www.recordedfuture.com Open in urlscan Pro
104.18.43.111  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1715849594329%26url%3Dhttps%253A%252F%252Fwww.recordedfuture.com%252Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIhohSfPVDTqAAAAY-AmwgPiTNz8WBrpnHp5IhFxlTy_9l06vOnrAMnt9VxXPtd9kPAMc2oRUUYllo3BXRPEM5OHkjoLw

103 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Show response www.recordedfuture.com/	87 KB 21 KB	584ms 551ms	Document text/html	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash 1fb7d6dbc64722705e42e72b832884ad286ad60198a297a9890e2e4183ab119b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers age 0 cache-control s-maxage=30, stale-while-revalidate cf-cache-status DYNAMIC cf-ray 884a22d41b475b92-FRA content-encoding gzip content-type text/html; charset=utf-8 date Thu, 16 May 2024 08:53:13 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains traceresponse 00-17cfec1d3bc9741eede6ad83700db2ba-c1fc0a661e49251c-01 vary Accept-Encoding via 1.1 varnish x-cache MISS x-cache-hits 0 x-content-type-options nosniff x-debug-info eyJyZXRyaWVzIjowfQ== x-nextjs-cache STALE x-platform-server i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0 x-powered-by Next.js x-served-by cache-fra-eddf8230026-FRA
GET H2	200	brand_logo_long_black_f2ead5b5c6.svg cms.recordedfuture.com/uploads/	4 KB 1 KB	460ms 409ms	Image image/svg+xml	151.101.2.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-cache-hits 0 date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 age 0 traceresponse 00-17cd245a46c9260c6bb38ad0fea2d74a-776eddf0662091d6-01 x-cache HIT content-length 1262 x-served-by cache-fra-eddf8230121-FRA last-modified Thu, 10 Mar 2022 10:37:46 GMT etag W/"6229d4fa-eab" vary Accept-Encoding content-type image/svg+xml cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes expires Tue, 07 May 2024 07:35:03 GMT
GET H2	200	large_Main_Feature_7d63aead72.webp cms.recordedfuture.com/uploads/	51 KB 51 KB	466ms 415ms	Image image/webp	151.101.2.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/large_Main_Feature_7d63aead72.webp?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 829beb2b8007ca0bf3d74a2f1b66ce6a206a9886c743eb72661d0c41568733f5 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Wed, 15 May 2024 18:11:33 GMT date Thu, 16 May 2024 08:53:14 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 fastly-io-served-by vpop-etou8240193 traceresponse 00-17cfbbba99ca69a2cd55baec8bce1c9e-9f5079cce96cb966-01 age 0 x-cache HIT fastly-io-info ifsz=52216 idim=1000x375 ifmt=webp ofsz=52216 odim=1000x375 ofmt=webp fastly-stats io=1 content-length 52216 fastly-io-warning Failed to shrink image x-served-by cache-fra-eddf8230121-FRA etag "HY+n6bGU1CZbmR/Nnu8trQPg8PF701PcZQ0IBUcQeUM" vary Accept-Encoding content-type image/webp cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	fonts.css www.recordedfuture.com/fonts/	1 KB 422 B	136ms 135ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/fonts/fonts.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cfec1d4db1304a32f6dd2f03cecbc3-d6e7a7a44eb86583-01 x-cache MISS content-length 208 x-served-by cache-fra-eddf8230156-FRA last-modified Thu, 16 May 2024 07:23:18 GMT server cloudflare etag W/"416-18f8048ae70" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d7dea45b92-FRA x-cache-hits 0
GET H2	200	5669f3a3e963b754.css www.recordedfuture.com/_next/static/css/	60 KB 13 KB	35ms 34ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f00265b5c4ea5ff06e43afb5cf09cd5268e152585a4b97250f8f77e60bd32c8c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff age 4775 traceresponse 00-17cfe7b3c6c9d3af5fb655a4e1724d57-eddb5d7c0815bea0-01 cf-polished origSize=61184 content-encoding gzip x-cache HIT x-served-by cache-fra-eddf8230096-FRA cf-bgj minify last-modified Thu, 16 May 2024 07:29:50 GMT server cloudflare etag W/"ef00-18f804eab2d" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 884a22d7dea85b92-FRA x-cache-hits 0
GET H2	200	afcbc21a5decfe5c.css www.recordedfuture.com/_next/static/css/	21 KB 5 KB	36ms 35ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/afcbc21a5decfe5c.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 509cd90bea3d2cdd9336fb50fcdc6d59cf507d069bad2657213a40d194509afe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff age 3412 traceresponse 00-17cfe8c587a7aa5762ac1f366124b664-f40ec0c34f596ff3-01 cf-polished origSize=21887 content-encoding gzip x-cache HIT x-served-by cache-fra-eddf8230159-FRA cf-bgj minify last-modified Thu, 16 May 2024 07:29:50 GMT server cloudflare etag W/"557f-18f804eab5a" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 884a22d7dea95b92-FRA x-cache-hits 0
GET H2	200	webpack-f685aac5b0d3d19f.js Show response www.recordedfuture.com/_next/static/chunks/	5 KB 2 KB	38ms 34ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/webpack-f685aac5b0d3d19f.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82ab2fedb65b40d47e84049fdc96ad1a3cc30a7bccc40e709d057b3c0b72ac74 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 4397 traceresponse 00-17cfe81d8054a2f11822c0eafbbf076f-73d64e3be9027af5-01 x-cache MISS content-length 2304 x-served-by cache-fra-eddf8230119-FRA last-modified Thu, 16 May 2024 07:29:50 GMT server cloudflare etag W/"15a4-18f804eab0b" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d7fec55b92-FRA x-cache-hits 0
GET H2	200	framework-467b11a89995b152.js Show response www.recordedfuture.com/_next/static/chunks/	138 KB 45 KB	31ms 27ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1987954 traceresponse 00-17c8dc14830dda2f1c6e4bbea8903d34-75af0fb35c61fb10-01 x-cache MISS content-length 45457 x-served-by cache-fra-eddf8230048-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"2270d-18f0a1a75c3" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ec75b92-FRA x-cache-hits 0
GET H2	200	main-75bdb96a41ba80f4.js Show response www.recordedfuture.com/_next/static/chunks/	113 KB 32 KB	40ms 37ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 1987955 traceresponse 00-17c8dbfc4719b5dd19d65959ae114b78-85f390bf5c60bb23-01 x-cache HIT content-length 33036 x-served-by cache-fra-eddf8230104-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"1c3b0-18f0a1a75d8" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ec85b92-FRA x-cache-hits 0
GET H2	200	_app-d8e4586260386d57.js Show response www.recordedfuture.com/_next/static/chunks/pages/	122 KB 39 KB	37ms 34ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/_app-d8e4586260386d57.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5e17346547b84fb6eb39887940896609ab42df0d14fdcfa501063d90d226d9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 1474329 traceresponse 00-17c8dc148317e222275024fbf463b9b5-eaf0747e0eb7e9f7-01 x-cache HIT content-length 39378 x-served-by cache-fra-eddf8230024-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"1e8a1-18f0a1a75fc" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80eca5b92-FRA x-cache-hits 0
GET H2	200	644-584ee0fdbd1978d9.js Show response www.recordedfuture.com/_next/static/chunks/	253 KB 75 KB	42ms 39ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/644-584ee0fdbd1978d9.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 850369a450ff44bc6cbbc7912c9ae0144aa7fe94f9da36de703d5a7e26fb1dd7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 4774 traceresponse 00-17cfe7c5adbe80994a7958533896d296-044d773840cecb57-01 x-cache MISS content-length 76505 x-served-by cache-fra-eddf8230032-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"3f5f0-18f804ea8a4" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ecb5b92-FRA x-cache-hits 0
