URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Submission: On February 21 via api from DE — Scanned from DE

Summary

This website contacted 56 IPs in 5 countries across 40 domains to perform 163 HTTP transactions. The main IP is 2606:2c40::c73c:67e1, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reversinglabs.com.
TLS certificate: Issued by GTS CA 1P5 on January 17th 2024. Valid for: 3 months.
This is the only time www.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
25 2606:2c40::c7... 209242 (CLOUDFLAR...)
2 151.101.129.181 54113 (FASTLY)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700:440... 13335 (CLOUDFLAR...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 18.172.103.101 16509 (AMAZON-02)
1 3.162.38.9 16509 (AMAZON-02)
10 2a00:1450:400... 15169 (GOOGLE)
4 2a03:2880:f08... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f17... 32934 (FACEBOOK)
2 2a04:4e42::396 54113 (FASTLY)
1 162.159.152.17 13335 (CLOUDFLAR...)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
1 18.169.22.210 16509 (AMAZON-02)
2 2600:9000:26d... 16509 (AMAZON-02)
3 18.194.13.162 16509 (AMAZON-02)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 52.205.58.74 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
2 18.173.154.87 16509 (AMAZON-02)
1 151.101.65.140 54113 (FASTLY)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
12 2a00:1450:400... 15169 (GOOGLE)
4 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:2800:234... 15133 (EDGECAST)
1 13.107.42.14 8068 (MICROSOFT...)
10 2a00:1450:400... 15169 (GOOGLE)
2 35.160.37.98 16509 (AMAZON-02)
1 35.166.97.53 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
2 7 2606:4700::68... 13335 (CLOUDFLAR...)
10 2.16.100.40 20940 (AKAMAI-ASN1)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.244.42.200 13414 (TWITTER)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
9 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3.33.220.150 16509 (AMAZON-02)
163 56
Apex Domain
Subdomains
Transfer
25 reversinglabs.com
www.reversinglabs.com
923 KB
21 gstatic.com
fonts.gstatic.com
www.gstatic.com
867 KB
13 google.com
google.com — Cisco Umbrella Rank: 1
region1.analytics.google.com — Cisco Umbrella Rank: 2707
www.google.com — Cisco Umbrella Rank: 2
111 KB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5416
c.6sc.co — Cisco Umbrella Rank: 8324
ipv6.6sc.co — Cisco Umbrella Rank: 5568
b.6sc.co — Cisco Umbrella Rank: 3635
22 KB
10 hubspot.com
js.hubspot.com — Cisco Umbrella Rank: 4538
app.hubspot.com — Cisco Umbrella Rank: 5489
cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 4459
track.hubspot.com — Cisco Umbrella Rank: 2372
forms.hubspot.com — Cisco Umbrella Rank: 5253
static.hubspot.com — Cisco Umbrella Rank: 21685
40 KB
10 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
309 KB
7 linkedin.com
platform.linkedin.com — Cisco Umbrella Rank: 3508
px.ads.linkedin.com — Cisco Umbrella Rank: 362
www.linkedin.com — Cisco Umbrella Rank: 631
px4.ads.linkedin.com — Cisco Umbrella Rank: 6425
164 KB
6 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 233
51 KB
5 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 4301
forms-na1.hsforms.com — Cisco Umbrella Rank: 6907
perf-na1.hsforms.com — Cisco Umbrella Rank: 4877
5 KB
5 hubspotusercontent-na1.net
3375217.fs1.hubspotusercontent-na1.net
145 KB
4 metadata.io
cdn.metadata.io — Cisco Umbrella Rank: 7910
api-gw.metadata.io — Cisco Umbrella Rank: 20994
4 KB
4 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
157 KB
4 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 5583
13 KB
3 twitter.com
platform.twitter.com — Cisco Umbrella Rank: 1276
syndication.twitter.com — Cisco Umbrella Rank: 1627
132 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6575
670 B
3 snitcher.com
snid.snitcher.com — Cisco Umbrella Rank: 91272
25 KB
3 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 35
stats.g.doubleclick.net — Cisco Umbrella Rank: 86
4 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 712
script.hotjar.com — Cisco Umbrella Rank: 944
62 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4510
forms.hscollectedforms.net — Cisco Umbrella Rank: 4634
26 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 5398
q.quora.com — Cisco Umbrella Rank: 4149
15 KB
2 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1206
10 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 103
216 B
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28
2 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1525
insight.adsrvr.org — Cisco Umbrella Rank: 598
3 KB
2 vidyard.com
play.vidyard.com — Cisco Umbrella Rank: 12018
45 KB
1 hs-sites.com
3375217.hs-sites.com
6 KB
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3428
1 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 5018
88 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 3140
4 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2217
23 KB
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 4783
25 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2213
21 KB
1 usbrowserspeed.com
a.usbrowserspeed.com — Cisco Umbrella Rank: 2890
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4426
2 KB
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1385
637 B
1 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 8271
2 KB
1 anura.io
script.anura.io — Cisco Umbrella Rank: 54544
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 800
16 KB
1 cookieinfoscript.com
cookieinfoscript.com — Cisco Umbrella Rank: 104513
4 KB
1 hubspot.net
cdn2.hubspot.net — Cisco Umbrella Rank: 8330
2 KB
163 40
Domain Requested by
25 www.reversinglabs.com www.reversinglabs.com
js.usemessages.com
12 fonts.gstatic.com fonts.googleapis.com
www.google.com
www.reversinglabs.com
10 www.google.com www.reversinglabs.com
www.gstatic.com
www.google.com
10 www.googletagmanager.com www.reversinglabs.com
www.googletagmanager.com
js.hsadspixel.net
9 www.gstatic.com www.google.com
www.gstatic.com
8 b.6sc.co www.reversinglabs.com
6 cdnjs.cloudflare.com www.reversinglabs.com
5 3375217.fs1.hubspotusercontent-na1.net www.reversinglabs.com
3375217.hs-sites.com
4 px.ads.linkedin.com 3 redirects snap.licdn.com
4 connect.facebook.net www.reversinglabs.com
connect.facebook.net
4 static.hsappstatic.net www.reversinglabs.com
3375217.hs-sites.com
3 track.hubspot.com
3 www.google.de www.reversinglabs.com
3 snid.snitcher.com www.reversinglabs.com
snid.snitcher.com
2 perf-na1.hsforms.com www.reversinglabs.com
2 forms.hsforms.com www.reversinglabs.com
2 cta-service-cms2.hubspot.com 1 redirects js.hubspot.com
2 js.hubspot.com www.reversinglabs.com
3375217.hs-sites.com
2 api-gw.metadata.io cdn.metadata.io
2 platform.twitter.com www.reversinglabs.com
platform.twitter.com
2 script.hotjar.com static.hotjar.com
script.hotjar.com
2 google.com www.googletagmanager.com
2 cdn.metadata.io www.reversinglabs.com
2 googleads.g.doubleclick.net www.googletagmanager.com
2 www.redditstatic.com www.googletagmanager.com
www.redditstatic.com
2 www.facebook.com www.reversinglabs.com
2 fonts.googleapis.com www.reversinglabs.com
2 play.vidyard.com www.reversinglabs.com
1 static.hubspot.com 1 redirects
1 forms.hubspot.com js.hsleadflows.net
1 insight.adsrvr.org js.adsrvr.org
1 3375217.hs-sites.com js.hubspot.com
1 forms-na1.hsforms.com www.reversinglabs.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 syndication.twitter.com platform.twitter.com
1 forms.hscollectedforms.net js.hscollectedforms.net
1 api.hubapi.com js.hsadspixel.net
1 j.6sc.co www.reversinglabs.com
1 app.hubspot.com www.reversinglabs.com
1 js.hsleadflows.net www.reversinglabs.com
1 js.hsadspixel.net www.reversinglabs.com
1 js.hscollectedforms.net www.reversinglabs.com
1 js.hs-banner.com www.reversinglabs.com
1 js.usemessages.com www.reversinglabs.com
1 js.hs-analytics.net www.reversinglabs.com
1 a.usbrowserspeed.com cdn.metadata.io
1 px4.ads.linkedin.com www.reversinglabs.com
1 www.linkedin.com 1 redirects
1 ws.zoominfo.com www.reversinglabs.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 alb.reddit.com www.reversinglabs.com
1 q.quora.com www.reversinglabs.com
1 tracking.g2crowd.com www.reversinglabs.com
1 script.anura.io www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 a.quora.com www.googletagmanager.com
1 static.hotjar.com www.reversinglabs.com
1 js.adsrvr.org www.reversinglabs.com
1 cookieinfoscript.com www.reversinglabs.com
1 cdn2.hubspot.net www.reversinglabs.com
1 platform.linkedin.com www.reversinglabs.com
163 63
Subject Issuer Validity Valid
www.reversinglabs.com
GTS CA 1P5
2024-01-17 -
2024-04-16
3 months crt.sh
*.vidyard.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-01 -
2024-08-01
a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA
2023-05-17 -
2024-05-16
a year crt.sh
hubspot.net
Cloudflare Inc ECC CA-3
2023-04-06 -
2024-04-05
a year crt.sh
hubspotusercontent-na1.net
Cloudflare Inc ECC CA-3
2023-12-26 -
2024-12-25
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3
2023-04-10 -
2024-04-09
a year crt.sh
cookieinfoscript.com
E1
2024-02-05 -
2024-05-05
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
*.hotjar.com
Amazon ECDSA 256 M03
2024-02-07 -
2025-03-08
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-11-30 -
2024-02-28
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-01-08 -
2024-07-06
6 months crt.sh
quora.com
R3
2024-01-07 -
2024-04-06
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
script.anura.io
Amazon RSA 2048 M02
2023-10-16 -
2024-11-13
a year crt.sh
*.metadata.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-12-29 -
2025-01-28
a year crt.sh
snid.snitcher.com
Amazon RSA 2048 M01
2023-08-18 -
2024-09-14
a year crt.sh
*.quora.com
R3
2023-12-17 -
2024-03-16
3 months crt.sh
*.google.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2024-01-15 -
2024-07-13
6 months crt.sh
www.google.de
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-01-30 -
2024-07-30
6 months crt.sh
zoominfo.com
E1
2024-02-20 -
2024-05-20
3 months crt.sh
*.twimg.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-28 -
2024-07-26
a year crt.sh
www.google.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
a.usbrowserspeed.com
Amazon RSA 2048 M02
2024-01-01 -
2025-01-29
a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2024-01-06 -
2024-12-31
a year crt.sh
6sc.co
R3
2024-01-29 -
2024-04-28
3 months crt.sh
hubapi.com
Cloudflare Inc ECC CA-3
2023-04-07 -
2024-04-06
a year crt.sh
syndication.twitter.com
R3
2023-12-06 -
2024-03-05
3 months crt.sh
hs-sites.com
Cloudflare Inc ECC CA-3
2024-02-14 -
2024-12-31
a year crt.sh

This page contains 6 frames:

Primary Page: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Frame ID: 1D4CB12FEDBC8C44EAA0D452BD2386B2
Requests: 134 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Frame ID: 7A36833CA523EF99C23F7EC599DAC6D5
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Frame ID: 83BEB2608749883DBE770DF772290DDC
Requests: 8 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Frame ID: 94FFE6F2DFF04290A4125FF61CF69D5F
Requests: 12 HTTP requests in this frame

Frame: https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Frame ID: 6D2818ED2F7182E0973F4E740C5DCDB2
Requests: 5 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&upid=8t4axvj&upv=1.1.0
Frame ID: FFDEFC7D60EB7A0DC70C8F22BF50DC01
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Attackers leverage PyPI to sideload malicious DLLs

Detected technologies

Overall confidence: 75%
Detected patterns

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js

Overall confidence: 100%
Detected patterns
  • //platform\.linkedin\.com/in\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

163
Requests

99 %
HTTPS

73 %
IPv6

40
Domains

63
Subdomains

56
IPs

5
Countries

3323 kB
Transfer

7779 kB
Size

37
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 84
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1708530099560%26li_adsId%3D795c525c-26bd-4679-bd42-b6efe501db6d%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%252Fblog%252Fattackers-leverage-pypi-to-sideload-malicious-dlls%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQID-5-2wmJFqwAAAY3MVGejeFtY5NTEWp075Kjrp_MdBBR6VUkYX8KdTHuCEHwCpJAh-1ijCPiz-ZhVbpsgy4Sdo7LAaw
Request Chain 160
  • https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=299104568595&containerType=SLIDE_IN&portalId=3375217&audienceId=46604739&campaignId=e339ca4a-4aaf-4a94-bbb9-2728fc693c6c&isLoaded=true&pageUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageTitle=Attackers+leverage+PyPI+to+sideload+malicious+DLLs&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F122.0.6261.57+Safari%2F537.36&hutk=980189b068f771889038909e0ed6490c&hssc=60854195.1.1708530100424&hstc=60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1&pageId=157537033740&analyticsPageId=157537033740&hsfp=696607268&canonicalUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&contentType=blog-post HTTP 307
  • https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
  • https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

