9b31dd
19d66a51d12c87c2c254f61d3dc66f4765bc852b03138e4b38ed5fbc3dd01d19
19ed0d35c2ed6fe85f30a033671fbd915df862517a7f233ca953f91b4288a67e
2b6d2a4d02ca3679ab025879962d0f8738c25858693c1e76d780a1978b880ee3
322b88ecc485486c626af1961147450474c1c97048ae43547d0fe5333e9cc168
36cf96f7c1ea5983f2bf4484375ce22e96f5fb05bddf9d0f9ac951dc9fe94ead
3e17d9ffedd7459d58e6c669de912c510574ec762c6c64fa599ed7e660cad7ba
5b7ade4116e14b315421eb6e4eeabbf1a1c7301a575ee1311fb1659eaaecd6f4
5bd5ebcf03a341e616a7b8361cf09a193e9e4b96fda68c679a6c53a07f5c31bb
5e5d46c22d87bff9d49018172f5764cb39ebcd228577ad17229a7dc67ee65198
63afc17a9a03684722e95291d72b5217f00a295a54d34a7b66cc4419654c986a
6a6862da716a66741766c94c7aec632a1f772f8c5e0860843ccc2e7a0afa58e0
72e086ecb5eed26e489b633ce3a7a85522747d8583852bf8756e290fec0f3d3b
77f9291def17b8ae239f0f5181ad69a3923dbcc7835ba7aaa4cb1d1cb2142211
7a7abe196a5d8d760adbec74b6dcf7af2f35c91a06b4e033928ee5c03dfb7e9b
7ffcdc0c49b5256a7c3792e350854d49994434073a92f766f5fb2c454e8b23c6
8b15da1e0bd1935eecff6905899564697c3c434c330d4dd410c9a6270c8b95f8
9d20a8fc1de189bad815a78bd3a36550412788bc1d8e6f2d7eba6bb18bc901a2
cb5faac10f736b11b94aeb79c7a9f4fb99f3b2a1b0ac08e5ca5a49d7e478dab5
d42cfade3d58d658e7e38a98572a735d4d8548d0b458dde7a7e7b8f6fd00d85d
de29fa42fdcdbc32e060d8e033322b3d0151f70e82dd08e8c9c9996e6c343dcb
e0eb2d334ba82b20857309a58f3d7891b960f328346b549892066f1772a6ae88
e23b4c5ab16f3b4ab4e956c43e3ff4b1af89f2a458c2a5c4544fb856f235b364
e269f4a039beda664bcd9294fe3f36f6ebfdf31dc2c02bee383f47ae67003af8
eaee182f99fdf2d211c29221098ce1d2a326f78ee7126ce481d0c139e91b0d01

www.gdatasoftware.com Open in urlscan Pro 212.23.151.164 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1335 kBTransfer

1771 kBSize

1 Cookies

29 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

www.gdatasoftware.com Open in urlscan Pro
212.23.151.164 Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1335 kB
Transfer

1771 kB
Size

1
Cookies

27 HTTP transactions
0 data transactions