GET H2	200	129-18f7d6c1f8c4b98c.js Show response www.recordedfuture.com/_next/static/chunks/	37 KB 11 KB	28ms 25ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/129-18f7d6c1f8c4b98c.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46d64a78d884e43692e0b4b83e8affef1f858885563fcb1ce92d11235499aa17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 1987955 traceresponse 00-17c8dc14833c797a5095d7cc5b98dbc4-bbddbf039536692f-01 x-cache MISS content-length 11517 x-served-by cache-fra-eddf8230134-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"93e4-18f0a1a754e" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ecc5b92-FRA x-cache-hits 0
GET H2	200	911-ff01f8a62625f045.js Show response www.recordedfuture.com/_next/static/chunks/	55 KB 19 KB	51ms 48ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1987954 traceresponse 00-17c8dc148460be9167a57fc8c757e8d6-432400118dc712f5-01 x-cache MISS content-length 18806 x-served-by cache-fra-eddf8230041-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"ddd2-18f0a1a75a2" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ecd5b92-FRA x-cache-hits 0
GET H2	200	747-a2f14eda3070de3f.js Show response www.recordedfuture.com/_next/static/chunks/	61 KB 12 KB	35ms 33ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/747-a2f14eda3070de3f.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1386c80797947cd37337fea484173915324f254e0a8ff7cd3918cce9fc7e733f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1987955 traceresponse 00-17c8dc147da66355fb2866b5d282fb4f-ec8e3f2e06ab7236-01 x-cache MISS content-length 12347 x-served-by cache-fra-eddf8230088-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"f5a3-18f0a1a7585" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ece5b92-FRA x-cache-hits 0
GET H2	200	407-b4466bcdd3b591b7.js Show response www.recordedfuture.com/_next/static/chunks/	15 KB 5 KB	49ms 46ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/407-b4466bcdd3b591b7.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 1987955 traceresponse 00-17c8dc14847662c4c299b4d2b5fa8d80-58bb55471a78f3ee-01 x-cache MISS content-length 5304 x-served-by cache-fra-eddf8230145-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"3cad-18f0a1a7567" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ed25b92-FRA x-cache-hits 0
GET H2	200	925-b476103fb5a7b7aa.js Show response www.recordedfuture.com/_next/static/chunks/	58 KB 18 KB	28ms 26ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/925-b476103fb5a7b7aa.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b12025936e837cee34970b346233fd8f61ba7c2981b033ec44c4fa08d7fa718 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 1987954 traceresponse 00-17c8dc14841e135b98144870ac5a5770-5e3e66019f4e3f15-01 x-cache MISS content-length 18004 x-served-by cache-fra-eddf8230119-FRA last-modified Tue, 23 Apr 2024 08:37:37 GMT server cloudflare etag W/"e6fc-18f0a1a75b3" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ed35b92-FRA x-cache-hits 0
GET H2	200	399-1b3aa244c807dc0b.js Show response www.recordedfuture.com/_next/static/chunks/	44 KB 11 KB	36ms 33ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/399-1b3aa244c807dc0b.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11190a749f59b077caec75c74dd32de36269537bea40955ac2014d422cfefde9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 4775 traceresponse 00-17cfe7afd9b95485d4cb50298ca4626d-bc92082004398d41-01 x-cache HIT content-length 11522 x-served-by cache-fra-eddf8230058-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"b012-18f804ea87b" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ed55b92-FRA x-cache-hits 0
GET H2	200	826-bc24dd74e0566b47.js Show response www.recordedfuture.com/_next/static/chunks/	29 KB 6 KB	48ms 46ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/826-bc24dd74e0566b47.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2a6784e6daecf03079b0c9ec24873164f7337105090c19efea06c1b6a936c97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 4774 traceresponse 00-17cfe7c59c608f2505ea2705a397f671-e39c1bc10c0bf8dc-01 x-cache MISS content-length 5819 x-served-by cache-fra-eddf8230087-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"7378-18f804ea8d4" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ed65b92-FRA x-cache-hits 0
GET H2	200	%5B%5B...slug%5D%5D-c24f56c165769f00.js Show response www.recordedfuture.com/_next/static/chunks/pages/	111 KB 25 KB	36ms 34ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-c24f56c165769f00.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 65b2b55f426789b99fa51474f26f4cd55858c4972ee232bc911f666c7b92bbf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 4774 traceresponse 00-17cfe7c59ca0f279a6e98112b3d61051-c97a139c827c30ad-01 x-cache MISS content-length 25459 x-served-by cache-fra-eddf8230043-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"1bde1-18f804ea92c" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80ed85b92-FRA x-cache-hits 0
GET H2	200	_buildManifest.js Show response www.recordedfuture.com/_next/static/B0q65flfgzyJU1JnrE140/	2 KB 954 B	41ms 39ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/B0q65flfgzyJU1JnrE140/_buildManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a5f7a9a8039cc768ef8907916769799813335dc7462460134759efdc1914e2b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 4775 traceresponse 00-17cfe7b44a94d5d4adba3b530f63cbbe-0642f8485ef73daa-01 x-cache HIT content-length 788 x-served-by cache-fra-eddf8230058-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"8c9-18f804ea83f" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d80eda5b92-FRA x-cache-hits 0
GET H2	200	_ssgManifest.js Show response www.recordedfuture.com/_next/static/B0q65flfgzyJU1JnrE140/	173 B 256 B	47ms 46ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/B0q65flfgzyJU1JnrE140/_ssgManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 020a19839813fdee2eacf5a88bb1c537c26cb6cffb8cb3fffdbac86d5cf939fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 cf-cache-status HIT age 4774 traceresponse 00-17cfe7c59c2df966813a1f1f1c1ae67c-b4a53e70d3575c2e-01 content-encoding gzip x-cache MISS x-served-by cache-fra-eddf8230109-FRA last-modified Thu, 16 May 2024 07:29:49 GMT server cloudflare etag W/"ad-18f804ea84c" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 884a22d80edb5b92-FRA x-cache-hits 0
GET H2	200	insikt_group_logo_updated_3_300x48_b5390f4ff2.png cms.recordedfuture.com/uploads/	2 KB 3 KB	360ms 311ms	Image image/png	151.101.2.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 16 May 2024 07:48:37 GMT date Thu, 16 May 2024 08:53:13 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 fastly-io-served-by vpop-etou8240196 traceresponse 00-17cfe850ef4f599723598a93b83f1c23-975b0cd1cbfbf14c-01 age 0 x-cache HIT fastly-io-info ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png fastly-stats io=1 content-length 2186 fastly-io-warning Failed to shrink image x-served-by cache-fra-eddf8230121-FRA etag "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg" vary Accept-Encoding content-type image/png cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	44 KB 9 KB	39ms 16ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&vn=2.1&x=true Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 50c92391c2b6e11a6badf2f2de17c6421cabaf9a0975e9ef42c324744647ca25 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 google server gfra1 etag W/"1715793291_EA" vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin https://www.recordedfuture.com cache-control public, max-age=0, no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	x-social-media-black-icon.svg www.recordedfuture.com/images/	456 B 488 B	433ms 433ms	Image image/svg+xml	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.recordedfuture.com/images/x-social-media-black-icon.svg Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 cf-cache-status MISS content-encoding gzip traceresponse 00-17cfec1d61da2da8f1b16cbb192abd49-34c93f21aa2e895d-01 x-cache MISS x-served-by cache-fra-eddf8230069-FRA last-modified Thu, 16 May 2024 07:23:18 GMT server cloudflare etag W/"1c8-18f8048ae70" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 884a22d82eee5b92-FRA x-cache-hits 0