163 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request attackers-leverage-pypi-to-sideload-malicious-dlls
www.reversinglabs.com/blog/
99 KB
22 KB
Document
General
Full URL
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9b683e35080765c2e29e6c8211dbaed29cd4755f4f9aea898a0a1940e101437
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-ray
8590183e6d0b5d8a-FRA
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 21 Feb 2024 15:41:39 GMT
edge-cache-tag
CT-157537033740,CG-3375217,CG-5901382633,P-3375217,L-137874121636,L-151291886696,CW-103636562700,CW-10782554896,CW-137935116631,CW-140969871649,CW-144803306068,CW-149435964191,CW-151292754277,CW-151549639208,CW-151597054095,CW-151597569943,CW-151597570095,CW-151597990913,CW-154010290546,CW-23776629869,CW-23799638916,CW-79001037452,CW-87757605656,E-11708570900,E-137900387987,E-139051314810,E-5951651806,PGS-ALL,SW-1,B-112999115134,B-5901382633,B-70179327783,B-94488163452,GC-103819429689,GC-139369207705,GC-140831756371,GC-151549770891,GC-151595222825,GC-151597570069,GC-151597990813,GC-151607465033,GC-154018987956,GC-25875947801,GC-87768577627
etag
W/"7d96bf9e92fd53ddae039f473e415ac9"
last-modified
Wed, 21 Feb 2024 14:34:16 GMT
link
</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy
no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BNpVC4wbbwthk%2FhtrzxExeUrk%2FASFz2OKGE8u2cuxlpgnC10%2Fun%2Fch478WI0jfiLPyEwtzDNNkBygR1wb%2BOI0tbMYdYoxprjJxBhhD7JvRqkN%2BSGsbxVNtUyEyn6jsV63XZZS7uNUb%2BinOjTfs5Vs2UCoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
deny
x-hs-cache-config
BrowserCache-5s-EdgeCache-0s
x-hs-cache-control
s-maxage=60, max-age=0
x-hs-cf-cache-status
REVALIDATED
x-hs-content-id
157537033740
x-hs-hub-id
3375217
x-hs-prerendered
two-phase;Wed, 21 Feb 2024 14:34:15 GMT
x-xss-protection
1
project.js
www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/
1 KB
1 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
7208019
x-amz-cf-pop
FRA56-P2
x-amz-server-side-encryption
AES256
x-amz-version-id
P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 09 Nov 2021 16:12:42 GMT
server
cloudflare
etag
W/"61ca66de658cab9587e4636894680d5d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Poq3Ugl0kDsv9n6Z9P6MSBfTu%2BVIEXsOQhVa6qNik%2FiwtpaGPq%2FCYsKmoUYiUGqt%2FWjorcNIaF3K6XIgiBZFmESeSUxGWMMiGAVllyttYNHD7LeiI%2F%2BCWUokR6CY0nXaGRb0tzId7ZrxquV6%2BA80ZsNA4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
8590183fee865d8a-FRA
x-amz-cf-id
vMxH2clCDRRjd7emHmifSLXhLc2TFOGFc0VsUqlcTSiVQmWY_1aUGQ==
expires
Thu, 20 Feb 2025 15:41:39 GMT
v2.js
www.reversinglabs.com/_hcms/forms/
481 KB
160 KB
Script
General
Full URL
https://www.reversinglabs.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c96ffd41ebeae752a5c45a0ef1f924dd5273c09f71453d4d158e54d8610e64b8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
218
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.4733/bundles/project-v2.js&cfRay=859012f087825d8a-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"99ad0d559dd43412bf3f831615c5b73b"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.4733/bundles/project-v2.js
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 76e55a2361219fb19722e949475d1844.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-amz-version-id
QAh2zQyNIaVN4nLxtOyq9RabbRMRGI_g
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
19c7f413-6fc9-48f1-b5d4-ae6d67cc47e5
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
19c7f413-6fc9-48f1-b5d4-ae6d67cc47e5
last-modified
Wed, 21 Feb 2024 09:29:57 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rYeeI8QcfptRf%2FctXeoaUgvknNYT48K3T%2BpP9mHIm4KV2ciB5zYzkdCB4og615Amne8JIKiWautkmIOZntHOgQ%2BlVL1EVP8x7kpoNh%2BddFBjkiHduHv9pVGQYny1iRMQ8XI9RN2Ege5Ai3Za03sPh6z8dA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-hcbth
cf-ray
8590183fee875d8a-FRA
x-amz-cf-id
kUMvg0lEmOgROtb8KY02bRXScCQsZDhn-lZwMX4y76Ye8e0j4q3kcw==
tag-list.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1704219240190/Redesign_2023/css/blog/
679 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1704219240190/Redesign_2023/css/blog/tag-list.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6767c2fe6d7e1ad86580596bf56802fe8bdd92698be3ae701f5f9d440aa1339f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
212
x-amz-request-id
RJP5AAR0G546GRM0
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"e2fa49efde00550874fc59a5334066f9"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1704219240879
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
m2JlYhkcTT5eJjT5qHpTHCGbuM7xJSYv
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
795a8790-8ead-409f-ae23-1336d439d949
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
225
alt-svc
h3=":443"; ma=86400
x-amz-id-2
mFIgsN+Zf3K8ez0lNDnMlgNYl+KlOXM8kDFERZAOweiLMcmEsBIgRnf9rvTSGoEMfKYmO65IvB0=
x-evy-trace-route-configuration
listener_https/all
x-request-id
795a8790-8ead-409f-ae23-1336d439d949
last-modified
Tue, 02 Jan 2024 18:14:01 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vMtswpfedwwG0KY205VjrjLDS1g43M2H9jV5MZhEQqMNGCahXi6NCNvwb1sYvHzHuiM%2BKsp0TjKQhlj7M0v7ZQx9SSoR%2B%2BkWso45xzHDtlRzUmoewtR8y%2FvqE%2FcKphe1WU6YBqMoyahTr0PSL40UG7Xsww%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-9984fb9f6-g2j2f
access-control-allow-credentials
false
cf-ray
8590183fee8a5d8a-FRA
x-amz-cf-id
V3WYJbWv1Pn95Ev9PTNBW-AkKglApih0fY6p4fagfRT26wCUP8Olag==
module_103636562700_Footer_Categories_Text_-_global_-_stage.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1704221872335/
89 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1704221872335/module_103636562700_Footer_Categories_Text_-_global_-_stage.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
212
x-amz-request-id
MSF5QSB37KVQSQP1
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
PENDING
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"0e24424bd7a91e1adc940105ffcd26d9"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1704221872335
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
ZOZlbLZSyRAVjdWaJ.Pa_7VPoYKdfw72
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
335ce0fd-7d4f-4abf-8449-77ce4eaaacb8
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
213
alt-svc
h3=":443"; ma=86400
x-amz-id-2
R4AOMnRn9Tlwc6af24fYO+H/yzI9DqADUT7gFgHWABEQOuutZbu40ym0OU7KLt7w97Yp8zUfuiY=
x-evy-trace-route-configuration
listener_https/all
x-request-id
335ce0fd-7d4f-4abf-8449-77ce4eaaacb8
last-modified
Tue, 02 Jan 2024 18:57:53 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z%2FfrW9%2F1XlufRiXQIAFp3o3Nuh4rjfVyTzZbKH7DCoiBppaaRv3aeOrGuDqFXyhLFHE%2FK1AfB%2FzPNSWoZzroFNGNdxmtlzBHJqfPT28E5yrr4fVJoIpKsk%2B3lfltEMa%2FceEgyVzcaN0DnMifXsJ24OXSAg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-9984fb9f6-f4gp4
access-control-allow-credentials
false
cf-ray
8590183fee8c5d8a-FRA
x-amz-cf-id
iLICVsVFfVW_FoaqNouC7gPh--0573ds8lxT73OFFFv9DgqHwDIEiw==
module_87757605656_Footer_Categories_Blog_Listing_-_global_-_stage.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1704221991640/
83 B
1 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1704221991640/module_87757605656_Footer_Categories_Blog_Listing_-_global_-_stage.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
77af0a963d2016e3165d4e70050e60f0054e70ed0dba5ae5c2be14bcccbff207
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
212
x-amz-request-id
KPP9MKM689DCACT5
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"7a2a8d16729e44cc5588c37604841314"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1704221991640
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
JClTVOGSysB.wU8UI69LU_2ZN01jOavM
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
704eede4-26a4-43d9-a0c4-beef68b3a553
x-cache
Miss from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
259
alt-svc
h3=":443"; ma=86400
x-amz-id-2
8WnM24MIUgkBaQ1pNEUoO/SvjdFHfMINswFz2RdYWnEcNeWXZNo7k8ed8GUAdtahvyRis7ayXOY=
x-evy-trace-route-configuration
listener_https/all
x-request-id
704eede4-26a4-43d9-a0c4-beef68b3a553
last-modified
Tue, 02 Jan 2024 18:59:52 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ozX8TnxBSzfvnCiE7P%2F24FoVoD7fYIgVdWxEcquPVtjzaImewUOop45HPluc0k67vTU7nU7LgYE1Rcqn8CrOg%2BYe%2BI4mOqsyzSYPb0ApWDc28thEHHT226DS0slfiDfuTv6ICng9DMVX4XIqgTEExf4YRg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-9984fb9f6-l5wpd
access-control-allow-credentials
false
cf-ray
8590183fee8e5d8a-FRA
x-amz-cf-id
7FM0UH2EAmNIUxdC6OWyVto0hWbUdH7zjIkZSigzlOBOTcOJVti3HA==
v4.js
play.vidyard.com/embed/
70 KB
23 KB
Script
General
Full URL
https://play.vidyard.com/embed/v4.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.181 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e492e5bd630a86a679a9ead911fc5e1e155d75098344c375131c40470e97396d
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-cache-hits
46
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
via
1.1 varnish
strict-transport-security
max-age=31557600
age
27956
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
23031
x-served-by
cache-fra-eddf8230090-FRA
x-china
0
last-modified
Mon, 28 Aug 2023 17:07:01 GMT
etag
"d22850d6ed493dad3ff1a51479d730cc"
vary
X-China, accept-language, Accept-Encoding
content-type
application/javascript
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
in.js
platform.linkedin.com/
510 KB
160 KB
Script
General
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Play /
Resource Hash
128d180fa7acfd1ff703533b57f11a3bf2b4390c9e8cf5f3651ee11b1cc43205
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn-client-ip-version
IPV6
server
Play
x-li-pop
prod-ltx1-x
x-cdn
AKAM
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
x-li-fabric
prod-ltx1
cache-control
public, max-age=3600
x-li-proto
http/1.1
content-length
163631
x-li-uuid
AAYR5g6EPZ4v01rq2R/kew==
expires
Wed, 21 Feb 2024 16:34:03 GMT
layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1708457257733/hubspot/hubspot_default/shared/responsive/
4 KB
2 KB
Stylesheet
General
Full URL
https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1708457257733/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:6ed1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
age
72785
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"fda5882b24ca5a84d04d090722dc713b"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1708457258375
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-evy-trace-virtual-host
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
3ec0b419-fbe5-462e-85bc-2eb3fa4460ee
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
134
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
3ec0b419-fbe5-462e-85bc-2eb3fa4460ee
last-modified
Tue, 20 Feb 2024 19:27:39 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kioxljuz92plpz92YGJir0iBoi9s9ekysbpV8pOQY6n5m6TdJwdYfnwQcfT6YuSE8%2BEREPrSNLZLo%2FRbRd8M1b52m%2FCWA%2FBJcGMLt4G%2BytA4tdNKLY%2B0t8P8Q2rU%2Bru2S0U6xDoeq8uO281E3EU%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-cdn2-td/envoy-proxy-b79697d9-hfljm
cf-ray
8590183ffe813a82-FRA
RL-custom.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1699711648432/Reversinglabs_July2018_Theme/Coded_Files/
12 KB
4 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1699711648432/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a94e1fd7de26b8bd3e63fc666c3d79bbe010fcbc98732cd4c617f99d413b99d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
212
x-amz-request-id
HXAWHDHK476QZZ3D
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"327ad4cfa243a0ffb505777334db1866"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1699711649160
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
V_1_qqFbhp8w6nxvGZEJXB7hA5x_vW4m
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
77bbc47f-0ebf-44b7-a56e-69911824bed5
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
161
alt-svc
h3=":443"; ma=86400
x-amz-id-2
RkkkLQjHoUTD+bKdmw0D1z+7TkgGAudLzzwi1nG5mxikEwZP5/xkcNrG9V0R1Tje+3o3eeUMm/g=
x-evy-trace-route-configuration
listener_https/all
x-request-id
77bbc47f-0ebf-44b7-a56e-69911824bed5
last-modified
Sat, 11 Nov 2023 14:07:30 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yCH4TuAix6sz9OdkKBfyK6ZJjaTTz6YrcaTCBLDj50MBbIf0n0rcvAkin82DNWhZvHQWAx6FSPeyU4bmC5GbYo2SZJTgLUHZ%2F3OO5KMa%2B3pFYQ6AmeN0rvf0TxuNH7dzVWZWH0opef0d0aU4SLJgiA5dlw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-9984fb9f6-gqrq7
access-control-allow-credentials
false
cf-ray
8590183fee905d8a-FRA
x-amz-cf-id
UW2RZmH9YJKlYIRLou4VdOar-ADtFoDB7CxkzuVe0zz0M4ncuFZuNQ==
main.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/
68 KB
16 KB
Stylesheet
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ab4c8c55c27b0a3a2d019af3aff563e65aed515ac59352f9808c27212d33f6c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
212
x-amz-request-id
AMNP14ZZR3TEPFG3
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
PENDING
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"1be2491e780e1d2c2e48c7fa3ef8978f"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1707496332225
content-type
text/css
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 2c36186b512068f67b05531ba050ed00.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
jgGQeC.fDyk0ZAFQe_Qr01mYsdhItp1k
x-amz-cf-pop
IAD61-P1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
a714fb8c-72b8-4825-835c-8dfd3266d84a
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
168
alt-svc
h3=":443"; ma=86400
x-amz-id-2
xDjl8avY4/W51Il3AuCM3c2ok/XINJIZKX2tcwjEG/mSAQnLyavxXHNNDWqvhA3zLpdd93Wfl8E=
x-evy-trace-route-configuration
listener_https/all
x-request-id
a714fb8c-72b8-4825-835c-8dfd3266d84a
last-modified
Fri, 09 Feb 2024 16:32:13 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EQU3Doi3dAVRTCd%2BG4t6%2BQ5J79%2FGxqmK88RBhcm04H%2FpcKKFaWI63A3KxJr0DYOVumch7cPnoBVcOY1W59PBMGZ9ss8kY%2FXXKXgktwBLFwUWXb%2FfHrljFimSpzPRRHGKlF0M9rYqyMgQX22dBTCq9FOYPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-5c8495489f-xmkhz
access-control-allow-credentials
false
cf-ray
8590183fee925d8a-FRA
x-amz-cf-id
Zg2qKKtivl1-zT9ng78VPYVMFSavoZbKLFoKNLBCxCUdDDdx6Rz3Fw==
rl-logo-long.svg
www.reversinglabs.com/hubfs/RL%20Logo/
6 KB
3 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/RL%20Logo/rl-logo-long.svg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
da0183f97db8d8d2af9a74abfdf38270689dec5cc34c7b0ec229ba69e9bcc756
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
x-amz-meta-cache-tag
F-141442306568,FD-6244989567,P-3375217,FLS-ALL
age
569550
x-amz-request-id
MPWMXF1YPEX79M0R
x-amz-server-side-encryption
AES256
edge-cache-tag
F-141442306568,FD-6244989567,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
etag
W/"d4a2965692559440f150bd2f13f6e019"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1697983483504
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 01e7df96c01c9ecdb1cce1b6595ae260.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
Ny5kNhA6D3ymMFZxy2PPRX0g0w0iXW.D
x-amz-cf-pop
CDG53-C1
x-hs-alternate-content-type
text/plain
x-cache
Miss from cloudfront
cache-tag
F-141442306568,FD-6244989567,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
x-amz-id-2
uWAJZbs1217e95QSYNkwVAdLULNdj3UJ+GfRhILCCeBmnzn0eVyXlOxfwhsOf5g2bUm1gqHwR40=
last-modified
Sun, 22 Oct 2023 14:14:23 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oR28ELbI6%2BNmTKRWnoofKTLnx87kmA1YA16BnbQdntUeWDGB6hVeWGuSkhAQkFYobauD8FJ9KpBpIbx%2B7RZjZdRWgkqHl%2FZhgHZqfPaK3C%2F8yA00zsMgcn7FSuXJB2d8CVJr3YLZyvKYErKd4r9Ca76mbg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8590183fee935d8a-FRA
x-amz-cf-id
jkkmuLcr92crCmAbElXqFl1DJd2owGaUJWjtuAmQidNn8CkW5CId3g==
Petar-Kirhmajer.webp
www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/
21 KB
22 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/Petar-Kirhmajer.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed494b949fc8d336fd3202e09bf19a84014bfbae61c89993da76f2f35dd6eaae
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-157549400958,FD-8444884887,P-3375217,FLS-ALL
age
89325
x-amz-request-id
PMYKBXRXET51C8DA
x-amz-server-side-encryption
AES256
edge-cache-tag
F-157549400958,FD-8444884887,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
etag
"d164a1276176c0a7e539208f9e95d79e"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1708360972089
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
QWk_polpYI.wfa8ROLHVVP6Loam.seYI
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
cache-tag
F-157549400958,FD-8444884887,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
21322
x-amz-id-2
ushjXfhXAu5XwtDgoDdWaY5YubsZu2aJPjKt+lTTRYoOzvHHcYAsfEYl0IbHC8FJ2q+8e4TrurY=
last-modified
Mon, 19 Feb 2024 16:42:53 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YyJgZiz13nCJc91y7JFrVSt9F8CJoJhItkrdPrfrCuhtYT13p368pFbyzOs00imqhPH7csMrMpWns6r7sJ3%2BYU9g1Tci13GDdacRshqftpjKa3bX3a0k1ZCEHPnwm4K1uo4J%2BZC4C%2BJEAAtCeiM%2B8Y5cqg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
8590183fee945d8a-FRA
x-amz-cf-id
psKYXte0P8f4PKfYPSVGDb_WHU2_7h1j5n9jeO2HBqcrsDs0pexfJw==
pypi-blog-figure-1.webp
www.reversinglabs.com/hs-fs/hubfs/Blog/
39 KB
40 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/pypi-blog-figure-1.webp?width=1400&name=pypi-blog-figure-1.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3081dc10908da87863cf4f5b3e1bc6f7300b810364d337622f12773b24fc520e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-157541352788,FD-11822274822,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
40284
cf-resized
internal=ok/m q=0 n=838+0 c=7+56 v=2024.1.3 l=40284
last-modified
Mon, 19 Feb 2024 14:39:33 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfh-BetqKjN6tPTeqycVkNf8piG4ubIV2ePdeCXg6EDQ:5179960001bb9ab3d82b497dfca2d623"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FA2K%2B198u%2FCjcxJTZ%2BPOwSIkrBIW75v4W1j%2BTjVFzs7gN2Shcj8%2Brjq7Dqu5k9XjdY%2FuvIRkjlFG992IKZw7PVXvuLFpyEXkXBk2D1n%2FvVNOZvtl9w0fNeX%2FuRwU2MOxuHHrGJvAmG2EMx%2F30vNdGvLNVw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
859018404cdc8fe3-FRA
pypi-blog-figure-2.webp
www.reversinglabs.com/hs-fs/hubfs/Blog/
20 KB
20 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/pypi-blog-figure-2.webp?width=1400&name=pypi-blog-figure-2.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4042fa3e443281692f19c5b9e8238ab4b567a07fe5f30d6d706eaea65989f3f5
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 d76db2cbee553c8bb2de7fd88a960646.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-157541518851,FD-11822274822,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
19986
cf-resized
internal=ok/m q=0 n=833+0 c=3+0 v=2024.1.3 l=19986
last-modified
Mon, 19 Feb 2024 14:39:32 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cfpv-3xbs7b8PPwYEuoyL4vUO9G4ubIV2ePdeCXg6EDQ:cab4f387b7bbed8be40782e5a448ac23"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUN%2FveXLHv1xITzFiXUAx91fUZDzC8VaTF157Mky9kUeCX8L3D%2FBBB5jwLniTxnHQjOv6tWToy7zHvOzZzXq6Ed58wbR6GBX6l8WiFOTc4CNMV6HEivoVTEhSenaRKXZS6gsGWy1BjqDynJFTJA4rMbfFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
859018404cde8fe3-FRA
pypi-blog-figure-5.webp
www.reversinglabs.com/hs-fs/hubfs/Blog/
83 KB
83 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/pypi-blog-figure-5.webp?width=1400&name=pypi-blog-figure-5.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fef74616aa24738b68090a9710dc428553b2d3e01c97d04150477cfabed0dd44
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-157541386366,FD-11822274822,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
84622
cf-resized
internal=ok/m q=0 n=868+0 c=7+0 v=2024.1.3 l=84622
last-modified
Mon, 19 Feb 2024 14:39:32 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cfsipco8LhYMyBHO6kCHt2g6r2G4ubIV2ePdeCXg6EDQ:9433a119aa109dcb416bcd7b4c75f427"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n8QyvuVZIdhHMct7Ph2URQtouvioIIpi9c00n2Ghh2HcMH2c%2FqKZmtn79j7VcAagB2V63JtdKoRgSLgNi3soxlzJBJ%2Bx022uTpfe4dcPIFQnkjwgtt5hj1USsJGSJR4xZIpnxPZtlAC6Eshx7TTY6yWakw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
859018409d3f8fe3-FRA
pypi-blog-figure-6.webp
www.reversinglabs.com/hs-fs/hubfs/Blog/
11 KB
11 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/pypi-blog-figure-6.webp?width=1400&name=pypi-blog-figure-6.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8865a5cc2331c6d0d661017cde904dc6a19753c0ed178dbbcf104ac8c7df798
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-157541967239,FD-11822274822,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
10862
cf-resized
internal=ok/m q=0 n=574+0 c=2+15 v=2024.1.3 l=10862
last-modified
Mon, 19 Feb 2024 14:39:32 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfG6Ug3FeZfDBJlS-Ql71Fm45EG4ubIV2ePdeCXg6EDQ:0f965c20c6a48cfbe44e58699dee274d"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhQYsFUNFA1Q9PO3%2BvEZkm6uQ47PQiStvic%2FSxs2utut5pGmuN6QtEqBskJzLfs8B%2B%2FGNTLPOaGoFNOvuVP6jwDaogMAHScjwEg0YPcausUgxNdd%2FxTwyhQ69YwsfAsSMv1hobdKYVEUeUtvlkjbXpHlSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
85901840dd6c8fe3-FRA
cybersecurity-hero-culture.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/
13 KB
13 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/cybersecurity-hero-culture.jpg?width=480&name=cybersecurity-hero-culture.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2043672fcf923c51955997fd7bc3d3c01834d8677709f65968247f14304fa95a
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-157676731767,P-3375217,FLS-ALL
content-length
12908
cf-resized
internal=ok/m q=0 n=252+0 c=10+29 v=2024.1.3 l=12908
last-modified
Tue, 20 Feb 2024 15:44:08 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfnUGaVX-xFsA0MYqapmy2pdgfzQG3Dz_JuxJXtzypDQ:8af4e97df3652be4ee633c09ed556f1c"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
85901840f86d03b0-FRA
Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Blog/
28 KB
29 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/Blog/Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp?width=480&name=Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1de799ec3c2d3f26217fc03ca2596b6fb1a89565221360493de21ae75b91381
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-157540533551,FD-11822274822,P-3375217,FLS-ALL
content-length
28822
cf-resized
internal=ok/h q=0 n=38+0 c=14+45 v=2024.1.3 l=28822
last-modified
Mon, 19 Feb 2024 14:35:22 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cf9tB0PuQiNVDnlZH8XY6gJw73zQG3Dz_JuxJXtzypDQ:596a60c78eec9d1f930dfcb616c3ebf5"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
85901840f86e03b0-FRA
esg-supply-chain-security-study-complexity.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/
18 KB
18 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/esg-supply-chain-security-study-complexity.jpg?width=480&name=esg-supply-chain-security-study-complexity.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c4f34835286016b8c67a4b25c7219fc541baf2948124fe91dfbb354594ed2db
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 e2e847b082ff9d1bdd61dc9c27ca0786.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-157080446880,P-3375217,FLS-ALL
content-length
18040
cf-resized
internal=ok/h q=0 n=28+0 c=15+27 v=2024.1.3 l=18040
last-modified
Thu, 15 Feb 2024 17:21:51 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfBZEzj5ZNn_AsMR8hBbvlw9tHzQG3Dz_JuxJXtzypDQ:4bcbf59cbd68d4f64822ac353aac7770"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
85901840f86f03b0-FRA
SSCS-Report-2024.webp
www.reversinglabs.com/hubfs/images/
45 KB
46 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/images/SSCS-Report-2024.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7cfd62a134cdab910bf1fde5f6aee5b28bb00d29b020ddcb53fbd3d437043256
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-152712655442,FD-41794900664,P-3375217,FLS-ALL
age
534789
x-amz-request-id
4D7A2AN6QF7E9NMK
x-amz-server-side-encryption
AES256
edge-cache-tag
F-152712655442,FD-41794900664,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
etag
"7b754ec9dc936126046ce5ce3d7ca92f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1704982035707