GET H2	200	Inter-Regular.86422bf3.ttf www.recordedfuture.com/_next/static/media/	303 KB 144 KB	33ms 24ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 2637982 traceresponse 00-17c35173e27d8668bbd84c3fe4652742-614f41395ddd154b-01 x-cache HIT content-length 147167 x-served-by cache-fra-eddf8230108-FRA last-modified Thu, 04 Apr 2024 14:57:09 GMT server cloudflare etag W/"4ba44-18ea99d1b0b" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f145b92-FRA x-cache-hits 0
GET H2	200	Inter-Bold.0b1aaf81.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	47ms 38ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 2637982 traceresponse 00-17c3596ccbb68a45fd54b3dcfbbaf1a8-f2820ba68d41f85c-01 x-cache HIT content-length 157388 x-served-by cache-fra-eddf8230092-FRA last-modified Thu, 04 Apr 2024 14:57:09 GMT server cloudflare etag W/"4d2c4-18ea99d1aa4" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f165b92-FRA x-cache-hits 0
GET H2	200	icomoon.ttf www.recordedfuture.com/icons/fonts/	6 KB 3 KB	446ms 437ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cfec1d63b1e00ec17037e75a8fd4f3-761ed45b5d975e66-01 x-cache MISS content-length 3235 x-served-by cache-fra-eddf8230144-FRA last-modified Thu, 16 May 2024 07:23:18 GMT server cloudflare etag W/"160c-18f8048ae70" vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f175b92-FRA x-cache-hits 0
GET H2	200	Inter-SemiBold.ebaf29e9.ttf www.recordedfuture.com/_next/static/media/	308 KB 153 KB	50ms 41ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 2638658 traceresponse 00-17c3e66dd30a0720b3ad747d77689238-32ed6736b42bbe37-01 x-cache HIT content-length 156755 x-served-by cache-fra-eddf8230149-FRA last-modified Thu, 04 Apr 2024 14:57:09 GMT server cloudflare etag W/"4d16c-18ea99d1b2b" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f185b92-FRA x-cache-hits 0
GET H2	200	Inter-ExtraBold.d19caa02.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	44ms 35ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 2637982 traceresponse 00-17c3eefdeb673ce066441cb677448016-1658bb8947f58a81-01 x-cache HIT content-length 157010 x-served-by cache-fra-eddf8230092-FRA last-modified Thu, 04 Apr 2024 14:57:09 GMT server cloudflare etag W/"4d52c-18ea99d1aba" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f195b92-FRA x-cache-hits 0
GET H2	200	Inter-Medium.6ee661b3.ttf www.recordedfuture.com/_next/static/media/	307 KB 152 KB	37ms 30ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/_next/static/css/5669f3a3e963b754.css Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 2638656 traceresponse 00-17c3596cd875a0b6efe269138716f876-ab9469c343bed3fc-01 x-cache HIT content-length 155503 x-served-by cache-fra-eddf8230104-FRA last-modified Thu, 04 Apr 2024 14:57:09 GMT server cloudflare etag W/"4cd58-18ea99d1af4" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22d84f1a5b92-FRA x-cache-hits 0
GET H3	200	worker-e0640a5c14d4a343c3d0bcc1c3d1277e.js Show response dev.visualwebsiteoptimizer.com/edrv/	247 KB 60 KB	26ms 13ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/worker-e0640a5c14d4a343c3d0bcc1c3d1277e.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 4fa58e61a7e2ff2773a7375c768668486b025995809b2cc543b9400f4df5d4d5 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding br via 1.1 google last-modified Wed, 15 May 2024 13:24:34 GMT server gfra1 etag "6644b792-eec5" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 61125
GET H3	200	va_gq-f4af2969fd28135bb596af5bc4ddbd14.js Show response dev.visualwebsiteoptimizer.com/edrv/	246 KB 64 KB	21ms 9ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/va_gq-f4af2969fd28135bb596af5bc4ddbd14.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash b2723c725f4e96ce773696b44f00bf432b4520c84e8e924b3bd342bbeecd9a01 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:12 GMT content-encoding br via 1.1 google last-modified Wed, 15 May 2024 13:24:34 GMT server gfra1 etag "6644b792-1017f" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65919
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 155 B	98ms 97ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=DB609FB6021C16DC0EECD2BA65FB8DFD9&h=86edc21b79c0cf04b0ecc2df54c78152&t=false Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control public, max-age=43200 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35
GET H2	200	gtm.js Show response www.googletagmanager.com/	308 KB 103 KB	70ms 40ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 6845ae66e2488e37a008fc8deeb60d249e2c2f4bdac8aa745b735c56bb3a782c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 104900 x-xss-protection 0 last-modified Thu, 16 May 2024 06:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 16 May 2024 08:53:13 GMT
GET H2	200	resource-sidebars Show response cms.recordedfuture.com/api/	82 B 827 B	25ms 8ms	XHR application/json	151.101.2.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash 6f2a66b7c2567498349c8dc31d361a2208aa2babd36fdaabe7ef20aefe992bd9 Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Thu, 16 May 2024 08:53:13 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-permitted-cross-domain-policies none age 2567 traceresponse 00-17cfe9c7b79d27944fec8f14d256e8b8-df164c894bbb5062-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache HIT via 1.1 varnish content-length 82 x-served-by cache-fra-eddf8230040-FRA referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	resources Show response cms.recordedfuture.com/api/	19 KB 19 KB	635ms 620ms	XHR application/json	151.101.2.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][1][$or][0][showFrom][$null]=true&filters[$and][1][$or][1][showFrom][$lte]=2024-05-16T08%3A53%3A13Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash 67afaa5c3b174fe3ad8a3875f8000252ccbf8e60023d3f29ac6778c8f0cf785e Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Thu, 16 May 2024 08:53:14 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-permitted-cross-domain-policies none age 0 traceresponse 00-17cfec1d6af8a15500e12440e7d33f1b-2f962e70ed887bf2-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache MISS via 1.1 varnish content-length 19657 x-served-by cache-fra-eddf8230040-FRA referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	97ms 97ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=DB609FB6021C16DC0EECD2BA65FB8DFD9&s=1715849593&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1715849593896%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1715849593916&v=c14b4bd14 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:13 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET BLOB	200 OK	68c615fd-3497-424b-99c5-d5a2f9bc2108 https://www.recordedfuture.com/	247 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.recordedfuture.com/68c615fd-3497-424b-99c5-d5a2f9bc2108 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 81d78f5da1f071fadcaf0806393a163de01a8d92623089f6240c35a2d5978120 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Length 253100 Content-Type application/javascript
GET H2	200	blog.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	41 KB 8 KB	127ms 126ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/blog.json?slug=blog Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a33082975ed7f211a1d71db83e9d5fdd004d162bdf3abaf56f145bf3704f6483 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cfeafec520100fbaf3f100e4e6bde3-7d941a19e1c2c6b2-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 7712 x-served-by cache-fra-eddf8230026-FRA server cloudflare etag "sriyk0ismtwjx" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da79c25b92-FRA x-cache-hits 0
GET H2	200	careers.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	76 KB 14 KB	134ms 133ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/careers.json?slug=careers Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e119ea2ba3da4fffd7cbd065e4bc33962a6f2d5efe34e9453ad986af09ad1c7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 varnish traceresponse 00-17cfeb042528bab8baa7c99cd480aadc-c135034ccc286d0f-01 age 0 x-cache HIT x-nextjs-cache STALE content-length 13749 x-served-by cache-fra-eddf8230026-FRA server cloudflare etag "16nxywoyy0d1nta" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89c35b92-FRA x-cache-hits 1
GET H2	200	contact.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	50 KB 10 KB	132ms 130ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/contact.json?slug=contact Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8b7ed360faa391f84bb8524b1cd761f7a4f006cc4bef843344716771c61b9daf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 varnish traceresponse 00-17cfeb58673ac2329ba4ccb560b04aa0-73506e35076709d8-01 age 0 x-cache HIT x-nextjs-cache STALE content-length 9990 x-served-by cache-fra-eddf8230099-FRA server cloudflare etag "4yiuxm0qda13lu" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89c55b92-FRA x-cache-hits 1
GET H2	200	index.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	87 KB 16 KB	32ms 30ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/index.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 596a5f78238fca3badb1a000ab9b09f95023707d15e56b0b0542dfe1713ea41f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 varnish traceresponse 00-17cfeafabb85617ed4423c3bee49da03-38e95f266547c613-01 age 1249 x-cache HIT x-nextjs-cache STALE content-length 15745 x-served-by cache-fra-eddf8230124-FRA server cloudflare etag "bhaz9474os1wrf" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89c75b92-FRA x-cache-hits 2
GET H2	200	intelligence-cloud.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/platform/	71 KB 13 KB	441ms 438ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/platform/intelligence-cloud.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff07afc3d9c6546780c36038fd225f1ada680d3e1188983cdafefa0fca1e6f9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cfeb335fb4443e0dcc08c2fcd0ca20-d35b33b38331fcfd-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 12907 x-served-by cache-fra-eddf8230124-FRA server cloudflare etag "rk0103nha1k1j" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89cb5b92-FRA x-cache-hits 0
GET H2	200	solutions.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	76 KB 13 KB	33ms 31ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/solutions.json?slug=solutions Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a13ac0b21c18e355c0b880594c43dfa86bf264a31bf3a6f0a37d6bf9bde4f32b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 1076 traceresponse 00-17cfeb22cfbab71c3a0f9c2a33e290b2-450152672658ea71-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 13518 x-served-by cache-fra-eddf8230099-FRA server cloudflare etag "anjo5o9k8k1o4j" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89cc5b92-FRA x-cache-hits 0
GET H2	200	client-success.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/services-support/	48 KB 10 KB	31ms 30ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/services-support/client-success.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83999a8e7552e02afc9353e1f1ba980b09820b30c2893b9572b2ffe5f06842f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 3322 traceresponse 00-17cfe917fadd9b3aa46fcd40b781f820-b59d7fd228be5bbf-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 9489 x-served-by cache-fra-eddf8230145-FRA server cloudflare etag "spo9qtu38k11wa" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89cd5b92-FRA x-cache-hits 0
GET H2	200	research.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	57 KB 11 KB	461ms 458ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/research.json?slug=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46b46c32e6b3b0e9c64706e6cf05b9472d11bb9e612c7d40e71950e312c047d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cfeafca3cc69cf4a91d939b2274dc5-abe86e35efffc164-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 11022 x-served-by cache-fra-eddf8230121-FRA server cloudflare etag "ym30ilr8e8194v" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89cf5b92-FRA x-cache-hits 0
GET H2	200	resources.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	55 KB 10 KB	140ms 137ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/resources.json?slug=resources Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b521fdeb6255c90f234ac417a332f634e08f583b10cc6fe84c9257531804af1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17cfeba3cbd874fcd0fdbbb815f7704c-d71b9e94bc2228d5-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 10005 x-served-by cache-fra-eddf8230145-FRA server cloudflare etag "p1uxz1v5nj17h1" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89d05b92-FRA x-cache-hits 0
GET H2	200	company.json Show response www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/	47 KB 9 KB	32ms 30ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/B0q65flfgzyJU1JnrE140/company.json?slug=company Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b79c1c5b020a30bbfee8c52fd6e5c2266464e95bf7c6a16c8cabae3ecb48e73c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 1123 traceresponse 00-17cfeb17de9165b71571c30ed62ecf12-eaa68d40ba1db80e-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 9356 x-served-by cache-fra-eddf8230111-FRA server cloudflare etag "pjmupwqwm510w7" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22da89d15b92-FRA x-cache-hits 0
GET H2	200	64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response j.6sc.co/j/	6 KB 6 KB	747ms 432ms	Script application/javascript	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9a73601ec1d6e441ee47efbe510855a822e6d855fa36728d42ff8db3ca13edb9 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id 3w5hm63GPAfRo68wp1nEVb5uiedjUjtH date Thu, 16 May 2024 08:53:14 GMT x-amz-cf-pop LHR50-P1 x-amz-server-side-encryption AES256 x-amz-meta-content-type application/json content-length 6092 pragma no-cache last-modified Thu, 28 Mar 2024 14:04:56 GMT server AmazonS3 etag "7d2aaf9fa96d19c8ff79cd758e1347b6" vary Accept-Encoding content-type application/javascript cache-control max-age=0, no-cache, no-store accept-ranges bytes x-amz-cf-id SUESkAecyDfvsMFhiVbuEJjS17uuTJzRmeYqV8ZleELWcNU9u6gBsQ== expires Thu, 16 May 2024 08:53:14 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	315 KB 103 KB	43ms 42ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7d55971777cbf161694abb89fe13378485543b04e61be99e72d32390ee113908 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 105704 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 16 May 2024 08:53:14 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	39ms 7ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip last-modified Fri, 22 Mar 2024 21:07:24 GMT x-amz-server-side-encryption AES256 etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15412 x-served-by cache-iad-kiad7000168-IAD, cache-fra-eddf8230031-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	47 KB 17 KB	65ms 13ms	Script application/javascript	2a02:26f0:3500:16::215:148d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 06 May 2024 17:20:18 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=10577 accept-ranges bytes content-length 16683