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
Yn6XqCw8xwH.yxLDoBVTERKuw.ntdIYX
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
cache-tag
F-152712655442,FD-41794900664,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
46104
x-amz-id-2
ZYbpdPc2ibOOIqoaAcXdRIMdoXNDE+o/grPoumSTjNve5u2mctRlZsztbRmsGZChejzec5Fa8+A=
last-modified
Thu, 11 Jan 2024 14:07:16 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TD6O8ae9nvX17hcE4IZXyw1hizb8FCIIRYN9bzZXkqx3622tntg8R8RC8UJAmXIdxkPY0EzhGCkuYlf8mVo%2BfFccKuRQMMQzI32fyKhAdMt3ZgWfR06Ri9yaxRrVsXhMns5Vx11zj7VeYzGryndg1oHsGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
85901840dd6d8fe3-FRA
x-amz-cf-id
wc5650yxlKa0bAuhs3khFIRYiXtls38UKy9VczYep9GoWvqg9y_M7A==
ConversingLabs%20S5E5.jpg
www.reversinglabs.com/hubfs/ConversingLabs/
89 KB
90 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/ConversingLabs/ConversingLabs%20S5E5.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89f1a01bdefa7a1d5ce3632bf7ac23bd6c16ee252987e78320895ecc43a9e43d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-138170570617,FD-69168798251,P-3375217,FLS-ALL
age
271647
x-amz-request-id
XQEYMWPERHC79F40
x-amz-server-side-encryption
AES256
edge-cache-tag
F-138170570617,FD-69168798251,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="ConversingLabs%20S5E5.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
cf-bgj
imgq:85,h2pri
etag
"a432212e019e7d15103cb68bfaf2934e"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1696440206800
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
yV9HSVCqO3iyyFU7yLWeEURuNR.U07jv
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=272344
x-cache
RefreshHit from cloudfront
cache-tag
F-138170570617,FD-69168798251,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
91044
x-amz-id-2
fBtBjKqsddBc3W15uv9sAEayD1NXcQrpnXPTGJ5GqlCmSINZPcKLWDk6BqoXPfiNLY1tbuLOIWH08FlXrmQHsDVw+YP1UXDp
last-modified
Wed, 04 Oct 2023 17:23:27 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PxYlhlajANIpdC329%2BtVVMKSdbUBw1qpDiDY6Qmyscf%2BVMV5cC6TQ9imYLsrIzZ2QQ2%2FvgCKRgHs8%2F598nW7QD2qBa%2FmNQyues%2BatOf3rRY9PcKACjBmK7Ekh5DCZ8oTS%2BMuUqESwszWuxRH5qmm6OhxnA%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
85901840dd6f8fe3-FRA
x-amz-cf-id
Pw3jVfkASARkY9B75SL083ybANuv2WuuBjdpMN0CvtuoqqvkFyAfZA==
ReversingGlass%201400x732%20copy.jpg
www.reversinglabs.com/hubfs/
164 KB
165 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/ReversingGlass%201400x732%20copy.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dcebc5250019387a265ba565f3bb38b30024036bb64e04ae17f656ee40f7848
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-156980431269,P-3375217,FLS-ALL
age
271647
x-amz-request-id
ZHPBDQH56GJ9XAF3
x-amz-server-side-encryption
AES256
edge-cache-tag
F-156980431269,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="ReversingGlass%201400x732%20copy.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
cf-bgj
imgq:85,h2pri
etag
"f7efefd3f624ba381792f8ffd2fc29f5"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1707970386500
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
QaIIpZdiYLre0FXvvvU1xqPBxh2ifgu2
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=642453
x-cache
RefreshHit from cloudfront
cache-tag
F-156980431269,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
167778
x-amz-id-2
5hN7JMNuk9TQkPZwOez4ww/3ZOShXV+l9Kcnf2pTgSyOcgQm+fi2qtKt6IKmGQMZtQIPvoO2xuo=
last-modified
Thu, 15 Feb 2024 04:13:07 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w68DU1fAqeO%2FCgyZCHu1J4e7keZvelKpcD9aIxzS8gxMglj%2FFIu8PZRFzKyl3SbBe6ZTlKCXf3ol6cv4vRN0hld4fKSTbDAlr0PFaHJ1r0gO1SyXKQ8eMyq1J5pjlR6SICh5L%2Bsk6uSz9alJzDSMyp%2FvoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
85901840dd738fe3-FRA
x-amz-cf-id
d-QUz31qJOA8QF4acsmrAOs6yn2dUh1qsDnLLmFGC7NcwThMPY52zg==
Software-Package-Deconstruction-Zoom-1400x732%20%282%29.jpg
www.reversinglabs.com/hubfs/
99 KB
100 KB
Image
General
Full URL
https://www.reversinglabs.com/hubfs/Software-Package-Deconstruction-Zoom-1400x732%20%282%29.jpg
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
49ccd6ef67a5506a1c8ae4ca61d9bcc2d3fcd8b70dc6ce7ef7ee8977a49856ff
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
x-amz-meta-cache-tag
F-148136481853,P-3375217,FLS-ALL
age
523167
x-amz-request-id
2KH80N5B3975S1C1
x-amz-server-side-encryption
AES256
edge-cache-tag
F-148136481853,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="Software-Package-Deconstruction-Zoom-1400x732%20%282%29.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
cf-bgj
imgq:85,h2pri
etag
"e24b19bd64dceaf213f98abe5326d74f"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1701443562319
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 e93c671d969240be8a6839ba09d3b732.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
O76Eg2t7ulZM8aaGKlwykHV.LYd8SPRm
x-amz-cf-pop
TLV50-C2
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=386877
x-cache
RefreshHit from cloudfront
cache-tag
F-148136481853,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
alt-svc
h3=":443"; ma=86400
content-length
101148
x-amz-id-2
L5H5PLfPc/NZqle2zrCEPs95jw5fC75MBIAhN64cWcGUQgtbA6330P9bIdkhhsE071UPx00PGhg=
last-modified
Fri, 01 Dec 2023 15:12:43 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ednU1pBfKeobs4HawMDh4V%2Fc6onL%2BJ4Niuz70RcVRTDWhK%2FwacqVOQSwV3YGlY%2BNCQAmFusJ76qHDm3yH61hvYLFT8BPEuntgCktFq02oCxWplnoBJlsDTQNKX6vMPp7QvkYYdog21oxz93k%2BsqRGSOVAw%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
85901840dd758fe3-FRA
x-amz-cf-id
JzSa1_HnzeCbGBbTmq4Xtn95pA5hIIpzKdsh-1XOtj4dm7xwE2MN3w==
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/
85 KB
27 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
597594
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27437
last-modified
Sun, 07 Jan 2024 20:26:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"659afac8-6b2d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ViWTFqoRSXWmP%2F9aft0g70CVomnrq2XMeQ3VJ1sXv%2Fo0kJtFa6o4WyxJmE2VXVmjIfw%2FzXDYLL%2BOk9wiTgLFIHeHf%2F%2BaPKI6ST34eBTTXi4oXVR%2FM9bHy3xa5g5WGAMAtqIP%2F3PqZPWA0wVtA5fsk6N2"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840bc2092c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
js.cookie.min.js
cdnjs.cloudflare.com/ajax/libs/js-cookie/3.0.5/
2 KB
1 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/js-cookie/3.0.5/js.cookie.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
595945
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
740
last-modified
Sun, 07 Jan 2024 07:24:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"659a4380-2e4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=szAKK6BbFDp%2BRhl03NMUiR0SCsr3WDDPz%2F%2BTPl2eL7Pkq%2F1T%2F3Mq5yoOC7KtSI4iDfHmeIrGZNY35a1IrUuEWl%2BjjZnz%2B2auHnND7LQlCJwa1cCjJmrXtJbb8Li2c71tv%2F8Aqd3QzUxAViMsfcYR1XBu"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840dc2992c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
tiny-slider.css
cdnjs.cloudflare.com/ajax/libs/tiny-slider/2.9.4/
2 KB
919 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/tiny-slider/2.9.4/tiny-slider.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9b8906a8b7540b8accfd2a491c0821d6bd6d8ccbd4ab53a56da8906ff028423
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
6467986
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
573
last-modified
Tue, 26 Oct 2021 21:33:28 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"61787428-23d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tIXCk7SB7neoFCnrmE0VF953ZhO8c33%2BGNaDM3%2B%2BuLuwQJxLLYULuIf33%2FO4gwcAP8He7FLy%2FhdlKUTcRAgs4O6bBZmKGnjaRiq7vKQZnU%2FgGU5kJSRLmvGCEtgxUNb5Y1jdg4gqIl8FvVsLzNjdBVwT"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840dc2a92c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
tiny-slider.js
cdnjs.cloudflare.com/ajax/libs/tiny-slider/2.9.4/min/
31 KB
12 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/tiny-slider/2.9.4/min/tiny-slider.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46c40fb973de87b70f9c738df7e9dc501f85fda35e5aac8aead035ee6957a625
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
7932484
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
11445
last-modified
Tue, 26 Oct 2021 21:33:28 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"61787428-2cb5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=STkn0Yw7aRI9xpn8O6AsvejSGMRrdCEsuAH1xU3wn%2FSGq5UKffE6HbhYSWNtrGEa%2BBIMnmWuaY%2FX2NEVin8XAk2ELohD%2Bq5Ow1mLX9eiZobsTC6d%2BbJfzGihWJMyfWtligfC%2BNyEJKqteleEPNAnHHl7"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840dc2b92c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
simple-lightbox.jquery.min.js
cdnjs.cloudflare.com/ajax/libs/simplelightbox/2.14.2/
48 KB
9 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/simplelightbox/2.14.2/simple-lightbox.jquery.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1039d8c6d5ca0ae27a058e460a3496ac932a0ed7b21496e3a7be5063c605ac5a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4277933
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
8422
last-modified
Thu, 31 Aug 2023 21:00:58 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"64f0ff8a-20e6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NYH9bAOzUlwLYm983s0%2B72SHfHPGTuhvFV%2Boa0NtQKmuUm6tV48KNZ8trZMbtSdXat7g8kpAw6BnDwuk3a%2FksRSkfaPwDzwTvptnguHe%2FrAolKCCAnl%2FMDC4C%2FFUy0%2FCb%2Bf6dp0D2Mtb%2BetOkjHBafZw"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840dc2c92c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
simple-lightbox.min.css
cdnjs.cloudflare.com/ajax/libs/simplelightbox/2.14.2/
4 KB
1 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/simplelightbox/2.14.2/simple-lightbox.min.css
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afcb95431b4036fd54fe79de411493352c550220beb8328f459663da5bc1b552
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4389163
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
839
last-modified
Thu, 31 Aug 2023 21:00:58 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"64f0ff8a-347"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PgnPVdI3ihHQcxK58snWjy60%2BOsqd%2FV6tJV%2BIMyP3bzQIKLGQvb8E6vRQJWbU5Ff0O6Y3TLASxzA5oS250DfdogsDdlZ0n1U%2F7AhqmRAw6MHf8R%2B3J0WfG2yztF0emd29n0tHvz2ihW8qaKAb3Vcp3k9"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85901840dc2d92c6-FRA
expires
Mon, 10 Feb 2025 15:41:39 GMT
functions.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/139051314810/1707479630516/Redesign_2023/js/
15 KB
6 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/139051314810/1707479630516/Redesign_2023/js/functions.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1c6faa5c00cccc8c96c246f728a6dd9340a8ffc4146584259f9acf171b13775
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
178
x-amz-request-id
WX7C3NWHXK12H290
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
PENDING
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"c59e32ea945edd67a1d924aef7fde8d7"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1707479630770
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 6129f7f4feb0c02da809b6ee7e340b18.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
o.NwnkKt0F1HVn0orM1JXezA4qVcj68S
x-amz-cf-pop
IAD61-P1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
5c66c611-4ef9-4bc6-bf9b-fcd8c35ea3a4
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
139
alt-svc
h3=":443"; ma=86400
x-amz-id-2
D0RoJrNOIa2Eqp4aK7+HPFLf6Xr0ndZRKTzERJVq6aF06mRgdoKUlZa5wCjow/QWiSvl76kOiZw=
x-evy-trace-route-configuration
listener_https/all
x-request-id
5c66c611-4ef9-4bc6-bf9b-fcd8c35ea3a4
last-modified
Fri, 09 Feb 2024 11:53:51 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jdYh67bZXwykwaGSdFGkezT3Z%2FFpRiDFr1Zcxi8yREGMUSYQ94cRt8C%2FJlIRpDcrx4%2F5ZbGta4K7DgMPRNzPR1OkycYFKyHRez%2F1QFydMpm73ur2yKK%2B8kU70ECyEGQgHGuspzfQcc6pcxW0Wb55w%2FdH6w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-5c8495489f-wvfbh
access-control-allow-credentials
false
cf-ray
85901840dd698fe3-FRA
x-amz-cf-id
Em9DolIm2T0_nZoRXbU26ahOBkMcWMlpOdsVx6TXRE6Z2R7R9Yboxw==
embed.js
static.hsappstatic.net/content-cwv-embed/static-1.388/
14 KB
6 KB
Script
General
Full URL
https://static.hsappstatic.net/content-cwv-embed/static-1.388/embed.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34942d531ecf961a2a6777526aef0c7d17f28a4ce9afcac868eb132c700bfe5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
GNgANes_HpxlXMl5IDFfVeYnBgfaeeYN
via
1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA60-P6
age
1590219
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 15 Aug 2023 19:48:57 GMT
server
cloudflare
etag
W/"8741985292d64b839be39c64b14f3783"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C8%2BJnObcc3HQcGUthXGcEl107bOJE4F%2BxkDIR3sCKM9rgzm%2BR59bDGWKP6v3UGOFsmuFs5uvom9ChKf7TGIfa%2FKHsfOeKRwQTpmr4QCkxx9OCUAclhzipZRYObeYxebOpii0YdsJ8Vjhfh%2BPM39wo2xBeVA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
859018410d715d61-FRA
x-amz-cf-id
ppDI2fVVjn9H1jQ1zgLMc3siIb_P-OchPddgUdUA-KB_zV9aIDwDsw==
expires
Thu, 20 Feb 2025 15:41:39 GMT
module_149435964191_Site_Search_Input_-_stage.min.js
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/149435964191/1704134990406/
3 KB
3 KB
Script
General
Full URL
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/149435964191/1704134990406/module_149435964191_Site_Search_Input_-_stage.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
03c30b3cb8bfcb6c97b324ef18840cebdbe696a9f50ad21285329699a6d6bd01
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
br
age
178
x-amz-request-id
DXVW81TENZNPAP48
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
x-evy-trace-listener
listener_https
etag
W/"8cfe1587167ebda531327cb947c48468"
vary
origin, Accept-Encoding
x-amz-meta-created-unix-time-millis
1704134990406
content-type
application/javascript; charset=utf-8
x-evy-trace-virtual-host
all
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 ad2604250e9eed83c372fadb62dfeaca.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id
0VsySWXJ7jaFmMT96fAjyc0_ys8pqFlU
x-amz-cf-pop
IAD61-P1
x-hs-alternate-content-type
text/plain
x-hubspot-correlation-id
ff971da6-5d1c-485c-9ca4-1e25dc479349
x-cache
RefreshHit from cloudfront
x-amz-storage-class
INTELLIGENT_TIERING
x-envoy-upstream-service-time
181
alt-svc
h3=":443"; ma=86400
x-amz-id-2
jxkSggJmCmeWzqzksYkvd8lF1wGXe6dNelaOFVM6Eer0DNa9DZ5pU9hrKU0oJi5vrYOM9tPZe+I=
x-evy-trace-route-configuration
listener_https/all
x-request-id
ff971da6-5d1c-485c-9ca4-1e25dc479349
last-modified
Mon, 01 Jan 2024 18:49:51 GMT
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zmcoIN%2BKUOPkkFo3%2B1oP%2F5AVVxZbRY8jMdUT9TEkMVvQ%2F7DslRIdgcbvntCG0KV6u5y1P1K8WH%2FLgTaFcCwURF18We7pk8d5NLvTrxglDrCydJ4U0YCoT1%2FoakPmSrd4y4eFet3H6%2Bn1LgBj565gXnsGpA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/cms-hubfs-td/envoy-proxy-5c8495489f-xmkhz
access-control-allow-credentials
false
cf-ray
85901840dd6b8fe3-FRA
x-amz-cf-id
1JVpoNKAmAi3s0MwKP0bNSXf6le__IDnwf9Vbe2EaE015ZREotY3Ng==
3375217.js
www.reversinglabs.com/hs/scriptloader/
3 KB
2 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/scriptloader/3375217.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f21cac7faf25c912fb299aca317c87403c753ae72c04b5a0ff663e31f9a2bd28
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
86
x-evy-trace-route-service-name
envoyset-translator
cf-polished
origSize=3476
x-hubspot-correlation-id
d6cf860b-3ffa-42af-9c86-d395e23bb341
content-encoding
br
x-envoy-upstream-service-time
435
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d6cf860b-3ffa-42af-9c86-d395e23bb341
last-modified
Wed, 21 Feb 2024 15:40:13 GMT
cf-bgj
minify
server
cloudflare
x-trace
2BDAEC2EF997BE974972ADA6390099D203FAAEA073000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-f7f4ffb8f-mvlkp
cache-control
public, max-age=90
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8METLHOdEZA3wg2a6eL3wCSsxWWzVgdCIYmzHMx1yBxXEbIvDW09VnRSoxw2lk92qDJvLmCvqHHnXlNyZ%2B3bOH05IlsxQ6jDX6Iyd5B8BgYk%2FULal9fJBUoUDKlLYx98gYKiVBuN1Vb0%2FLaigWjkiNX9Rw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
85901840dd778fe3-FRA
expires
Wed, 21 Feb 2024 15:43:09 GMT
index.js
www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/
11 KB
5 KB
Script
General
Full URL
https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
age
8847267
x-amz-cf-pop
FRA60-P6
x-amz-server-side-encryption
AES256
x-amz-version-id
inhS2tX2f2C4tITR3p2haS.uhsvA9eGz
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 21 Apr 2023 15:17:56 GMT
server
cloudflare
etag
W/"0bbd63c0750f141fd5cec04a9393647e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F64qNUwmYB0dAOlssuOKnGHik%2F6tOqbDu%2BbdQRsHuWWfxJSgyUXz4E1KqCFvorIewgMOoIW1XserV7k%2BimYw0omkUHiv7OjoBykAvaiRmPbmhuMcqseyxQz2GSb4fkkWnZWE1kWVcsY1dgHMM%2FXeytrKYA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
85901840dd788fe3-FRA
x-amz-cf-id
bv1G24lAVj0e2ZB0u8KPQCKL79Cwzgd453_BoGRtvWeIY5I7WPQeoA==
expires
Thu, 20 Feb 2025 15:41:39 GMT
cookieinfo.min.js
cookieinfoscript.com/js/
7 KB
4 KB
Script
General
Full URL
https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
AEQFMSKMNKR7QZQ9
age
7193
x-amz-meta-cb-modifiedtime
Mon, 03 Jul 2023 14:52:01 GMT
alt-svc
h3=":443"; ma=86400
x-amz-id-2
TSDr5AwMveaeCO1rY3NraNnr4sE5pOmWWC53zi0naRL113PQJT4ZtUgUGAt61Z0fAl79KsDiK8w=
last-modified
Wed, 05 Jul 2023 10:39:27 GMT
server
cloudflare
etag
W/"d15d93068c1121f63008407d339bd819"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A23oWa9myd0NX%2FRrHRvZjrWH5g80Tawi95ffJgN4p0qPOuwVpPgig6sqFYNOSRJtdHuqjW6TQNkDIK1s%2BPmUliOqEQ77N88y947NaVP5d0SlttQWjmqEM2aneTvHbwUMJIQzlJLSHMrrsrYLv1WJqL9ZYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
max-age=2678400
cf-ray
859018411ac86638-AMS
up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.172.103.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-103-101.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 09:28:07 GMT
Content-Encoding
gzip
Via
1.1 1fa5d8f57b04797d33d03ff93cb7543e.cloudfront.net (CloudFront)
Last-Modified
Wed, 17 Jan 2024 00:44:59 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA60-P8
Age
22413
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
SOKIrc0lpqXH9TKLjAsTjES0S1ESELR74BSYQxvB4awchpHC8pobJg==
hotjar-3176008.js
static.hotjar.com/c/
9 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-3176008.js?sv=6
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.162.38.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-162-38-9.cdg52.r.cloudfront.net
Software
/
Resource Hash
53aee3f9c27bd8fb1e557580ef17b33e114ea63736d6bdfae75c28726bc78c7d
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 f3ecb7d9889971a19731c9dc77982e54.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG52-P6
age
12
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/ec1b15aa57366c20b25e0e2711b7c72d
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
M6YvM9A2E7tC1u3dtFUn184aUvigNS0HcBE9pVha5q9nVFlvkGxZQw==
gtm.js
www.googletagmanager.com/
310 KB
100 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3ffbddacb6e7a4d9c576969656ca7236d2d65d287da5a69c13645a776b2aee35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
102047
x-xss-protection
0
last-modified
Wed, 21 Feb 2024 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 21 Feb 2024 15:41:39 GMT
fbevents.js
connect.facebook.net/en_US/
214 KB
58 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 21 Feb 2024 15:41:39 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
57257
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma
public
x-fb-debug
tLmnFc2UgcojqnuxowEA9RlCE6QG4xssx1TTcE/fhrYqWF+Gqu+a+0n/7idFOra170y6//X4qqQ7c+0oCuiHyQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
css
fonts.googleapis.com/
16 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
92b7d2521a258609fb0fd998b5db42022bc54c9f71faf87511488582ecc4ebdc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 21 Feb 2024 15:37:14 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 21 Feb 2024 15:41:39 GMT
css2
fonts.googleapis.com/
5 KB
872 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,100;9..40,200;9..40,300;9..40,400;9..40,500;9..40,600&display=swap
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
654bedb35fd51e7fae840f82579fc43fdebbaec7343b7a6f385421aa99c5ade2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 21 Feb 2024 15:38:52 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 21 Feb 2024 15:41:39 GMT
1076912843267184
connect.facebook.net/signals/config/
53 KB
11 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1076912843267184?v=2.9.147&r=stable&domain=www.reversinglabs.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f366636f36127d2b1058843b3d522a4ed46d82bb726716a6c83d1f30a8c023f0
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Wed, 21 Feb 2024 15:41:39 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
11041
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma
public
x-fb-debug
UdIPvqXsEA8PmOv4QPRjdEMSlOyLN0ZkwLfnBXza6OGJeLfWCbSB2WrkL4ZioEu3EO/8BudpT7xFNI2aY87l9A==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1076912843267184&ev=Lead&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&rl=&if=false&ts=1708530099412&sw=1600&sh=1200&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1708530099412.2059853999&ler=empty&cdl=API_unavailable&it=1708530099395&coo=false&exp=e1&rqm=GET
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 21 Feb 2024 15:41:39 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
js
www.googletagmanager.com/gtag/
317 KB
105 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2d0ca0f78af88fdc1a9f0a429cfdd7b14c4d363fbbe77099c393c6891c0544b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
106982
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 21 Feb 2024 15:41:39 GMT
pixel.js
www.redditstatic.com/ads/
28 KB
9 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Feb 2024 20:38:48 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"9a680c8c475d8bba600d4d87b4fa7ee5"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
8702
qevents.js
a.quora.com/
41 KB
14 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2a101f313f27c267a744088e44664a87d2ec7dc2a3464bf1319a95094dc76db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
DENAuZi5jc6G3XAf0_byr8vJzUcVnf.F
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
5K57PBR2A0025GG8
age
8856043
x-amz-server-side-encryption
AES256
alt-svc
h3=":443"; ma=86400
x-amz-id-2
rvPsThAgQkJShQQ2J7UMgDJ+mUUBMPz6v4o52Qjy3F2U8CcHm7z1WCN2wGkAgqOAkDHbpFzSZ2Y=
last-modified
Tue, 17 Oct 2023 18:57:21 GMT
server
cloudflare
x-amz-meta-s3cmd-attrs
md5:5defc3f1c55a0cb9cbca8c06fbabaf65
etag
W/"5defc3f1c55a0cb9cbca8c06fbabaf65"
vary
Accept-Encoding
content-type
text/plain
cache-control
public, max-age=14400
cf-ray
859018419d58924d-FRA
expires
Wed, 21 Feb 2024 19:41:39 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
45 KB
16 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e9841d9258210b13f0870a80d02ce8f3224c8798d1c0d618f210a573ce96038e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 20 Feb 2024 09:12:49 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=54900
accept-ranges
bytes
content-length
16480
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1708530099431&cv=11&fst=1708530099431&bg=ffffff&guid=ON&async=1&gtm=45He42h0v856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&hn=www.googleadservices.com&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&pscdl=noapi&auid=1056620481.1708530099&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bf120dc0e1bbc267cc9af35fcd1248a162e349f98c40cce021012237cb12a2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1324
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
request.js
script.anura.io/
0
0
Script
General
Full URL
https://script.anura.io/request.js?instance=1480878102&1708530099434
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.169.22.210 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-169-22-210.eu-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

site-script.js
cdn.metadata.io/
7 KB
3 KB
Script
General
Full URL
https://cdn.metadata.io/site-script.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:d600:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2e8ac193dd69f6561479a2c46c7089f5b1c66c4afa36ec74958be270e25e3db3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-amz-version-id
mWfr8wxku1ozz3DdYlV.O4nCQVFUqKXx
content-encoding
gzip
via
1.1 b36a9cc0b5286fd650732f1458855500.cloudfront.net (CloudFront)
date
Wed, 21 Feb 2024 11:02:55 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
MUC50-P3
age
16725
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 12 Dec 2023 16:47:45 GMT
server
AmazonS3
etag
W/"4c08eb9605ac986944978f7081c30a96"
vary
Accept-Encoding, Origin
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-amz-cf-id
EZDuXV59Cy4Qq2U4AFFMwzMyr2gSaS68e2bippCfRu110kRB2D5T6w==
8423336.js
snid.snitcher.com/
24 KB
25 KB
Script
General
Full URL
https://snid.snitcher.com/8423336.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.194.13.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-13-162.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
1697c3d4408d4f4f4f5155efcd03ce7cb614f6d4c73aca1baf76f9de2bbb00d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

access-control-allow-origin
*
x-vapor-base64-encode
True
date
Wed, 21 Feb 2024 15:41:40 GMT
cache-control
max-age=1800, private
content-length
24862
apigw-requestid
Tfj0FiBqliAEMlw=
content-type
application/javascript
site-insights.js
cdn.metadata.io/
3 KB
2 KB
Script
General
Full URL
https://cdn.metadata.io/site-insights.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:d600:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8cede167f8e0eb1a742b600847e11c36e71ca6f8a2392c2474f31387b0cd5f4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-amz-version-id
oLwy90dZVO5VbL0SwmxJ7JP9D8GQ9nog
content-encoding
gzip
via
1.1 b36a9cc0b5286fd650732f1458855500.cloudfront.net (CloudFront)
date
Wed, 21 Feb 2024 06:33:01 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
MUC50-P3
age
50324
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 05 Feb 2024 15:29:59 GMT
server
AmazonS3
etag
W/"802c81b5c2aebbed9aa94f55cd523a61"
vary
Accept-Encoding, Origin
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-amz-cf-id
YopuelVTjAzVRMyjC10--eMrC3E7n7pE3gg_lwIdyITKRWM1cgQroQ==
1010075.js
tracking.g2crowd.com/attribution_tracking/conversions/
960 B
2 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1010075.js?p=https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls&e=
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99422095a0a321c15136d54e3c37b3aed5675895480781218f738496eb60f96a
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
x-permitted-cross-domain-policies
none
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
x-xss-protection
1; mode=block
x-request-id
8b37dabc-6f58-41f6-877b-a7bdbac22b0b
x-runtime
0.005277
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"99422095a0a321c15136d54e3c37b3ae"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
cf-ray
859018419aff3828-FRA
pixel
q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/
43 B
419 B
Image
General
Full URL
https://q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.58.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-58-74.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:39 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
,9f8326a732bfd741def87f8c26107a2c,10.0.0.52,5282,45.141.152.77,,75324973230,1,1708530099.765,0.001,,.,0,0,0.000,0.000,-,0,0,203,160,80,10,35796,,,,,,-,
Content-Type
image/gif
970567826
google.com/pagead/form-data/
0
0
Ping
General
Full URL
https://google.com/pagead/form-data/970567826?em=tv.1&gtm=45He42h0v856083864za200&gcd=13l3l3l3l0&dma_cps=sypham&dma=1&npa=0&auid=1056620481.1708530099
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

970567826
google.com/ccm/form-data/
0
249 B
Ping
General
Full URL
https://google.com/ccm/form-data/970567826?em=tv.1&gtm=45He42h0v856083864za200&gcd=13l3l3l3l0&dma_cps=sypham&dma=1&npa=0&auid=1056620481.1708530099
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
0
31 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1076912843267184&ev=PageView&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&rl=&if=false&ts=1708530099438&sw=1600&sh=1200&v=2.9.147&r=stable&a=tmgoogletagmanager&ec=1&o=4126&fbp=fb.1.1708530099412.2059853999&ler=empty&cdl=API_unavailable&it=1708530099395&coo=false&exp=e1&rqm=GET
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 21 Feb 2024 15:41:39 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
modules.a02b08e96dea6b9516bd.js
script.hotjar.com/
228 KB
55 KB
Script
General
Full URL
https://script.hotjar.com/modules.a02b08e96dea6b9516bd.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3176008.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-87.muc50.r.cloudfront.net
Software
/
Resource Hash
31f4db27d40c17ddd30179d71bfc7cd0ab6ce459c46e2a935609acf3cba1e295
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 11:01:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 7ad01e16cb039e6f25a50f4e294fd0ae.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
189633
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
56163
last-modified
Mon, 19 Feb 2024 11:00:25 GMT
etag
"26c6b143280117fc6f6e3350a91924ce"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
UQEFjv9KeFkKPLuWAA03OHf_a8yjX7eG_jGe3vHMijqhDohDBNy_QQ==
t2_neftrm6a_telemetry
www.redditstatic.com/ads/conversions-config/v1/pixel/config/
86 B
700 B
XHR
General
Full URL
https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_neftrm6a_telemetry
Requested by
Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server
snooserv
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=300
accept-ranges
bytes
content-length
98
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1708530099463&id=t2_neftrm6a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=f02ed524-7477-4824-a51b-0c3fedf7ab3d&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_c9439d84&dpm=&dpcc=&dprc=
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1708530099481&cv=11&fst=1708530099481&bg=ffffff&guid=ON&async=1&gtm=45je42h0v867824530z8856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&hn=www.googleadservices.com&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&pscdl=noapi&auid=1056620481.1708530099&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b5a703f44531104e5a322715c1f9189d2a2214d6d69b71ab444545adc47a4b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1352
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
258 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je42h0v867824530z8856083864za200&_p=1708530099245&_gaz=1&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=384745464.1708530099&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708530099&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&dt=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=583
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
258 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JVM9Z1XQPL&cid=384745464.1708530099&gtm=45je42h0v867824530z8856083864za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.reversinglabs.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tdp=G-JVM9Z1XQPL;67824530;1;6;0&rtg=56083864&rlo=37&slo=14&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
td
www.googletagmanager.com/
0
15 B
Image
General
Full URL
https://www.googletagmanager.com/td?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tdp=G-JVM9Z1XQPL;67824530;1;6;0&rtg=56083864&rlo=37&slo=14&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
server
Golfe2
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&es=1&e=gtm.init&eid=0&h=Ag&tr=1ogtcrossdomain.1ogtadsdatatos.1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ccdgaadslink.1ogtgooglesignals.1ccdgaregscope.1ccdemdownload.1ccdemoutboundclick.1ccdadsfirst.1ccdempageview.1ccdemsitesearch.1ccdpreautopii.1ccdemvideo.1ccdemform.1ccdconversionmarking.1ccdadd1pdata.1ccdautoredact.1ccdadslast.1ccdgalast&ti=2ogtcrossdomain.2ogtadsdatatos.2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaadslink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdadsfirst.2ccdempageview.2ccdemsitesearch.2ccdpreautopii.2ccdemvideo.2ccdemform.2ccdconversionmarking.2ccdadd1pdata.2ccdautoredact.2ccdadslast.2ccdgalast&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JVM9Z1XQPL&cid=384745464.1708530099&gtm=45je42h0v867824530z8856083864za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0&z=468976621
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&es=1&e=gtag.config&eid=1&u=AAAAAAAIAAAAACA&h=Ag&epr=1AW.1G.2G&tr=1rep.1gct&ti=1rep.1gct&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&e=gtm.init&eid=0&u=AAAAAAAIAAAAACA&h=Ag&tr=5ogtcrossdomain.5ogtadsdatatos.5ogt1pdatav2.5ccdgafirst.5setproductsettings.5ccdgaadslink.5ogtgooglesignals.5ccdgaregscope.5ccdemdownload.5ccdemoutboundclick.5ccdadsfirst.5ccdempageview.5ccdemsitesearch.5ccdpreautopii.5ccdemvideo.5ccdemform.5ccdconversionmarking.5ccdadd1pdata.5ccdautoredact.5ccdadslast.5ccdgalast&ti=2ogtcrossdomain.2ogtadsdatatos.2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaadslink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdadsfirst.2ccdempageview.2ccdemsitesearch.2ccdpreautopii.2ccdemvideo.2ccdemform.2ccdconversionmarking.2ccdadd1pdata.2ccdautoredact.2ccdadslast.2ccdgalast&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:38:45 GMT
x-content-type-options
nosniff
age
28974
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:38:45 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:52:39 GMT
x-content-type-options
nosniff
age
28140
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:52:39 GMT
rl-icons.ttf
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/raw_assets/public/Redesign_2023/icons/fonts/
10 KB
8 KB
Font
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/raw_assets/public/Redesign_2023/icons/fonts/rl-icons.ttf
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/137900387987/1707496332225/Redesign_2023/css/globals/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bca7640b96e8bc5e480ba56c1509be51f7ff85bd7c6f7c8ba718584ee014f325