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	52ms 5ms	Script text/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 16 May 2024 07:54:57 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 3497 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Thu, 16 May 2024 09:54:57 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	52ms 6ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 04:42:58 GMT content-encoding gzip x-content-type-options nosniff age 15016 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 16 May 2025 04:42:58 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	218 KB 59 KB	36ms 8ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 16 May 2024 08:53:14 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 57845 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1326, tbw=2795, tp=-1, tpl=-1, uplat=1, ullat=-1 pragma public x-fb-debug OjT0tD3lEFaXtY5n+Tx7JfPHuMtjX8KpEhJ2oxeN4DJdWmIVhhoL5+8CM+ZX4Qkh2t1avdQZ5cuGWBQ3XCbiGg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	container_nbhoRDM8.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	255 KB 72 KB	51ms 6ms	Script application/javascript	2600:9000:2724:e600:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2724:e600:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 1a05df42ef9d39590206db8fa312263869e8bb5412e8e49e4a26f69434378342 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 06:08:01 GMT x-amz-version-id fWFQoupYkDYoPThaxu70CFB9bmx.yYlZ content-encoding gzip strict-transport-security max-age=31536000 via 1.1 1270eda8f49e8826b43258fcc9ef44d2.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P12 age 9914 x-cache Hit from cloudfront x-amz-replication-status FAILED last-modified Mon, 13 May 2024 21:21:56 GMT server CloudFront etag W/"e82c9d0943cb96607be27127743df235" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id jEbVCjgVf_jR0mENGCCTEG015QBcZxGX2NtWRXLEKiVYkgu9PK11YQ==
GET H2	200	matomo.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	202 KB 59 KB	60ms 15ms	Script application/javascript	2600:9000:2724:e600:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2724:e600:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 06:00:48 GMT x-amz-version-id nUcBrzhVy9JMMaAtFkxpvW8b5Jy3nYQT content-encoding gzip strict-transport-security max-age=31536000 via 1.1 1270eda8f49e8826b43258fcc9ef44d2.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P12 age 10347 x-cache Hit from cloudfront x-amz-replication-status FAILED last-modified Mon, 29 Apr 2024 00:09:25 GMT server CloudFront etag W/"5c359e1fa9398dc7248bc8740cc8eb49" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id Xz-CibQyMyzWoP4uHJ8pbi2dyzeVwrmE1JhgF1eGnGPdI8xKAjs01A==
GET H2	200	252628.js Show response js.hs-scripts.com/	2 KB 1 KB	67ms 25ms	Script application/javascript	2606:4700::6810:8ad1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/252628.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10bf594db85cd03e1b428865d8e34a05593e78284b93b25bb3f03cfd2b6b4f46 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT x-hubspot-correlation-id 1913e1f4-d62d-4958-a1bb-31745832f289 x-evy-trace-route-service-name envoyset-translator cf-polished origSize=2007 age 24 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 1913e1f4-d62d-4958-a1bb-31745832f289 cf-bgj minify last-modified Thu, 16 May 2024 08:52:50 GMT server cloudflare access-control-max-age 3600 vary origin, Accept-Encoding content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5d47c8d44f-2hls6 x-evy-trace-virtual-host all access-control-allow-credentials true cache-control public, max-age=90 cf-ray 884a22db1fdd8ecd-FRA expires Thu, 16 May 2024 08:54:44 GMT
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/	42 KB 8 KB	25ms 25ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=880669&settings_type=1&vn=&eventArch=1&uuid=&ec=958153|962224&exc=8|12|16 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 4e614fdde0022b6c48199ef9dfc15594829f19271b84febdbee9d1e5b8bf185b Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT content-encoding gzip via 1.1 google server gfra1 etag W/"1715793291_EA" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	adsct t.co/i/	43 B 377 B	241ms 193ms	Image image/gif	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=5499db1e-50a2-4fe9-9ba6-ea2290ef2c93&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5e373f8d-2d05-461a-b982-18674ca1bcd5&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 176 date Thu, 16 May 2024 08:53:13 GMT strict-transport-security max-age=0 server tsa_f content-type image/gif;charset=utf-8 x-transaction-id f53b2c2632f9937a cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash b26c03da1a11961c0b1160c1987588b3790ffcf9a4660073004a75599b6e2ab7 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 396 B	184ms 130ms	Image image/gif	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=5499db1e-50a2-4fe9-9ba6-ea2290ef2c93&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5e373f8d-2d05-461a-b982-18674ca1bcd5&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 113 date Thu, 16 May 2024 08:53:14 GMT strict-transport-security max-age=631138519 server tsa_f content-type image/gif;charset=utf-8 x-transaction-id 5dcb5d0e85d79e57 cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash d260cbf795bc31919ac5f45691781fbb9cdd7bdf1c63f63a126895836f010e98 content-length 43
GET H2	200	194163687656043 Show response connect.facebook.net/signals/config/	67 KB 14 KB	51ms 50ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/194163687656043?v=2.9.156&r=stable&domain=www.recordedfuture.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa9ce7833973c4c7eb59f8fd769049807c3e27fbc651dcf62aebf109a5aa14f4 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 16 May 2024 08:53:14 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=5, rtx=0, c=64, mss=1326, tbw=63366, tp=-1, tpl=-1, uplat=43, ullat=0 pragma public x-fb-debug 5qFqOMxkhpZWlsB47NiCwGO9vq0HfTcVlkT9rXfUXl0WEXfu8rtsT35wCllv8zgQ4af1XxPmUo8ea2pr2UWwVQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	98ms 97ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=DB609FB6021C16DC0EECD2BA65FB8DFD9&s=1715849593&p=1&tags={%22si%22:{%2212%22:%223%22}}&update=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1715849594168&v=c14b4bd14&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 198 B	15ms 14ms	Image image/gif	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1987166151&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future&utmhid=3081181&utmr=-&utmp=%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&utmht=1715849594183&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.873797033.1715849594.1715849594.1715849594.1%3B%2B__utmz%3D93161374.1715849594.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=362246481&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAAAAAAE~ Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 260 B	59ms 15ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je45f0v873499763z8830966511za200&_p=1715849593861&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=234985311.1715849594&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1715849594&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&dt=GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1324 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 260 B	83ms 21ms	Ping text/plain	2a00:1450:400c:c1f::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=234985311.1715849594&gtm=45je45f0v873499763z8830966511za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c1f::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	63ms 33ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-MHTMF48BZH&cid=234985311.1715849594&gtm=45je45f0v873499763z8830966511za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=860271596 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 446 B	232ms 186ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 8C3EEC89B8F94715A3A4D169E97296B8 Ref B: FRAEDGE1513 Ref C: 2024-05-16T08:53:14Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.recordedfuture.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYYjl2QHuL5j4Pdpw3SAg==