Request headers

Referer
https://www.reversinglabs.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
x-amz-meta-cache-tag
F-139510720360,FD-139508672619,P-3375217,FLS-ALL
age
865184
x-amz-request-id
5CF72EGJ4PADSW9S
x-amz-server-side-encryption
AES256
edge-cache-tag
F-139510720360,FD-139508672619,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
etag
W/"c34766f3c440d3a30b4d460b6148c3d6"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
font/ttf
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1696946198131
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
none
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:39 GMT
via
1.1 6f32a39163a1e36ace7a71a85e2d2884.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-version-id
.0L69OQo3V1rT7nywVyw1zXneYo.i_8D
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
x-cache
RefreshHit from cloudfront
cache-tag
F-139510720360,FD-139508672619,P-3375217,FLS-ALL
x-amz-meta-index-tag
none
x-amz-storage-class
INTELLIGENT_TIERING
x-amz-id-2
iva5Tz75lmkPHs3qj56b2Jl3wNTjhfRU92VVWC2sHpO7DQljNss3ws0lWHF4N263UCxrllluzC9qPRhDtksQXA==
last-modified
Fri, 12 Jan 2024 12:43:41 GMT
server
cloudflare
cf-ray
8590184208ef18db-FRA
x-amz-cf-id
pxPROF5AWUv3sknkJgPVrf7jHTrjEknpsm-TAVs-v1THh0FZ_dTKvw==
rP2Hp2ywxg089UriCZOIHQ.woff2
fonts.gstatic.com/s/dmsans/v14/
61 KB
61 KB
Font
General
Full URL
https://fonts.gstatic.com/s/dmsans/v14/rP2Hp2ywxg089UriCZOIHQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,100;9..40,200;9..40,300;9..40,400;9..40,500;9..40,600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef3e7e94fc36d961b807c8fa6c2bbbd5cf60a746a95c0d01f331d847156b198c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:36:18 GMT
x-content-type-options
nosniff
age
29121
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
62704
x-xss-protection
0
last-modified
Wed, 12 Jul 2023 22:05:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:36:18 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:57:47 GMT
x-content-type-options
nosniff
age
27832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:57:47 GMT
KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 06:23:44 GMT
x-content-type-options
nosniff
age
33475
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17508
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:41 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 06:23:44 GMT
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/
12 KB
12 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b076e86301cbee8c5c9aef51863a9c0a88e6f6d2aabdffca93e031113c6caa74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:41:07 GMT
x-content-type-options
nosniff
age
28832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11796
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:41:07 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:30:26 GMT
x-content-type-options
nosniff
age
29473
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:30:26 GMT
Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp
www.reversinglabs.com/hs-fs/hubfs/Blog/
110 KB
111 KB
Image
General
Full URL
https://www.reversinglabs.com/hs-fs/hubfs/Blog/Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp?width=1400&height=732&name=Attackers-leverage-PyPI-to-sideload-malicious-DLLs.webp
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a971a1b8a77930e6428838ba6f9f32438422ff3c4e97f0a692a7e704abbbc225
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
via
1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-157540533551,FD-11822274822,P-3375217,FLS-ALL
alt-svc
h3=":443"; ma=86400
content-length
112950
cf-resized
internal=ok/m q=0 n=879+0 c=13+1 v=2024.1.3 l=112950
last-modified
Mon, 19 Feb 2024 14:35:22 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cf9tB0PuQiNVDnlZH8XY6gJw73svDsvdffkG1yWKzcDQ:596a60c78eec9d1f930dfcb616c3ebf5"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=50dGDwZd%2FxKsQJqLpi%2Fm4%2FbQppleapXP6FhNuRC3SNufjUBMQc7aCDGyvvQCNCLyPD5ff4lSrqyzLHBiRvWTIn%2FTCi1bP7zfuSAA9NcDiA6HbeRUR%2BGTj68FzWVaecolfkInyMVgYd0cRvW3E5aSpjTKug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
85901841fe7f8fe3-FRA
v4.js
play.vidyard.com/embed/
70 KB
23 KB
Script
General
Full URL
https://play.vidyard.com/embed/v4.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.181 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e492e5bd630a86a679a9ead911fc5e1e155d75098344c375131c40470e97396d
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-cache-hits
47
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
via
1.1 varnish
strict-transport-security
max-age=31557600
age
27956
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
23031
x-served-by
cache-fra-eddf8230090-FRA
x-china
0
last-modified
Mon, 28 Aug 2023 17:07:01 GMT
etag
"d22850d6ed493dad3ff1a51479d730cc"
vary
X-China, accept-language, Accept-Encoding
content-type
application/javascript
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
px.ads.linkedin.com/wa/
0
442 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 40DE3BA1A42D47D2BC812EC19974998F Ref B: FRAEDGE2018 Ref C: 2024-02-21T15:41:39Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
access-control-allow-origin
https://www.reversinglabs.com
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYR5imtSnYgqWL22eRURQ==
json
www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/
16 KB
4 KB
XHR
General
Full URL
https://www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/json?hs_static_app=forms-embed&hs_static_app_version=1.4733&X-HubSpot-Static-App-Info=forms-embed-1.4733
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fcfe413e637375e4d9faedb78c76e14bf0b2ba429c2a962665ab5ca17441e0e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-origin-hublet
na1
date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
cdb5742a-566c-4169-aea7-32ecfe9b0b51
content-encoding
br
x-envoy-upstream-service-time
20
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
cdb5742a-566c-4169-aea7-32ecfe9b0b51
server
cloudflare
x-trace
2B7BC3A60A9DF4710C5290CA7FC4F3F00C040404FA000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-max-age
180
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-4s88s
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U4Bi5z8gvZP6%2BvNadyWcAcGai1uJpc8GgYNX0XUJQt2HBSUcYOgGSBQ4OeKVgu79y3LPPJaSRSGbwk9a7XFr3D9tjAqN8ZDSq5xFxHNA%2BdKruo%2FhbsXo5xVeDtYp3f7pbS8JANL69j6IpqN9rNJvWa%2Bt1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
859018423ead8fe3-FRA
access-control-allow-headers
*
x-robots-tag
none
JrRu3vUM8j33QSR7Bwxw
ws.zoominfo.com/pixel/
3 KB
2 KB
Script
General
Full URL
https://ws.zoominfo.com/pixel/JrRu3vUM8j33QSR7Bwxw
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
fd091571851b8cdb06a588dc6a11fa4552d07f9b095f8c60daa8303dcc524477
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc
h3=":443"; ma=86400
cf-ray
8590184259c81cad-FRA
all.js
connect.facebook.net/en_GB/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_GB/all.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
24851f7032cc4a3a7e7de029c023b48764d2b373e04300008b071d6abd0b163e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 21 Feb 2024 15:41:39 GMT
content-md5
xVwaTx74cooG4vct5U7l/g==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1686
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug
YcAB8kQEruMCrvX+LObSy5AUzAKfTP+cgyBvAZTYO08P5l1bicNO34EtKs14mli5/6NBqrFmo9+4iaTNxyfYVw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
ebdc6b0c3941681aa63e69963627ca1e
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
etag
"afc0ec20742d67b726a1c0795bc0f96f"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
x-fb-optimizer
1
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options
DENY
timing-allow-origin
*
priority
u=3,i
expires
Wed, 21 Feb 2024 15:54:32 GMT
widgets.js
platform.twitter.com/
91 KB
28 KB
Script
General
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BB7) /
Resource Hash
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:39 GMT
Content-Encoding
gzip
Age
1409
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
27597
Last-Modified
Mon, 11 Dec 2023 17:20:28 GMT
Server
ECS (amb/6BB7)
Etag
"824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=1800
Vary
Accept-Encoding
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-t...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-t...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1708530099560%26li_adsId%3D795c525c-26bd-4679-bd42-b6efe501db6d%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-t...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQID-5-2wmJFqwAAAY3MVGejeFtY5NTEWp075Kjrp_MdBBR6VUkYX8KdTHuCEHwCpJAh-1ijCPiz-ZhVbpsgy4Sdo7LAaw
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 51C080A5FD4B476D820CA9C4BA0BDEF3 Ref B: FRAEDGE1808 Ref C: 2024-02-21T15:41:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYR5im3e8TLfQAM018K+w==

Redirect headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: CA67E8CD54C943BE876D6AC397348631 Ref B: FRAEDGE2018 Ref C: 2024-02-21T15:41:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1708530099560&li_adsId=795c525c-26bd-4679-bd42-b6efe501db6d&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQID-5-2wmJFqwAAAY3MVGejeFtY5NTEWp075Kjrp_MdBBR6VUkYX8KdTHuCEHwCpJAh-1ijCPiz-ZhVbpsgy4Sdo7LAaw
x-li-proto
http/2
content-length
0
x-li-uuid
AAYR5im0u3SkhgCEEACt2Q==
/
www.google.com/pagead/1p-user-list/970567826/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970567826/?random=1708530099431&cv=11&fst=1708527600000&bg=ffffff&guid=ON&async=1&gtm=45He42h0v856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_UsQuRjk2i704Zysr2clYJa2oK5ntUQ&random=2723863368&rmt_tld=0&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/970567826/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/970567826/?random=1708530099431&cv=11&fst=1708527600000&bg=ffffff&guid=ON&async=1&gtm=45He42h0v856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_UsQuRjk2i704Zysr2clYJa2oK5ntUQ&random=2723863368&rmt_tld=1&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
traffic
api-gw.metadata.io/ Frame
0
0
Preflight
General
Full URL
https://api-gw.metadata.io/traffic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.160.37.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-160-37-98.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.reversinglabs.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
*
access-control-max-age
86400
content-length
0
content-type
application/json
date
Wed, 21 Feb 2024 15:41:40 GMT
x-amz-apigw-id
Tfj0LFfkvHcEt8w=
x-amzn-requestid
21ee501b-71fe-41e8-9496-1ac39813a14b
traffic
api-gw.metadata.io/
0
0
Fetch
General
Full URL
https://api-gw.metadata.io/traffic
Requested by
Host: cdn.metadata.io
URL: https://cdn.metadata.io/site-insights.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.160.37.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-160-37-98.us-west-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
x-amzn-remapped-content-length
0
x-amzn-remapped-connection
keep-alive
x-amzn-requestid
d8fe8adf-71da-4d12-b667-fcfdd69540e6
access-control-max-age
1728000
access-control-allow-methods
OPTIONS,POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
content-length
0
x-amzn-remapped-date
Wed, 21 Feb 2024 15:41:40 GMT
x-amz-apigw-id
Tfj0MFmRPHcEu4A=
cs
a.usbrowserspeed.com/
0
0
Fetch
General
Full URL
https://a.usbrowserspeed.com/cs?pid=5de38576d91fe7ac65e01de48078379caf9e72e979b06a5762372b0c12e930ef&puid=lsvypi09xnlabqw27ha
Requested by
Host: cdn.metadata.io
URL: https://cdn.metadata.io/site-insights.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.166.97.53 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-166-97-53.us-west-2.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
server
awselb/2.0
3375217.js
js.hs-analytics.net/analytics/1708530000000/
66 KB
21 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1708530000000/3375217.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:50ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecdd82fe677d7643614f490e727c913fbaa86d9c74f89651a611ca3349062e63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
ZG9NS7Q9F3QDH1MR
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-hubspot-correlation-id
0e3d00c2-1b7a-429b-a5d3-d50d8715a720
x-envoy-upstream-service-time
33
x-amz-id-2
R0rxn0AysK0urmuAPGtCn8hU3dKyxLGYHi8DxKoCpCYg2Bc681DVKzMMKRtjABcsDcIB+/1ZmdZH54JVC2mZ9g==
x-evy-trace-listener
listener_https
x-request-id
0e3d00c2-1b7a-429b-a5d3-d50d8715a720
x-evy-trace-route-configuration
listener_https/all
last-modified
Wed, 03 Jan 2024 16:28:05 GMT
server
cloudflare
etag
W/"26db45fc2a3bed4dbbff25aa2a07f220"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-hgmm2
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
859018427ad9bb3d-FRA
expires
Wed, 21 Feb 2024 15:46:39 GMT
conversations-embed.js
js.usemessages.com/
85 KB
25 KB
Script
General
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:fba8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67a2ef843448fd18bbff44f59c6347d9ac79b757722a14988efbc9210a02e0a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
pcABCp7aTfnslFOuXS9T9WQPLRPjzj27
via
1.1 c5f8f8068a88ebb73e505f5e51b5262e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
age
174
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.15480/bundles/project.js&cfRay=859013ff891937ce-FRA
x-cache
Hit from cloudfront
x-hubspot-correlation-id
e8adea95-a6fb-4108-bb69-bf93c9340276
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
content-encoding
br
x-envoy-upstream-service-time
3
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
e8adea95-a6fb-4108-bb69-bf93c9340276
last-modified
Thu, 15 Feb 2024 15:13:02 UTC
server
cloudflare
etag
W/"daadcf17e8fb7d655d233f6a0f1e4d72"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-mjwfl
cf-ray
859018427d0f19b1-FRA
x-amz-cf-id
WIf-5xTgLjEvGzhmj0UMxDi8VKrfJzrOq5YoQJc_x5Pw63lja5uIAA==
x-hs-target-asset
conversations-embed/static-1.15480/bundles/project.js
banner.js
js.hs-banner.com/v2/3375217/
69 KB
23 KB
Script
General
Full URL
https://js.hs-banner.com/v2/3375217/banner.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4056eaf916b02748614fcbacbe3ac5ccafee050fc24b17ca5a93a71a233788ca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
YOo.cox9s5VMitLsbtVdwygjgWxXE8Ao
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
9DE5VNB2PBJW0GAD
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-hubspot-correlation-id
9402b0cb-e29d-4134-9c8e-8678b3c7eb22
age
200
x-envoy-upstream-service-time
26
x-amz-id-2
hk+htoD0jkvMihS37vVSixxm396PSe1NB8ALxNL+hgNxG24T5hPVfNShg318ou9XVaGMRBA22BI=
x-evy-trace-listener
listener_https
x-request-id
9402b0cb-e29d-4134-9c8e-8678b3c7eb22
x-evy-trace-route-configuration
listener_https/all
last-modified
Tue, 13 Feb 2024 15:59:29 GMT
server
cloudflare
etag
W/"525e10cb047bad8b6a7536d44843b1e7"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-pbs6d
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
859018427e322c23-FRA
expires
Wed, 21 Feb 2024 15:43:19 GMT
collectedforms.js
js.hscollectedforms.net/
69 KB
25 KB
Script
General
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:5a9a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
age
262
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.468/bundles/project.js&cfRay=859011de3a671cb5-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"0892458d49ed5681928e6be69131caa7"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
collected-forms-embed-js/static-1.468/bundles/project.js
date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
VTCx5Wpr_CjwKFe_1K6ShUsHQL37oHcJ
via
1.1 3c43e000c50d5633eb558057710f3c54.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
f0cb8dfc-95bb-44a9-b663-7347db9fc8db
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
0
x-evy-trace-route-configuration
listener_https/all
x-request-id
f0cb8dfc-95bb-44a9-b663-7347db9fc8db
last-modified
Wed, 21 Feb 2024 09:36:07 UTC
server
cloudflare
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-xbcdx
cf-ray
8590184289a99249-FRA
x-amz-cf-id
M9_FwA58eyiK3jDCj1FywaqelrmXGIsGT3CdETaYS3YxiK6jS6TyrA==
fb.js
js.hsadspixel.net/
6 KB
4 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e4a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa97d5a93f1d1e252fd0259295827c1a0713d434e3acbd2e33786adfceb534ce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
isGrj7bsJKQyiYsmde6FQimVS.PTJSF2
via
1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
age
267
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.522/bundles/pixels-release.js&cfRay=859011ba8b0d65a2-FRA
x-cache
Hit from cloudfront
x-hubspot-correlation-id
741f50b5-7e6f-4c19-9a01-d92a8a3afc63
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding
br
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
741f50b5-7e6f-4c19-9a01-d92a8a3afc63
last-modified
Thu, 15 Feb 2024 14:51:53 UTC
server
cloudflare
etag
W/"b058f364a6909ff145f5780315cd5784"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-95tks
cf-ray
859018429e8465c8-FRA
x-amz-cf-id
Erc6S_03GDEuczXDebtDec3Pww5QLLxBuizWhHbttpEUZL7Yaed0xg==
x-hs-target-asset
adsscriptloaderstatic/static-1.522/bundles/pixels-release.js
leadflows.js
js.hsleadflows.net/
551 KB
88 KB
Script
General
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:7b0c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0eb564e8b104002217b23d191c384d64d77b30fa37b0f124db645e16096cfd3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
age
62539
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1313/bundle/main/lead-flows-release.js&cfRay=858a216caaac9220-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"2a6dc24f5ac6c8a7eefaadde95ff2129"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=86400, max-age=0
x-hs-target-asset
lead-flows-js/static-1.1313/bundle/main/lead-flows-release.js
date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
ukHk26vS_rf4a6X6Ik2.9R2qKIwOxT4G
via
1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
539448cf-ad46-433e-8d1b-d218a166bfde
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
8
x-evy-trace-route-configuration
listener_https/all
x-request-id
539448cf-ad46-433e-8d1b-d218a166bfde
last-modified
Tue, 06 Feb 2024 10:46:39 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-rh5xx
cf-ray
85901842aad39280-FRA
x-amz-cf-id
bsgkM3JrhWE-Vjx7OtaBF8sWabVX4iDef6wb8PjqZztvCwPzRUAPyQ==
web-interactives-embed.js
js.hubspot.com/
83 KB
24 KB
Script
General
Full URL
https://js.hubspot.com/web-interactives-embed.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2af3f1d7f94ab4dd9772778426b29f7dcc94932d4cd320a81ed087698dad53cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
age
219
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.902/bundles/project.js&cfRay=859012e64c161a86-FRA
x-amz-replication-status
PENDING
x-evy-trace-listener
listener_https
etag
W/"fe6f74022c5ca341c554dbc9f28319ec"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-hs-target-asset
web-interactives-embed/static-2.902/bundles/project.js
date
Wed, 21 Feb 2024 15:41:39 GMT
x-amz-version-id
JZDwjXGu.HUDwuViUXB3teXgVe39E4Xp
via
1.1 bcfffcf7e0fc8cd9cfe4125369a9f036.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
1f784d41-6ad0-4170-99dd-1d59b6bfb083
x-cache
Hit from cloudfront
cache-tag
staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
x-evy-trace-route-configuration
listener_https/all
x-request-id
1f784d41-6ad0-4170-99dd-1d59b6bfb083
last-modified
Tue, 20 Feb 2024 16:31:19 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PXCp8rOFJcV2TiaOOTtwpGgOU5x8BnFIGarOHn%2FYN7eedJDDhGl%2FkHVRJ3sOqkyCCInE6XPLC0ajCM%2FuAcnCd3AASgXY%2FwDfqka9IpZx8EsUjBslDRzwid2Bu%2BLRdl09%2FV9fdbW%2FWBYwIvma"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-qbbz2
cf-ray
85901842aed719a9-FRA
x-amz-cf-id
GKtC5F7vXNnaotQTYLzRSCAaWl3rthTCX9RLknRMWRSVWJsHjlgqdQ==
has-permission
app.hubspot.com/content-tools-menu/api/v1/tools-menu/
0
1 KB
Script
General
Full URL
https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options no-sniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
no-sniff
cf-cache-status
DYNAMIC
x-hs-worker-debug-mode
false
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
6f01ea43-91d0-4f47-bb50-212dae53c719
x-envoy-upstream-service-time
11
x-evy-trace-route-configuration
listener_https/all
reporting-endpoints
default="https://send.hsbrowserreports.com/csp/reports?cfRay=85901842bf9968fb&resource=unknown"
x-evy-trace-listener
listener_https
x-request-id
6f01ea43-91d0-4f47-bb50-212dae53c719
server
cloudflare
x-trace
2B4E064D864F0D2D6EA79D0E4E4BE9044D4F04A30B000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-mjwfl
x-evy-trace-virtual-host
all
cache-control
max-age=0
access-control-allow-credentials
true
cf-ray
85901842bf9968fb-FRA
truncated
/
37 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Content-Type
image/gif
/
www.google.com/pagead/1p-user-list/970567826/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970567826/?random=1708530099481&cv=11&fst=1708527600000&bg=ffffff&guid=ON&async=1&gtm=45je42h0v867824530z8856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_2ae4PVKk3tyc3pv84wx7Tx5IhLdr6g&random=2786019959&rmt_tld=0&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/970567826/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/970567826/?random=1708530099481&cv=11&fst=1708527600000&bg=ffffff&guid=ON&async=1&gtm=45je42h0v867824530z8856083864za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&frm=0&tiba=Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_2ae4PVKk3tyc3pv84wx7Tx5IhLdr6g&random=2786019959&rmt_tld=1&ipr=y
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&e=gtag.config&eid=1&u=AAAAAAAIAAAAACA&h=Ag&tr=5rep.5gct&ti=1rep.1gct&z=0
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
6si.min.js
j.6sc.co/
64 KB
17 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 20 Dec 2023 22:26:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"65836a29-fee9"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
17567
expires
Wed, 21 Feb 2024 15:41:39 GMT
browser-perf.8417c6bba72228fa2e29.js
script.hotjar.com/
5 KB
2 KB
Script
General
Full URL
https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.a02b08e96dea6b9516bd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-87.muc50.r.cloudfront.net
Software
/
Resource Hash
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 24 Jan 2024 14:32:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 7ad01e16cb039e6f25a50f4e294fd0ae.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
2423372
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1782
last-modified
Wed, 24 Jan 2024 14:31:37 GMT
etag
"b83b61bc5871e9a23a0434e2c539f4f3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
Hfh0c4kToUxw2CIV5kRQZPbo_AZV3uED42Ufw5D3GD38bxLOnLCqBg==
all.js
connect.facebook.net/en_GB/
305 KB
86 KB
Script
General
Full URL
https://connect.facebook.net/en_GB/all.js?hash=cf8a0711f30ce96fe496873dee41271c
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
fe1bd72522e47500bbf691586c52219533d6de0801edee024de76ad787f12ae0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 21 Feb 2024 15:41:39 GMT
content-md5
HvFqO2PSOdO4RgFD1EOQSQ==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
88160
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug
CeX15rEAqwBONRjZNm5pkOPZF3NmkGXq5c+aLRsx4dV97/ohbdsUHqWDUswtxgu0MonCVkjyWrH4qiKeL1ehHw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
b5fab8e50086e31774693c364164983a
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
etag
"d10f6acad33cf433840a585b811339c6"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options
DENY
timing-allow-origin
*
priority
u=3,i
expires
Thu, 20 Feb 2025 14:04:09 GMT
widget
www.reversinglabs.com/_hcms/livechat/
319 B
2 KB
XHR
General
Full URL
https://www.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.15480&mobile=false&messagesUtk=4708663c822c4c1894ce9da8945de52a&traceId=4708663c822c4c1894ce9da8945de52a
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c39ec2c79dfda63505bb21c8d372efd21ffe96652221aaf8853901d39a9ba6c2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy
upgrade-insecure-requests
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
79f640bf-dd2a-4c48-a98e-f013a66a8f47
x-envoy-upstream-service-time
256
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
79f640bf-dd2a-4c48-a98e-f013a66a8f47
server
cloudflare
x-trace
2BD0B1506E2DCC5715C54245C0B17CF1022A6357E9000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-f7f4ffb8f-69wzr
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BRh77wkJkMrtRXtXe8IJLg%2FiwaijhkSfhl6hHK%2BnR0gfSbpfd41O2ssDol0FA2t%2ByP5rI5NTp7rJbfmoY5deu%2FMfVGcFx4nxwSmA5kkoD2NoU%2FNLFusEAifT5M%2BNMSGopNgQ66BRQbXZX4I%2BysEzQZDskQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
85901842df208fe3-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 7A36
319 KB
104 KB
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BB9) /
Resource Hash
70c00445d6632039ed99af760731daf3bf60eb12061863ee61e2cd7276a54d18