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	116ms 115ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_variationShown&a=880669&v=c14b4bd14&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip via 1.1 google server gnv1c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-inf... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-inf... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1715849594329%26url%3Dhttps%253A%252F%252Fwww.recorded... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-inf... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-in...	0 266 B	210ms 159ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIhohSfPVDTqAAAAY-AmwgPiTNz8WBrpnHp5IhFxlTy_9l06vOnrAMnt9VxXPtd9kPAMc2oRUUYllo3BXRPEM5OHkjoLw Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.recordedfuture.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Thu, 16 May 2024 08:53:14 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: BAF90A6403E04BD4BD26BA8B26EC1FC6 Ref B: FRAEDGE1918 Ref C: 2024-05-16T08:53:15Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYYjl2aecImLbDZPz8RhA== Redirect headers date Thu, 16 May 2024 08:53:14 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 0B6AA035C0CA40DFB5DEAC262F4A04DD Ref B: FRAEDGE1513 Ref C: 2024-05-16T08:53:14Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1715849594329&url=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQIhohSfPVDTqAAAAY-AmwgPiTNz8WBrpnHp5IhFxlTy_9l06vOnrAMnt9VxXPtd9kPAMc2oRUUYllo3BXRPEM5OHkjoLw x-li-proto http/2 content-length 0 x-li-uuid AAYYjl2XRojNEcqRxTu8ow==
POST H3	200	l.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	98ms 97ms	Ping image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/l.gif?experiment_id=12&account_id=880669&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&combination=3&s=1&sId=1715849593&u=DB609FB6021C16DC0EECD2BA65FB8DFD9&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1715849594144%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&vn=undefined&vns=undefined&vno=undefined&eTime=1715849594339&v=c14b4bd14 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H2	200	/ www.facebook.com/tr/	0 274 B	31ms 7ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&rl=&if=false&ts=1715849594353&sw=1600&sh=1200&v=2.9.156&r=stable&ec=0&o=4126&fbp=fb.1.1715849594350.303186243&cs_est=true&ler=empty&cdl=API_unavailable&it=1715849594163&coo=false&rqm=GET Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1326, tbw=2764, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Thu, 16 May 2024 08:53:14 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	afcbc21a5decfe5c.css Show response www.recordedfuture.com/_next/static/css/	21 KB 0	0ms 0ms	Fetch text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/afcbc21a5decfe5c.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 509cd90bea3d2cdd9336fb50fcdc6d59cf507d069bad2657213a40d194509afe Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:13 GMT via 1.1 varnish x-content-type-options nosniff cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 age 3412 traceresponse 00-17cfe8c587a7aa5762ac1f366124b664-f40ec0c34f596ff3-01 cf-polished origSize=21887 content-encoding gzip x-cache HIT x-served-by cache-fra-eddf8230159-FRA cf-bgj minify last-modified Thu, 16 May 2024 07:29:50 GMT server cloudflare etag W/"557f-18f804eab5a" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 884a22d7dea95b92-FRA x-cache-hits 0
GET H2	200	6si.min.js Show response j.6sc.co/	66 KB 18 KB	99ms 99ms	Script application/javascript	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 09 May 2024 06:01:25 GMT server nginx/1.14.0 (Ubuntu) etag "663c66b5-106b3" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 18038 expires Thu, 16 May 2024 08:53:14 GMT
GET H2	200	252628.js Show response js.hs-banner.com/	62 KB 17 KB	56ms 23ms	Script text/javascript	2606:4700:4400::6812:22e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d9c7a52fdb22318677dadf7fa1550a7fa415ff1209d6d9cab674388343bbf79 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT x-amz-version-id in_nA8WDIlUpjHb2KBQP5zKemBOPrsWZ content-encoding br cf-cache-status HIT x-amz-request-id TZFY475PH5BA0S7R x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 2dec34ec-2b45-427a-a677-1b5c6f20a6f7 age 156 x-envoy-upstream-service-time 19 x-amz-id-2 X/d7sxlDaL5dR1g3YPvTB4v0j7kXnHdgByXhgIxyAYv+pgXcDEiH3gZA04vgCz/XQjihv2VjIEw= x-evy-trace-listener listener_https x-request-id 2dec34ec-2b45-427a-a677-1b5c6f20a6f7 x-evy-trace-route-configuration listener_https/all last-modified Wed, 15 May 2024 14:20:59 GMT server cloudflare etag W/"fa7ab68dca34a79cbf3868a713b65241" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-qr8zh vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 884a22df98f318e2-FRA expires Thu, 16 May 2024 08:55:38 GMT
GET H2	200	252628.js Show response js.hs-analytics.net/analytics/1715849400000/	68 KB 22 KB	62ms 28ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1715849400000/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e6188d2da190a811abd709d89507a072d74b304d794596e29180eae30268637 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:14 GMT x-amz-version-id null content-encoding br cf-cache-status HIT x-amz-request-id D49D2E5E7KBNM25Y x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id a501c351-f366-48ff-857b-ea5239912e9a age 121 x-envoy-upstream-service-time 19 x-amz-id-2 NPcd5SncAoSDj+TxgGhNgYfUFGRKVQY3NhfzXPasjmKPpPcJwo4lok0gCwFl1p/SWNnzeb6vsU4= x-evy-trace-listener listener_https x-request-id a501c351-f366-48ff-857b-ea5239912e9a x-evy-trace-route-configuration listener_https/all last-modified Wed, 15 May 2024 14:46:03 GMT server cloudflare etag W/"13db477962d2f63971f5678175a79547" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-q4rbs cache-control max-age=300,public access-control-allow-credentials false cf-ray 884a22df9f508ecb-FRA expires Thu, 16 May 2024 08:56:13 GMT
GET H2	200	web-interactives-embed.js Show response js.hubspot.com/	82 KB 25 KB	57ms 30ms	Script application/javascript	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hubspot.com/web-interactives-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf6683ec2fb825072bc67ba2b4831425951dc365245d5334ca6f2150f50e1590 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding br age 534 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1122/bundles/project.js&cfRay=884a15d07928cafd-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"fa60ef0d372e46facb8180b2d901ba81" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.1122/bundles/project.js date Thu, 16 May 2024 08:53:14 GMT x-amz-version-id TKnbzs9HpFoaV4UGBsfs5UANej3HQBO9 via 1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id b6efcac5-580e-429f-988f-ef7f1d0be795 x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 x-evy-trace-route-configuration listener_https/all x-request-id b6efcac5-580e-429f-988f-ef7f1d0be795 last-modified Tue, 14 May 2024 11:26:52 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ABSo6WpHobs3GBZsBEdeYtJgiXgkGkApcjcBHivlcf1Sb6HaRYwh4vuw9xoCYqdQILd%2FIutJBI4sWgunVuvhqeKr9Qcx%2FLY%2FpJIXfJpSuEg7N0uc9GfOsEUVWzGZo%2FPDwS7H9jy6TVdNXtdv"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-68b7f7fbff-qbnbs cf-ray 884a22df9bfe1c79-FRA x-amz-cf-id -5ngdK4Gw4In_ShhqffDwpAPxCflSHv0HtAGhPSSYQFeCIxhwcI5tQ==