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
6214808
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
105429
Content-Type
text/html; charset=utf-8
Date
Wed, 21 Feb 2024 15:41:39 GMT
Etag
"81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified
Mon, 11 Dec 2023 17:19:49 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6BB9)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary
Accept-Encoding
X-Cache
HIT
x-amz-server-side-encryption
AES256
x-tw-cdn
VZ
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/
115 B
1 KB
XHR
General
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=3375217
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
816360b9246cc268283dad1c2dae8f48e40df1cee8b234412201f4a03541e4a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
de98d29e-951e-4f81-bcdc-be4de3d6477f
content-encoding
br
x-envoy-upstream-service-time
6
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
de98d29e-951e-4f81-bcdc-be4de3d6477f
server
cloudflare
x-trace
2BF8F2D64008AA9FFCD65EB16F291CFD15777BED20000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-f7f4ffb8f-dlfxr
access-control-max-age
180
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZqwYvXCqp5Rpt21S7Yoa%2BPNnishTbdCSCr53g%2B17uEb3IanD%2B0%2FY5Z2t2MClj4bIBp2mawkJ18YIEab42WqKvyOmAgEIzF%2Bcw2eiAf2iNttuNxFDlYIrQVuDF7G0wkv4Bw%2BtgQS0GLfmghbC"}],"group":"cf-nel","max_age":604800}
cf-ray
85901842f9d14dc0-FRA
access-control-allow-headers
*
json
forms.hscollectedforms.net/collected-forms/v1/config/
115 B
435 B
XHR
General
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3375217&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:5a9a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
0751a569-e492-43fa-a1f9-34136baf0311
x-envoy-upstream-service-time
4
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
0751a569-e492-43fa-a1f9-34136baf0311
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-c4fsd
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
859018430a199249-FRA
combinedConfigs
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/
1 KB
2 KB
Fetch
General
Full URL
https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3375217&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&contentId=157537033740
Requested by
Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3455c96d0ff6f3666306a3dcbebdb0a38cd0096564208fde7efceca139c68af8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
c192eea5-836b-4106-9a5b-37a87ab164c0
content-encoding
br
x-envoy-upstream-service-time
277
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
c192eea5-836b-4106-9a5b-37a87ab164c0
server
cloudflare
vary
origin
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
true
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EBsH9FeDgNuubUULWFE6xkZRxe9qpg6hupiSmStbirzM806m9w2QyS%2BU8RUVxx6mdXU3xV8K19r7OQ0lzW2ZPP%2F1eAE0X%2FcxpzeQBbHmRkIoL7XQuxTgK253NvAkg3W2eR0uXgkD4QHWqF99OybLJnLBsqvQJ1aH2lc%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag
noindex, follow
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
859018431f6719a9-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-4s88s
settings
syndication.twitter.com/ Frame 7A36
869 B
658 B
Fetch
General
Full URL
https://syndication.twitter.com/settings?session_id=6d098a262235a1f13f883a6ded4f1a8482ac01c3
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-response-time
114
date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
strict-transport-security
max-age=631138519
last-modified
Wed, 21 Feb 2024 15:41:39 GMT
server
tsa_f
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
x-transaction-id
dea6288c548c0bfb
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
perf
7469935968
x-connection-hash
5c0de47786881131e108b12b8e359b68dfe1da35d184204b58b778e2a01ecd68
content-length
337
/
c.6sc.co/
7 B
197 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.reversinglabs.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
36 B
342 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5bc9121badd59a61d7f4a9fd5a1e57c14e4f9a709663c6220c8e229da3e44375

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Feb 2024 15:41:39 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.reversinglabs.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:ac8:20:3a00:1011:f51d:e96f:e814
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1708530099747_389993773_87170383_26_1335_12_27_219";dur=1
content-length
36
expires
Wed, 21 Feb 2024 15:41:39 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A39%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20Feb%202024%2015%3A41%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22125cf4892bae30e8b53458235ef53f8d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20Feb%202024%2015%3A41%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20Feb%202024%2015%3A41%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
1015 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:eff9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
9edaeb3e-9d56-4b50-9737-3630b8cc37c8
x-envoy-upstream-service-time
5
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
9edaeb3e-9d56-4b50-9737-3630b8cc37c8
Server
cloudflare
X-Trace
2BD67F1B862F6BC4F33793BDEDBBBA1C36CD9EFD58000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-8vflb
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
859018437ce95c5c-FRA
enterprise.js
www.google.com/recaptcha/
1 KB
1 KB
Script
General
Full URL
https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_a37a1b2b_8ac7_4e0f_8c63_e6ee3e8c8982&render=explicit&hl=en
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
bfb764d9df6c95a2a592195bca9ffba538ee6a47301aca6343ae7d4b26e1ec69
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 21 Feb 2024 15:41:39 GMT
counters.gif
forms-na1.hsforms.com/embed/v3/
35 B
1016 B
Image
General
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
0a3f198b-88e4-412c-a7ef-34e694fd1233
x-envoy-upstream-service-time
11
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
0a3f198b-88e4-412c-a7ef-34e694fd1233
Server
cloudflare
X-Trace
2BA5A695997B505A3682E2E5618910CA73AE170237000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-kq4w2
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
859018438dda3820-FRA
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/
492 KB
196 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_a37a1b2b_8ac7_4e0f_8c63_e6ee3e8c8982&render=explicit&hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Origin
https://www.reversinglabs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 14:20:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4885
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 14:20:14 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1011%3Af51d%3Ae96f%3Ae814%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
1015 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:eff9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:39 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
d0bbbc17-b2a1-4cd4-ac24-c00204bf75cd
x-envoy-upstream-service-time
2
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d0bbbc17-b2a1-4cd4-ac24-c00204bf75cd
Server
cloudflare
X-Trace
2BFE22549F2682F02FB00DC13C06B4FC294EA8D71D000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-kq4w2
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
85901843ed83364e-FRA
js
www.googletagmanager.com/gtag/
317 KB
105 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-970567826
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b507f3c39812daa5502135bde16efb258985358be5228244edea29b83761dd66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
107014
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 21 Feb 2024 15:41:39 GMT
anchor
www.google.com/recaptcha/enterprise/ Frame 83BE
46 KB
29 KB
Document
General
Full URL
https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
4ef227993e9cb6511ce89e4318830761c939c639aff7d3334c641b458bfcbbba
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-LZynBRGHAckgeR_0tbnDUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-LZynBRGHAckgeR_0tbnDUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 21 Feb 2024 15:41:39 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 83BE
55 KB
24 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 14:20:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4884
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 14:20:15 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 83BE
492 KB
195 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 14:20:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4885
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 14:20:14 GMT
Mm4kFZLLjkD0sbKo4FoYHdq4eBWr_78n4J5vVann3bY.js
www.google.com/js/bg/ Frame 83BE
17 KB
7 KB
Script
General
Full URL
https://www.google.com/js/bg/Mm4kFZLLjkD0sbKo4FoYHdq4eBWr_78n4J5vVann3bY.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
326e241592cb8e40f4b1b2a8e05a181ddab87815abffbf27e09e6f55a9e7ddb6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:42:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
28764
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6949
x-xss-protection
0
last-modified
Mon, 05 Feb 2024 17:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 07:42:15 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 83BE
2 KB
2 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:32:00 GMT
x-content-type-options
nosniff
age
29379
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Wed, 28 Feb 2024 07:32:00 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 83BE
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:46:35 GMT
x-content-type-options
nosniff
age
28504
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:46:35 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 83BE
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 13:40:25 GMT
x-content-type-options
nosniff
age
525674
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Feb 2025 13:40:25 GMT
webworker.js
www.google.com/recaptcha/enterprise/ Frame 83BE
102 B
135 B
Other
General
Full URL
https://www.google.com/recaptcha/enterprise/webworker.js?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
80663b7d03f283b27d8d833ca725a43d5cd3d5b5a7dd6487970dca9469f9c139
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cucmV2ZXJzaW5nbGFicy5jb206NDQz&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&badge=inline&cb=w5vonbf5jlmd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 21 Feb 2024 15:41:39 GMT
bframe
www.google.com/recaptcha/enterprise/ Frame 94FF
7 KB
1 KB
Document
General
Full URL
https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
36e95bc88b89ba6d134e6634348d7366c3aaf7a7f0bee5102d649457d19c4988
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-5-ltOqOnp3sUmPDXeXXpqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-5-ltOqOnp3sUmPDXeXXpqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 21 Feb 2024 15:41:40 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 94FF
55 KB
24 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 14:20:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4885
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 14:20:15 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 94FF
492 KB
195 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 14:20:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4886
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 14:20:14 GMT
counters.gif
perf-na1.hsforms.com/embed/v3/
35 B
1 KB
Image
General
Full URL
https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

Date
Wed, 21 Feb 2024 15:41:40 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
MISS
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
7f6ec413-05e4-49c3-aef6-6ea54526af24
x-envoy-upstream-service-time
2
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
7f6ec413-05e4-49c3-aef6-6ea54526af24
Last-Modified
Wed, 21 Feb 2024 15:41:40 GMT
Server
cloudflare
X-Trace
2B78A43638A4A98FF0D1DBEB8D7FA4B188C582F399000000000000000000
Vary
origin, Accept-Encoding
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-9285z
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
X-Robots-Tag
none
CF-RAY
85901845e8ab1cc3-FRA
hs-web-interactive-3375217-156662841132
3375217.hs-sites.com/ Frame 6D28
20 KB
6 KB
Document
General
Full URL
https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Requested by
Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:ae5d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cca56635d8b60422a95ec52208e3dde8b9760490e39d3b63932ec963b16d8f61
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
alt-svc
h3=":443"; ma=86400
cache-control
s-maxage=10,max-age=5
cache-tag
CT-156662841132,P-3375217,PGS-ALL,SW-1
cf-cache-status
HIT
cf-ray
85901845ef831e5a-FRA
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html;charset=utf-8
date
Wed, 21 Feb 2024 15:41:40 GMT
edge-cache-tag
CT-156662841132,P-3375217,PGS-ALL,SW-1
last-modified
Wed, 21 Feb 2024 14:33:24 GMT
server
cloudflare
vary
origin, Accept-Encoding
x-content-type-options
nosniff
x-envoy-upstream-service-time
49
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/cms-hs-sites-td/envoy-proxy-68f8578999-cknfz
x-evy-trace-virtual-host
all
x-hs-cache-config
BrowserCache-5s-EdgeCache-10s
x-hs-content-campaign-id
e339ca4a-4aaf-4a94-bbb9-2728fc693c6c
x-hs-content-id
156662841132
x-hs-hub-id
3375217
x-hubspot-correlation-id
80d8de1b-4e95-4f8c-88ef-4a35f03d3095
x-request-id
80d8de1b-4e95-4f8c-88ef-4a35f03d3095
x-robots-tag
none
x-trace
2B129DB9E1244667CE3AAF0D4281EDE27757CDC526000000000000000000
reload
www.google.com/recaptcha/api2/ Frame 94FF
21 KB
16 KB
XHR
General
Full URL
https://www.google.com/recaptcha/api2/reload?k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7f68888d176abdd375ce03f254182db6e0a6706b04fadbae9f32bd85521a3d97
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 21 Feb 2024 15:41:40 GMT
web-interactives-container.js
js.hubspot.com/ Frame 6D28
28 KB
9 KB
Script
General
Full URL
https://js.hubspot.com/web-interactives-container.js
Requested by
Host: 3375217.hs-sites.com
URL: https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a368adf977b467eb8e874f2b3958f3e5363e8c441f9ecd6e08516f8095ec732b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://3375217.hs-sites.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