GET H2	200	leadflows.js Show response js.hsleadflows.net/	551 KB 88 KB	54ms 25ms	Script application/javascript	2606:4700::6812:8c11 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:8c11 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efb5dc6835aeb8a8e1615ca49df1828cfaf708dc73651c5f1c651f2d2ab3907a Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding br age 56468 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js&cfRay=8844c03cabd92cfa-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"d252299cef5b9176cf0435e72e0baeeb" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1338/bundle/main/lead-flows-release.js date Thu, 16 May 2024 08:53:14 GMT x-amz-version-id FzXUOelq5PzvbDhLOc3Au0ThiCBuXHAc via 1.1 af160f4504a0539433328f73887ea912.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop IAD61-P1 x-hubspot-correlation-id 19efd029-26dc-4d79-8eb6-e2320c703075 x-cache Hit from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 6 x-evy-trace-route-configuration listener_https/all x-request-id 19efd029-26dc-4d79-8eb6-e2320c703075 last-modified Wed, 03 Apr 2024 09:27:53 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-68b7f7fbff-r5jtt cf-ray 884a22df99271983-FRA x-amz-cf-id hIG1_KO6xSWlahsS_9aBhQzQgEkTEz0JWMTe-Y1NCG7zg_iZVhc9EA==
GET H2	200	combinedConfigs Show response cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/	433 B 1 KB	158ms 148ms	Fetch application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b4bf8910a202b24bd61be26e28eaa8c5f83a48d78999b2693a9cbdf4c9910cf1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 7b470901-0dd6-4bcd-9bca-9b486324d2f2 content-encoding br x-envoy-upstream-service-time 19 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 7b470901-0dd6-4bcd-9bca-9b486324d2f2 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d3UVH6jH%2B49Rp7m5DQeucJH%2FaHbhOaOiInm16Y0jH9NP9%2BiLtLLoibqbZbtdjrdoZsX53jPAJVpNqODcuHcOu%2FwbcTGmgZVYHi6WhcL8E01EvP%2BZlAyZ1uT9QeOL%2BPXEXJuAm01IV9z9BpitrUYxrte0mIGRcRPVufs%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 884a22dffc8b1c79-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-md7fl
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 706 B	30ms 9ms	XHR application/json	37.252.171.21 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:14 GMT an-x-request-uuid 93afecfe-fe1a-4714-8509-5e758e9c7154 server nginx/1.23.4 accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com cache-control no-store, no-cache, private access-control-allow-credentials true x-proxy-origin 45.141.152.72; 45.141.152.72; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com content-length 11 x-xss-protection 0 expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 199 B	107ms 99ms	XHR text/html	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.recordedfuture.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 345 B	100ms 30ms	XHR text/html	2a02:26f0:2100::58dd:c530 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:2100::58dd:c530 Munich, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 9afc67691749451c5fc73c4f1f0964d8937508b7446a9133ea6ebf731e7bd520 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:15 GMT vary Origin content-type text/html access-control-allow-origin https://www.recordedfuture.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:20:3d00:1011:89bb:cb2e:b5a1 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715849594951_1490928940_206016821_27_1002_17_49_219";dur=1 content-length 36 expires Thu, 16 May 2024 08:53:15 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 259 B	182ms 174ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:15 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:15 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 259 B	181ms 173ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:15 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:15 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 259 B	173ms 173ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3d00%3A1011%3A89bb%3Acb2e%3Ab5a1%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:15 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:15 GMT
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 929 B	152ms 128ms	Image image/gif	2606:4700::6813:afbc CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id dc5f6a4a-f6e2-434b-8c24-67fa26a14a2d x-envoy-upstream-service-time 11 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id dc5f6a4a-f6e2-434b-8c24-67fa26a14a2d last-modified Thu, 16 May 2024 08:53:15 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-md7fl access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 884a22e10db571ca-FRA
GET H2	200	details Show response epsilon.6sense.com/v3/company/	745 B 725 B	28ms 14ms	XHR application/json	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash 4160094e8e7a55a3dd60c62de930a81375ddce09c11dc6d7b28332da6dbbdf14 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 X-6s-CustomID WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers x-trace-id 6069439228984541499 date Thu, 16 May 2024 08:53:15 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 399
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	32ms 10ms	Preflight	13.248.142.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.248.142.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ac3ff6aafb2cddae2.awsglobalaccelerator.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.recordedfuture.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Thu, 16 May 2024 08:53:15 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 138692088240644257
GET H3	200	nc-f84ee836e67184b6d958de715ad95301.js Show response dev.visualwebsiteoptimizer.com/edrv/	9 KB 3 KB	9ms 8ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/nc-f84ee836e67184b6d958de715ad95301.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 738ca50d93493d56ab3c05ffbfc6c9524677f30afa891c41ff014f3f3787ea51 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT content-encoding br via 1.1 google last-modified Wed, 15 May 2024 13:24:34 GMT server gfra1 etag "6644b792-c29" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3113
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	162ms 133ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715849595193&vi=e4520d0ae8fd18730a683d4d8d80e14e&nc=true&u=57501621.e4520d0ae8fd18730a683d4d8d80e14e.1715849595189.1715849595189.1715849595189.1&b=57501621.1.1715849595189&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 84e06609-2336-4a1a-b9f3-5cc87bd16b38 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 84e06609-2336-4a1a-b9f3-5cc87bd16b38 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlSlbaoEVty5%2BJHhkpjwu%2Bgt5l%2FotwL8tO5rf66ErssVgrZcZ3uiH8OFrVujPa%2BBHHSa17ImwhhG0x7TjsVVx9xvQtIvA0p1P6ZNHzpZuoAUqVrYYzGmBvO6tP5%2B4pO22iYy1Sp2aGqk0yTUb8%2BJ"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-wmbn8 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 884a22e238869f2e-FRA x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 745 B	165ms 136ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?id=vwo_Campaign-12_Variation-2&value=null&k=3&n=vwo_Campaign-12_Variation-2&m=&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715849595195&vi=e4520d0ae8fd18730a683d4d8d80e14e&nc=true&u=57501621.e4520d0ae8fd18730a683d4d8d80e14e.1715849595189.1715849595189.1715849595189.1&b=57501621.1.1715849595189&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 35397222-e0c0-4c68-a15f-c50060a6a733 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 35397222-e0c0-4c68-a15f-c50060a6a733 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UblzMFFI3A2zIvvf92UnA5D1kXlnbiz%2FpkyyRUUvsllL%2BAY4EkR6MGEjAsk18AvAvvEAMDf%2Fu1kq4PS%2BsqTRlRWPrjtj0qRcWCTLfjtt7GIixiDs2C2sFS5sdbUnl2hrBTtpQJZ60TluYgisXv9u"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-zw6hg x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 884a22e238839f2e-FRA x-robots-tag none
GET H2	200	favicon.ico www.recordedfuture.com/	17 KB 907 B	456ms 455ms	Other image/x-icon	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17cfec1dc174486013e525a0b2c5d7e2-1b416635dae6aaa7-01 x-cache MISS content-length 676 x-served-by cache-fra-eddf8230025-FRA last-modified Thu, 16 May 2024 07:23:18 GMT server cloudflare etag W/"423e-18f8048ae70" vary Accept-Encoding content-type image/x-icon cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 884a22e20fa65b92-FRA x-cache-hits 0
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	98ms 98ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=c14b4bd14&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 16 May 2024 08:53:14 GMT content-encoding gzip via 1.1 google server gnv1c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	96ms 96ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=c14b4bd14&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infr Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/gitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 16 May 2024 08:53:15 GMT content-encoding gzip via 1.1 google server gnv1c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	2 KB 2 KB	146ms 136ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=e4520d0ae8fd18730a683d4d8d80e14e&__hstc=57501621.e4520d0ae8fd18730a683d4d8d80e14e.1715849595189.1715849595189.1715849595189.1&__hssc=57501621.1.1715849595189&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d933d89eee191a5a57743742961c05ef1069d1948b97864e04d51565a5d4560 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 57d23a4f-95c9-4c69-841d-76def70ecd4b content-encoding br x-envoy-upstream-service-time 22 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 57d23a4f-95c9-4c69-841d-76def70ecd4b server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-9fd6b4b-qhrwc access-control-max-age 180 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dRQGhr0eGOsWCuq5JmRPjXlOEombr1YYT2%2FeQAHxJmxZs5QBZFRPIW0Q6KbDdJx%2F%2FYH3YsC56bcury5NCL4g8gkwoGUCH4PvrpUVUIkN3L5sdZgF1qx8CVlxQ7kaWGuH3PKeeDvv8Bjy2e6QU7n%2F"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 884a22e29f5d1c79-FRA
GET H2	200	__ptq.gif track.hubspot.com/	45 B 439 B	128ms 128ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=2492303821&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&t=GitCaught%3A+Threat+Actor+Leverages+GitHub+Repository+for+Malicious+Infrastructure+%7C+Recorded+Future&cts=1715849595430&vi=e4520d0ae8fd18730a683d4d8d80e14e&nc=true&u=57501621.e4520d0ae8fd18730a683d4d8d80e14e.1715849595189.1715849595189.1715849595189.1&b=57501621.1.1715849595189&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 08:53:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 47317328-8995-4368-8d37-35dfd4374cbf p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 7 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 47317328-8995-4368-8d37-35dfd4374cbf server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GhZqjXqevAkQ93j24nI8kuJinm%2FuYYb0Hs7V7sa9M5kAMF6FYRQzjOJQAuXQfzoB8BiPAsHfflAcLXoZJ2xZz2KwUz7DjCgY4WUs1Pkd3Ff%2BM4V4Cse%2FR4ytJV5vUp0hB19OFki0YyzPTyk803S8"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-76d96f8b5d-9kkj8 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 884a22e37a629f2e-FRA x-robots-tag none
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 260 B	175ms 175ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A14%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:16 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:16 GMT
GET H3	200	iphone-cd1.jpg go.recordedfuture.com/hubfs/	83 KB 85 KB	139ms 61ms	Image image/webp	2606:2c40::c73c:67fe CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://go.recordedfuture.com/hubfs/iphone-cd1.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:2c40::c73c:67fe , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy upgrade-insecure-requests x-amz-meta-cache-tag F-99167145604,P-252628,FLS-ALL age 369740 x-amz-request-id AVGWXW71JXM0V1TG x-amz-server-side-encryption AES256 edge-cache-tag F-99167145604,P-252628,FLS-ALL x-amz-replication-status COMPLETED content-disposition inline; filename="iphone-cd1.webp" x-hs-cf-lambda us-east-1.EnforceAclForReads 3 cf-bgj imgq:85,h2pri etag "f5c3d1b581a50e5c3637310137a43f0e" vary Accept, Accept-Encoding access-control-allow-methods GET content-type image/webp access-control-allow-origin * x-amz-meta-created-unix-time-millis 1674144065940 cache-control s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 x-robots-tag all x-hs-cf-lambda-enforce us-east-1.EnforceAclForReads 3 date Thu, 16 May 2024 08:53:16 GMT strict-transport-security max-age=31536000 via 1.1 134eef7df83fe066fda8a86e722c33dc.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-amz-version-id CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx x-amz-cf-pop FRA60-P7 x-hs-alternate-content-type text/plain cf-polished qual=85, origFmt=jpeg, origSize=229013 x-cache Miss from cloudfront cache-tag F-99167145604,P-252628,FLS-ALL x-amz-meta-index-tag all x-amz-storage-class INTELLIGENT_TIERING alt-svc h3=":443"; ma=86400 content-length 85082 x-amz-id-2 J2vhj35HE2U9GDM4Ro40FR5NqSgJ0ph28YMxkI5kQHCzZUGIfLltdY0AY6kIzyqtLxeFErNhRywr02kwIt/HHEbVxFhw3xzv0GERJVsegbQ= last-modified Thu, 19 Jan 2023 16:01:07 GMT server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ROQ0CsyL8Tx0%2FfYQ8LO3FFRF%2FHFynwBgvWagP3AgggvWndySOxPQ78R%2F9ljlL3Eiz0c1%2BnsO2bJrlpiQkSrAk0KgKh3uCcLDx4%2BhnhwTfSKbbyNCNYeIdzESZrqOcrAHkwv0nLZlyRJiuMHgm77KfNmZg%3D%3D"}],"group":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 884a22ea3b231907-FRA timing-allow-origin d8fk70yj6xfhx.cloudfront.net x-amz-cf-id oivebh8r0OGxg2Z_Ocf4MKsxLYNLdX59ylRQhSDlewukpCxkbLiZEQ==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 259 B	174ms 173ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:17 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:17 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 260 B	173ms 173ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=ni%3AmapCookie&q=%7B%22thirdPartyValues%22%3A%22%5B%7B%5C%22map%5C%22%3A%5C%22Hubspot%5C%22%2C%5C%22cookieName%5C%22%3A%5C%22hubspotutk%5C%22%2C%5C%22cookieValue%5C%22%3A%5C%22e4520d0ae8fd18730a683d4d8d80e14e%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:17 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:17 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 260 B	174ms 174ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:18 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:18 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 260 B	175ms 175ms	Image image/gif	184.50.114.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.50.114.24 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-50-114-24.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.recordedfuture.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 16 May 2024 08:53:19 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 16 May 2024 08:53:19 GMT
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=4c8361e2-0430-4b50-8152-5e334d5a213c&session=842c87dd-4647-480e-8732-5ede92cd6347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2016%20May%202024%2008%3A53%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Russian-speaking%20hackers%20leverage%20GitHub%20to%20host%20malware%20disguised%20as%20legitimate%20software.%20Explore%20the%20campaign%2C%20implications%2C%20and%20protection%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22GitCaught%3A%20Threat%20Actor%20Leverages%20GitHub%20Repository%20for%20Malicious%20Infrastructure%20%7C%20Recorded%20Future%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fgitcaught-threat-actor-leverages-github-repository-for-malicious-infrastructure&pageViewId=055df538-a4e6-4a30-8d43-1f48df7f61b7&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.20