content-encoding
br
age
558
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-container/static-2.902/bundles/project.js&cfRay=85900aa89d095c26-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"869ede08f45e3402354efa3568340790"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-hs-target-asset
web-interactives-container/static-2.902/bundles/project.js
date
Wed, 21 Feb 2024 15:41:40 GMT
x-amz-version-id
lX3Q4Gwr_D_AlbL..dpz.xpmrIV4WAtY
via
1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-hubspot-correlation-id
35d93ac8-83ac-4a3a-a138-4b3bc03cbe0a
x-cache
Hit from cloudfront
cache-tag
staticjsapp-web-interactives-container-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
0
x-evy-trace-route-configuration
listener_https/all
x-request-id
35d93ac8-83ac-4a3a-a138-4b3bc03cbe0a
last-modified
Tue, 20 Feb 2024 16:31:19 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhNp%2Fcix1iIlTAgPbkLXoNGDANpCpgjpJjm9Wi%2BR%2F10WdRZvmFdoGrum03vD7UDyT9nhxZ7NtO0stZhhyLaZDYzo0%2FdvPCaGDGNDIHtF2GxthUY7je7W0MtQpAZen6jRCmiwmP8Pgr1AuioW"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-748b697-mjwfl
cf-ray
8590184679c068fb-FRA
x-amz-cf-id
KoxKxWrYgTc2eziSaoogyJl6nopNVQh36eSOTcsUDFheOPWAhU9s1Q==
RL%20Bluebird%20Pop%20up%20Spectra%20Assure%20750x900.jpg
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/ Frame 6D28
77 KB
78 KB
Image
General
Full URL
https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/RL%20Bluebird%20Pop%20up%20Spectra%20Assure%20750x900.jpg
Requested by
Host: 3375217.hs-sites.com
URL: https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:297c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
823eb2b70ea4cd85173dfb8bab628f97a8b27f18606efbe31f447867d2cd49c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://3375217.hs-sites.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

x-amz-meta-cache-tag
F-156684171139,P-3375217,FLS-ALL
age
311139
x-amz-request-id
6CVHYV1BN0XHZNBN
x-amz-server-side-encryption
AES256
edge-cache-tag
F-156684171139,P-3375217,FLS-ALL
x-amz-replication-status
COMPLETED
content-disposition
inline; filename="RL%20Bluebird%20Pop%20up%20Spectra%20Assure%20750x900.webp"
x-hs-cf-lambda
us-east-1.EnforceAclForReads 3
cf-bgj
imgq:85,h2pri
etag
"f2b489f9c7c151aff58604b5eb159155"
vary
Accept, Accept-Encoding
access-control-allow-methods
GET
content-type
image/webp
access-control-allow-origin
*
x-amz-meta-created-unix-time-millis
1707839659009
cache-control
s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag
all
x-hs-cf-lambda-enforce
us-east-1.EnforceAclForReads 3
date
Wed, 21 Feb 2024 15:41:40 GMT
via
1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-version-id
.FyxZF0Zr7D14ubEICBu.Rq5zLC8KhQy
x-amz-cf-pop
FRA56-P7
x-hs-alternate-content-type
text/plain
cf-polished
qual=85, origFmt=jpeg, origSize=491844
x-cache
RefreshHit from cloudfront
cache-tag
F-156684171139,P-3375217,FLS-ALL
x-amz-meta-index-tag
all
x-amz-storage-class
INTELLIGENT_TIERING
content-length
78626
x-amz-id-2
LH2HD77mVmhPK078G6O6PSGK0bXSGf5LChkWTZ86ZmfuvbKrnuTYlgkJplNebagY/KltFe+npKtJDzxK5eTaxw==
last-modified
Tue, 13 Feb 2024 15:54:20 GMT
server
cloudflare
accept-ranges
bytes
cf-ray
859018467d1a03b0-FRA
x-amz-cf-id
ZFwwZVobTH6jeIBvXoriyvPMZ8FIrKAZToiYkjitYforFcQuUxSc9w==
embed.js
static.hsappstatic.net/content-cwv-embed/static-1.388/ Frame 6D28
14 KB
5 KB
Script
General
Full URL
https://static.hsappstatic.net/content-cwv-embed/static-1.388/embed.js
Requested by
Host: 3375217.hs-sites.com
URL: https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34942d531ecf961a2a6777526aef0c7d17f28a4ce9afcac868eb132c700bfe5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://3375217.hs-sites.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
x-amz-version-id
GNgANes_HpxlXMl5IDFfVeYnBgfaeeYN
via
1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA60-P6
age
1590220
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 15 Aug 2023 19:48:57 GMT
server
cloudflare
etag
W/"8741985292d64b839be39c64b14f3783"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y9miWluHzJy2NH9cSELuzzlj6N%2FahEWatUlKiXXyCfpIYOOEPQI2QQWoYW33hyrGd7zQHy0QD0H3VQyGLg2iXK6WXXMXQM4YwTjDksyFKZ1TN69B9Hu1igCBrTzh9ZeeVe4t0suK11uz8fGzDsrej6VshIU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
85901846aa735d61-FRA
x-amz-cf-id
ppDI2fVVjn9H1jQ1zgLMc3siIb_P-OchPddgUdUA-KB_zV9aIDwDsw==
expires
Thu, 20 Feb 2025 15:41:40 GMT
project.js
static.hsappstatic.net/cos-i18n/static-1.53/bundles/ Frame 6D28
1 KB
1 KB
Script
General
Full URL
https://static.hsappstatic.net/cos-i18n/static-1.53/bundles/project.js
Requested by
Host: 3375217.hs-sites.com
URL: https://3375217.hs-sites.com/hs-web-interactive-3375217-156662841132
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://3375217.hs-sites.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
x-amz-version-id
P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
via
1.1 218c6128df18321f9758e53ccc351448.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA60-P6
age
2369594
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 09 Nov 2021 16:12:42 GMT
server
cloudflare
etag
W/"61ca66de658cab9587e4636894680d5d"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vg0sGVSjJAeaXFU5jfFA%2BHNUbz9VBrKOHEW4JFKyCrcs9XpF2nSolUq717Rwf6uIJB%2FZOqBN9XQRwwwQc0jaokTPQ8OR0PXKupL3plwYsbky1SUZiT95M00vxHkxSVy9%2Fao81n4H9nPrr6eLYjG29oRhc6Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
859018467a3e5d61-FRA
x-amz-cf-id
KD6ejsUOx7vO80pg-7J6M7VyxQt6eOrR9osF9k8iJlicpkUYhKsHUg==
expires
Thu, 20 Feb 2025 15:41:40 GMT
counters.gif
perf-na1.hsforms.com/embed/v3/
35 B
664 B
Image
General
Full URL
https://perf-na1.hsforms.com/embed/v3/counters.gif?key=interactive-shown&value=1
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
7d81cf32-88e5-46ae-aeb9-c21104e4a241
x-envoy-upstream-service-time
1
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
7d81cf32-88e5-46ae-aeb9-c21104e4a241
last-modified
Wed, 21 Feb 2024 15:41:40 GMT
server
cloudflare
x-trace
2BD20927115A13C7351FDF8312C18D376919CB964A000000000000000000
vary
origin, Accept-Encoding
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-s6b6d
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
accept-ranges
bytes
x-robots-tag
none
cf-ray
85901846db391e4a-FRA
refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 94FF
600 B
624 B
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:57:49 GMT
x-content-type-options
nosniff
age
27831
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
600
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Wed, 28 Feb 2024 07:57:49 GMT
audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 94FF
530 B
554 B
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/audio_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 19:17:32 GMT
x-content-type-options
nosniff
age
159848
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
530
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Mon, 26 Feb 2024 19:17:32 GMT
info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 94FF
665 B
689 B
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/info_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 11:42:02 GMT
x-content-type-options
nosniff
age
532778
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
665
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Thu, 22 Feb 2024 11:42:02 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 94FF
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:46:35 GMT
x-content-type-options
nosniff
age
28505
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:46:35 GMT
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 94FF
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 17:34:06 GMT
x-content-type-options
nosniff
age
166054
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15340
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 18 Feb 2025 17:34:06 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 94FF
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 13:40:25 GMT
x-content-type-options
nosniff
age
525675
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Feb 2025 13:40:25 GMT
Mm4kFZLLjkD0sbKo4FoYHdq4eBWr_78n4J5vVann3bY.js
www.google.com/js/bg/ Frame 94FF
17 KB
7 KB
Script
General
Full URL
https://www.google.com/js/bg/Mm4kFZLLjkD0sbKo4FoYHdq4eBWr_78n4J5vVann3bY.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
326e241592cb8e40f4b1b2a8e05a181ddab87815abffbf27e09e6f55a9e7ddb6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:42:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
28765
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6949
x-xss-protection
0
last-modified
Mon, 05 Feb 2024 17:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 07:42:15 GMT
payload
www.google.com/recaptcha/api2/ Frame 94FF
49 KB
49 KB
Image
General
Full URL
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA7oNHCagDrjeEnF3DtzBrXNwMIjal8y4P_v76jRoM8DUdPm7TIxuJxnJb3wfuxRhqG9SjtwthdFkGtDihfxM2_3hXp_mmR-RhXN9vOgTd0sbCPeCNpAxAIgJEt3AER9Q4tA5SjuO6CoOhdmh-_40ID_4MXkqvb0_VwvOgDrW-oJ-1Qe5d_y2fircXU8LP4Q0ek3hFOBSGQFfwY8zOFDRNujah1zxzNplYIdmtX5xgiKmfWsOuo&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Requested by
Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
5c2355ee2b0b0198b68af78b7f863efeaf4563ee7d60fe385735f76d831e92be
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
content-security-policy
frame-ancestors 'self'
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
private, max-age=30
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Wed, 21 Feb 2024 15:41:40 GMT
verify
snid.snitcher.com/ Frame
0
0
Preflight
General
Full URL
https://snid.snitcher.com/verify
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.194.13.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-13-162.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.reversinglabs.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
0
apigw-requestid
Tfj0OjCaFiAEM0w=
cache-control
no-cache, private
date
Wed, 21 Feb 2024 15:41:40 GMT
vary
Access-Control-Request-Method, Access-Control-Request-Headers
verify
snid.snitcher.com/
6 B
148 B
XHR
General
Full URL
https://snid.snitcher.com/verify
Requested by
Host: snid.snitcher.com
URL: https://snid.snitcher.com/8423336.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.194.13.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-13-162.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
d9ea8a8cab935e18796b1a064b1644c0f5db2d967a60e5f7cb8b37066b2399a4

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
*
date
Wed, 21 Feb 2024 15:41:40 GMT
cache-control
no-cache, private
content-length
6
apigw-requestid
Tfj0PhNhFiAEMMA=
content-type
application/json
up
insight.adsrvr.org/track/ Frame FFDE
0
60 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&upid=8t4axvj&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
0
content-type
text/html
date
Wed, 21 Feb 2024 15:41:40 GMT
server
Kestrel
__ptq.gif
track.hubspot.com/
45 B
713 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=696607268&v=1.1&a=3375217&pi=157537033740&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&cpi=157537033740&cgi=5901382633&lpi=157537033740&lvi=157537033740&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&t=Attackers+leverage+PyPI+to+sideload+malicious+DLLs&cts=1708530100426&vi=980189b068f771889038909e0ed6490c&nc=true&u=60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1&b=60854195.1.1708530100424&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
43f170cb-0b9c-4752-9a6e-2b4beb125a41
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
6
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
43f170cb-0b9c-4752-9a6e-2b4beb125a41
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6qiH6GAQxHbT7dEp9Cox4aHrMaHMF5Sgs1X95aGMbfZ6OF8YnZ7gsXjomD6BjJvqPBhFHYQMAWg6FQV9neeWhc8f0LY3HRpmAFMjiG5HFObIhARtcoQn3GzxKqxFSTWPbXUHMKuuCmkn9BswW1E"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-scd75
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
85901847aa7668fb-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
448 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=a37a1b2b-8ac7-4e0f-8c63-e6ee3e8c8982&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=696607268&v=1.1&a=3375217&pi=157537033740&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&cpi=157537033740&cgi=5901382633&lpi=157537033740&lvi=157537033740&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&t=Attackers+leverage+PyPI+to+sideload+malicious+DLLs&cts=1708530100427&vi=980189b068f771889038909e0ed6490c&nc=true&u=60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1&b=60854195.1.1708530100424&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
40337710-3bf3-432b-89ce-860e16196626
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
20
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
40337710-3bf3-432b-89ce-860e16196626
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iToCp55j7k3mnq8KrifHdaLy7sVyi8yI46dREQH%2BRxLsSND4UXTlC4pB0yiuNVDavYZ48RK9ahT3pogYuCIq%2FYSC2Ub%2FK8jxlWzruvRIDPOD1%2FZKpPbP2v8FeskcleOGdjEOhZIu2UHLSq0V9SRJ"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-k2d59
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
85901847ba8668fb-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
466 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=a37a1b2b-8ac7-4e0f-8c63-e6ee3e8c8982&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=696607268&v=1.1&a=3375217&pi=157537033740&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&cpi=157537033740&cgi=5901382633&lpi=157537033740&lvi=157537033740&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&t=Attackers+leverage+PyPI+to+sideload+malicious+DLLs&cts=1708530100427&vi=980189b068f771889038909e0ed6490c&nc=true&u=60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1&b=60854195.1.1708530100424&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
da2c7b9d-1d18-4af2-baa7-927c44b7b81f
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
22
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
da2c7b9d-1d18-4af2-baa7-927c44b7b81f
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WxlNyhg3g%2BkYYCf5d3CxwnaWNryiRCq9R1OON80MNC9xgRBKVieSpuEWw%2Buu6Myu9t61yB7WAGurU%2B1d9lwo%2FS1Vp2oZQTAZGEQTgyfyrRfzgZAO1aL931DT5tJCC%2FZyXDmnKJ5Un9B%2BRX3Wqspq"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-m8f89
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
85901847ba8a68fb-FRA
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/
178 B
1 KB
XHR
General
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=980189b068f771889038909e0ed6490c&__hstc=60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1&__hssc=60854195.1.1708530100424&contentId=157537033740&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ead1791e8d1f8e71c757cc19b02e482345103104974c7a0104dcf04bd679e80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
76da8c71-ff0f-4a52-ba48-e74124cfb168
content-encoding
br
x-envoy-upstream-service-time
79
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
76da8c71-ff0f-4a52-ba48-e74124cfb168
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reversinglabs.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDH49AYhtyaVjB1G2ErNIeRqJ2oUdnrSs973FrXFNFiKdtQpJ09fMxcOUOzfYCQby%2BNcz%2BlOCJF5zSWVZChrN90%2BD7WG4RPMSANFIsjzwWVipnkgWj%2F3qxdW44kiw6EThDoiARI5jEseJJDj4Y9n"}],"group":"cf-nel","max_age":604800}
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
859018480c2519a9-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-bfd765d7d-whsh6
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A39%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=G-JVM9Z1XQPL&v=3&t=t&pid=287565060&cv=3&rv=42h0&tc=23&es=1&e=gtm.load&eid=10&u=AgAAAAAIAAAAACA&h=Ag&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:40 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A40%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
blank001.gif
static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/
Redirect Chain
  • https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=299104568595&containerType=SLIDE_IN&portalId=3375217&audienceId=46604739&campaignId=e339ca4a-4aaf-4a94-bb...
  • https://static.hubspot.com/img/trackers/blank001.gif
  • https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
43 B
640 B
Image
General
Full URL
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
Protocol
H2
Server
2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:43 GMT
via
1.1 13ad77f5993668d67b8168f460ba6368.cloudfront.net (CloudFront)
x-amz-version-id
MFfZlkR4U8_6aknbgflTSIqo4fNbniK3
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
1349110
x-amz-cf-pop
FRA60-P6
cf-polished
origSize=49, status=webp_bigger
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-length
43
cf-bgj
imgq:85,h2pri
last-modified
Thu, 15 Apr 2021 16:47:19 GMT
server
cloudflare
etag
"51416c7ff0b9d7efc8c9b16d84052fab"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hu%2BwvMitOT9%2B7LJFY6DBA3ls3NJXrnLRu8zNUNEmHe3XXmj%2BHp35dj7uNyUk%2Fl8SrX8M4oigaCPwsSPXKgdW1KV%2B3lsHXMV94URuLRRg8U0EytGUPhldMqnrYclCDkTKgEYZT797pQ07tTLOWnGcKYIDfz0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
859018582b245d61-FRA
x-amz-cf-id
QLXuUtjHp7xruHJSU2Cv40tpGDPpSzUqvVN7nY6Wfdhn78nvB9tZbw==
expires
Thu, 20 Feb 2025 15:41:43 GMT

Redirect headers

date
Wed, 21 Feb 2024 15:41:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8pPQ8qQ55kHsXAls7Mfs3dBIU2FR3iLuEaOW%2F8HOoJFbQLW64VRa%2BBdLOzJlporAxprSpZaKcl%2F00REK%2FZV493TRISNCRp3S7Jdno83G%2B1zLPSLfu8KHqyYqrf%2BHdBNfZjpTzH0SBxbGqeECsia6zA%3D%3D"}],"group":"cf-nel","max_age":604800}
location
https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif
cache-control
max-age=3600
cf-ray
859018580b6d68fb-FRA
expires
Wed, 21 Feb 2024 16:41:43 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A42%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:43 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&visitor=07534409-99d2-4c56-848c-b4fe70f9b2ed&session=e013399c-6427-4ca1-86d9-f8954715cd70&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Feb%202024%2015%3A41%3A43%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225004%22%7D&isIframe=false&m=%7B%22description%22%3A%22RL%20discovered%20two%20malicious%20PyPI%20packages%20and%20a%20larger%20subsequent%20campaign%20of%20packages%20%E2%80%94%20highlighting%20that%20DLL%20sideloading%20is%20an%20emerging%20method%20for%20software%20supply%20chain%20attacks.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Attackers%20leverage%20PyPI%20to%20sideload%20malicious%20DLLs%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Fattackers-leverage-pypi-to-sideload-malicious-dlls&pageViewId=0b1c33bc-068b-4d44-805d-a2b100f0cf2e&v=1.1.14
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.40 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-40.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 15:41:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

145 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 function| launchLightbox function| hj object| _hjSettings object| dataLayer function| fbq function| _fbq object| __core-js_shared__ object| Sslac object| IN object| vidyardEmbed function| setImmediate function| clearImmediate object| VidyardV4 object| Vidyard function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data function| rdt function| qp string| qpGtm object| _linkedin_data_partner_ids boolean| _already_called_lintrk object| GooglebQhCsO function| anura_custom_gtm_callback string| SnitchObject function| snid object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels function| onYouTubeIframeAPIReady object| gaGlobal function| $ function| jQuery object| qevents object| Cookies function| tns function| SimpleLightbox function| hsSearch undefined| searchResults object| MicroModal function| onVidyardAPI object| hsVars function| hs_i18n_log function| hs_i18n_substituteStrings function| hs_i18n_insertPlaceholders function| hs_i18n_getMessage undefined| module_149435964191 object| hubspot object| HubSpotForms object| hbspt object| hsFormsOnReady function| lintrk object| ORIBILI object| options object| _hsq function| cookieinfo object| cbinstance function| ttd_dom_ready function| TTDUniversalPixelApi object| Metadata object| _hsp function| jsonpHandler object| _6si undefined| $checker number| tnsId object| namespaces object| FB boolean| hubspot_live_messages_running object| HubSpotConversations object| __twttrll object| twttr object| __twttr boolean| PIXELS_RAN object| enabledEventSettings object| hsCookieBanner boolean| _hspb_loaded boolean| _hspb_ran object| __hsCollectedFormsDebug object| globalRoot undefined| hns function| bindToWindowOnError object| leadflows function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| __buffer object| hsCtasOnReady object| __PRIVATE__HubspotCtaClient object| hsCallsToActionsReady object| __hsWebInteractiveInstance object| HubSpotCallsToActions boolean| hubspot_web_interactives_running function| hsRecaptchaLoaded_a37a1b2b_8ac7_4e0f_8c63_e6ee3e8c8982 object| _paq function| sanitizeKey boolean| _hstc_loaded object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| closure_lm_566300 object| ziws string| snWid string| snSnid string| snHost string| snSpotterToken boolean| snHasGaConnections object| snGaConnections number| pagetime_count string| page_uuid string| prevLocation string| session_uuid string| snid_id boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN

37 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09AO4XG76ojleu5XsIwCT1LfAIHoJHf1jOuhuIg-5qnvSF_lpV_y6q6GiyMH1OPNV6L1qjpnA2tmF_QeIr1gQUKAg
.www.reversinglabs.com/ Name: __cf_bm
Value: EuuN9cNXMj6hYa2HkzHIieXd8zO3Ku.IE9uQ81C.W0w-1708530099-1.0-AY+eUwKikekPF52Key8zPt50XTbEDef39+pzFqzU9zFXh0HLRy3TZktnWuPIz2yYRZFh4Hd0l7hSpZ64f8E2I/k=
.www.reversinglabs.com/ Name: __cfruid
Value: e9c200ecfe5cd3805a94f921ad713c218c69daa6-1708530099
.reversinglabs.com/ Name: _fbp
Value: fb.1.1708530099412.2059853999
.reversinglabs.com/ Name: _gcl_au
Value: 1.1.1056620481.1708530099
.reversinglabs.com/ Name: _rdt_uuid
Value: 1708530099463.f02ed524-7477-4824-a51b-0c3fedf7ab3d
.reversinglabs.com/ Name: _ga_JVM9Z1XQPL
Value: GS1.1.1708530099.1.0.1708530099.60.0.0
.reversinglabs.com/ Name: _ga
Value: GA1.1.384745464.1708530099
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
www.reversinglabs.com/ Name: Metadata_visitor_id
Value: lsvypi09xnlabqw27ha
www.reversinglabs.com/ Name: Metadata_session_id
Value: lsvypi09k0t7tegb8fm
tracking.g2crowd.com/ Name: _session_id
Value: 2237b27b51deb99121d591e77854f3cd
.g2crowd.com/ Name: __cf_bm
Value: 0R1S3chUaz02odvQurbnzcODBuXIhvcbdxCrhp9dC9s-1708530099-1.0-AYVWVdQFJbAcNxrNDXDvBSmUU/db0dXzW2JBsEkn1RUpUCqplufSitAG4KpXNvaZ/h0pkaGkD0EYIy8Fg4P9GEU=
.reversinglabs.com/ Name: _hjSessionUser_3176008
Value: eyJpZCI6ImFlNmJkNTI2LTEwMGYtNThiYi1iMzRhLTdjZDBhNDlhYTdjNiIsImNyZWF0ZWQiOjE3MDg1MzAwOTk2MzcsImV4aXN0aW5nIjpmYWxzZX0=
.reversinglabs.com/ Name: _hjSession_3176008
Value: eyJpZCI6ImQ5NWYwNzQ1LWI5ZTQtNGE4YS04ZjIzLWEwZjRhYzJhMzUzYyIsImMiOjE3MDg1MzAwOTk2MzcsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.linkedin.com/ Name: li_sugr
Value: bd9a1919-0ead-436d-9e8a-9079d77431c5
.linkedin.com/ Name: lidc
Value: "b=TGST07:s=T:r=T:a=T:p=T:g=2745:u=1:x=1:i=1708530099:t=1708616499:v=2:sig=AQE1n81uaPoVplHdGVolyGk7pB4e5D31"
www.reversinglabs.com/ Name: _gd_visitor
Value: 07534409-99d2-4c56-848c-b4fe70f9b2ed
www.reversinglabs.com/ Name: _gd_session
Value: e013399c-6427-4ca1-86d9-f8954715cd70
.hubspot.com/ Name: __cf_bm
Value: g6Frx2ElViAlRfDBejiFh5v3MM3yhllz4k.yjIBKBns-1708530099-1.0-AQQc3ZHvHQpMZ37Xlfvs/OT5uOK1qCPPXhDO5/KV6+nROMfx5O8D0yKFYb1Vxj+NoFcGsL/zfaMaaOJNqIIDZR4=
.hubspot.com/ Name: _cfuvid
Value: SGaZtX9CUn3j9uPJpb3y_EV7QjyelXNlsG9BAJERGcY-1708530099791-0.0-604800000
.linkedin.com/ Name: UserMatchHistory
Value: AQK6yTwiwqJqAgAAAY3MVGZdjVvx1V7fGsawdYAPZOSi8k1s1lwAh-WWjVEwTd33cfOyg_XlOQho6A
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQL9ib96Zwp9QwAAAY3MVGZdmTapNYe_nCxFEokUsAvKs6RDAKGCURT3b3rSblwd3h13DcjY86heK1Pzwh2GVw
.linkedin.com/ Name: bcookie
Value: "v=2&e6df1226-398d-45f0-8d2f-d8eae63c9642"
.ws.zoominfo.com/ Name: visitorId
Value: d130ff0fe693390f2495407e17a0b9733f06fab90588bd334ca59151fdb7f0bc
.zoominfo.com/ Name: __cf_bm
Value: Bo05Qb3VvST24koaznMAFQDqIjc5IN1afiWpa5i2.bs-1708530099-1.0-AaDKT/4KnerpJalagmp8GldgNnybeW2WhmMkFt/fd4ixBVbOsIuoyWhh9aiB/XsGqgHwc7bG5aSLersiqoNugb4=
.zoominfo.com/ Name: _cfuvid
Value: YgbzCaAxyU4DwI_AeNMhA80zQnO2fvxWF2HbNZliuQ0-1708530099912-0.0-604800000
.6sc.co/ Name: 6suuid
Value: 246410027a402600b319d665e203000012260e00
.www.linkedin.com/ Name: bscookie
Value: "v=1&202402211541395a72e376-4b71-4771-839b-be7226736129AQHOfh4fdpWIX71W-Fpf9IPcwZ6EY1o5"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MDg1MzAwOTk7MjswMjGD2yc1PPPWD4rxq/GWS3+1kUHuJMCJe1x/Oi00QvX4/Q==
.a.usbrowserspeed.com/ Name: tuid
Value: d49341c6-e6b1-4326-b21d-e999a3893431
.hs-sites.com/ Name: __cfruid
Value: 7b55768a4a71549eb70cc8b9aa4c3185fded95f0-1708530100
snid.snitcher.com/ Name: SNID
Value: eyJpdiI6InBaenQ3SEZLRGtyajRmYW95MnNjYkE9PSIsInZhbHVlIjoib1l6VWFFSW5wZ25idW1jZHh4QS9vcVQ5andFUmlla1lCVjJBbFB2ZlVxVHNJRG41SGphSDNLTkhhTGdxTi9LWEFhTzZSNzdWRlZaM1dSb1E0b2lZZGU1cXFvOUdOZTJuQS9ROWhwSFFuNXdHMVlaYUY5ZFN2L2krSzFmdUdPengiLCJtYWMiOiIxZjlhYjQ3ODkyYWE1NjQxMDgzYWUwZWU0ZmIyODhjZjczMTFlOGE1ZDViNzU2MjZmMDM3MTlkMzg5YjQ1NzM0IiwidGFnIjoiIn0%3D
.reversinglabs.com/ Name: __hstc
Value: 60854195.980189b068f771889038909e0ed6490c.1708530100424.1708530100424.1708530100424.1
.reversinglabs.com/ Name: hubspotutk
Value: 980189b068f771889038909e0ed6490c
.reversinglabs.com/ Name: __hssrc
Value: 1
.reversinglabs.com/ Name: __hssc
Value: 60854195.1.1708530100424

75 Console Messages

Source Level URL
Text
other warning URL: https://connect.facebook.net/signals/config/1076912843267184?v=2.9.147&r=stable&domain=www.reversinglabs.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
network error URL: https://script.anura.io/request.js?instance=1480878102&1708530099434
Message:
Failed to load resource: the server responded with a status of 403 ()
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls(Line 1403)
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.reversinglabs.com/blog/attackers-leverage-pypi-to-sideload-malicious-dlls
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
3375217.hs-sites.com
a.quora.com
a.usbrowserspeed.com
alb.reddit.com
api-gw.metadata.io
api.hubapi.com
app.hubspot.com
b.6sc.co
c.6sc.co
cdn.metadata.io
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
cookieinfoscript.com
cta-service-cms2.hubspot.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
google.com
googleads.g.doubleclick.net
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
js.usemessages.com
perf-na1.hsforms.com
platform.linkedin.com
platform.twitter.com
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
script.anura.io
script.hotjar.com
snap.licdn.com
snid.snitcher.com
static.hotjar.com
static.hsappstatic.net
static.hubspot.com
stats.g.doubleclick.net
syndication.twitter.com
track.hubspot.com
tracking.g2crowd.com
ws.zoominfo.com
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.redditstatic.com
www.reversinglabs.com
104.244.42.200
13.107.42.14
151.101.129.181
151.101.65.140
162.159.152.17
18.169.22.210
18.172.103.101
18.173.154.87
18.194.13.162
2.16.100.40
2001:4860:4802:32::36
2600:9000:26db:d600:9:d7d4:1380:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:2c40::c73c:67e1
2606:4700:4400::6812:297c
2606:4700:4400::6812:2b1f
2606:4700:4400::ac40:991b
2606:4700::6810:50ba
2606:4700::6810:6ed1
2606:4700::6810:880f
2606:4700::6811:190e
2606:4700::6811:5a9a
2606:4700::6811:ae5d
2606:4700::6811:c9cc
2606:4700::6811:e4a3
2606:4700::6811:eff9
2606:4700::6811:fba8
2606:4700::6812:7b0c
2606:4700::6812:a07d
2606:4700::6812:b05d
2606:4700::6812:c07d
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:800::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2003
2a00:1450:4001:812::200a
2a00:1450:4001:829::2003
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2004
2a00:1450:4001:82b::2002
2a00:1450:400c:c00::9a
2a02:26f0:3500:16::215:148e
2a02:26f0:3500:16::215:148f
2a02:26f0:480:22::1726:62ed
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42::396
2a06:98c1:3121::3
3.162.38.9
3.33.220.150
35.160.37.98
35.166.97.53
52.205.58.74
03c30b3cb8bfcb6c97b324ef18840cebdbe696a9f50ad21285329699a6d6bd01
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
0bf120dc0e1bbc267cc9af35fcd1248a162e349f98c40cce021012237cb12a2e
0c4f34835286016b8c67a4b25c7219fc541baf2948124fe91dfbb354594ed2db
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
1039d8c6d5ca0ae27a058e460a3496ac932a0ed7b21496e3a7be5063c605ac5a
115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491
128d180fa7acfd1ff703533b57f11a3bf2b4390c9e8cf5f3651ee11b1cc43205
1697c3d4408d4f4f4f5155efcd03ce7cb614f6d4c73aca1baf76f9de2bbb00d0
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1dcebc5250019387a265ba565f3bb38b30024036bb64e04ae17f656ee40f7848
2043672fcf923c51955997fd7bc3d3c01834d8677709f65968247f14304fa95a
24851f7032cc4a3a7e7de029c023b48764d2b373e04300008b071d6abd0b163e
2939d067bced6e2e3e43c1b10d2b067cb980410c2cc42fd3e867798a4a36c697
2af3f1d7f94ab4dd9772778426b29f7dcc94932d4cd320a81ed087698dad53cd
2b5a703f44531104e5a322715c1f9189d2a2214d6d69b71ab444545adc47a4b4
2d0ca0f78af88fdc1a9f0a429cfdd7b14c4d363fbbe77099c393c6891c0544b2
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
2e8ac193dd69f6561479a2c46c7089f5b1c66c4afa36ec74958be270e25e3db3
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
3081dc10908da87863cf4f5b3e1bc6f7300b810364d337622f12773b24fc520e
31f4db27d40c17ddd30179d71bfc7cd0ab6ce459c46e2a935609acf3cba1e295
326e241592cb8e40f4b1b2a8e05a181ddab87815abffbf27e09e6f55a9e7ddb6
3455c96d0ff6f3666306a3dcbebdb0a38cd0096564208fde7efceca139c68af8
34942d531ecf961a2a6777526aef0c7d17f28a4ce9afcac868eb132c700bfe5a
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
356bb4bf2245a68ee5de5732b5574260dd2016a2c3987e17ad97fb2586a883d1
36e95bc88b89ba6d134e6634348d7366c3aaf7a7f0bee5102d649457d19c4988
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3ead1791e8d1f8e71c757cc19b02e482345103104974c7a0104dcf04bd679e80
3ffbddacb6e7a4d9c576969656ca7236d2d65d287da5a69c13645a776b2aee35
4042fa3e443281692f19c5b9e8238ab4b567a07fe5f30d6d706eaea65989f3f5
4056eaf916b02748614fcbacbe3ac5ccafee050fc24b17ca5a93a71a233788ca
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
44dbbb0a1da3d1a2b3f637ba2eff82150de83164b3caf824fc0fc46633588de3
46c40fb973de87b70f9c738df7e9dc501f85fda35e5aac8aead035ee6957a625
49ccd6ef67a5506a1c8ae4ca61d9bcc2d3fcd8b70dc6ce7ef7ee8977a49856ff
4ef227993e9cb6511ce89e4318830761c939c639aff7d3334c641b458bfcbbba
53aee3f9c27bd8fb1e557580ef17b33e114ea63736d6bdfae75c28726bc78c7d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5bc9121badd59a61d7f4a9fd5a1e57c14e4f9a709663c6220c8e229da3e44375
5c2355ee2b0b0198b68af78b7f863efeaf4563ee7d60fe385735f76d831e92be
5fcfe413e637375e4d9faedb78c76e14bf0b2ba429c2a962665ab5ca17441e0e
654bedb35fd51e7fae840f82579fc43fdebbaec7343b7a6f385421aa99c5ade2
6767c2fe6d7e1ad86580596bf56802fe8bdd92698be3ae701f5f9d440aa1339f
67a2ef843448fd18bbff44f59c6347d9ac79b757722a14988efbc9210a02e0a4
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
70c00445d6632039ed99af760731daf3bf60eb12061863ee61e2cd7276a54d18
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
77af0a963d2016e3165d4e70050e60f0054e70ed0dba5ae5c2be14bcccbff207
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7a94e1fd7de26b8bd3e63fc666c3d79bbe010fcbc98732cd4c617f99d413b99d
7cfd62a134cdab910bf1fde5f6aee5b28bb00d29b020ddcb53fbd3d437043256
7f68888d176abdd375ce03f254182db6e0a6706b04fadbae9f32bd85521a3d97
80663b7d03f283b27d8d833ca725a43d5cd3d5b5a7dd6487970dca9469f9c139
816360b9246cc268283dad1c2dae8f48e40df1cee8b234412201f4a03541e4a2
823eb2b70ea4cd85173dfb8bab628f97a8b27f18606efbe31f447867d2cd49c0
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
89f1a01bdefa7a1d5ce3632bf7ac23bd6c16ee252987e78320895ecc43a9e43d
8cede167f8e0eb1a742b600847e11c36e71ca6f8a2392c2474f31387b0cd5f4c
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
92b7d2521a258609fb0fd998b5db42022bc54c9f71faf87511488582ecc4ebdc
99422095a0a321c15136d54e3c37b3aed5675895480781218f738496eb60f96a
9ab4c8c55c27b0a3a2d019af3aff563e65aed515ac59352f9808c27212d33f6c
a0eb564e8b104002217b23d191c384d64d77b30fa37b0f124db645e16096cfd3
a368adf977b467eb8e874f2b3958f3e5363e8c441f9ecd6e08516f8095ec732b
a971a1b8a77930e6428838ba6f9f32438422ff3c4e97f0a692a7e704abbbc225
afcb95431b4036fd54fe79de411493352c550220beb8328f459663da5bc1b552
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b076e86301cbee8c5c9aef51863a9c0a88e6f6d2aabdffca93e031113c6caa74
b1c6faa5c00cccc8c96c246f728a6dd9340a8ffc4146584259f9acf171b13775
b507f3c39812daa5502135bde16efb258985358be5228244edea29b83761dd66
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bca7640b96e8bc5e480ba56c1509be51f7ff85bd7c6f7c8ba718584ee014f325
bfb764d9df6c95a2a592195bca9ffba538ee6a47301aca6343ae7d4b26e1ec69
c2a101f313f27c267a744088e44664a87d2ec7dc2a3464bf1319a95094dc76db
c39ec2c79dfda63505bb21c8d372efd21ffe96652221aaf8853901d39a9ba6c2
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
c96ffd41ebeae752a5c45a0ef1f924dd5273c09f71453d4d158e54d8610e64b8
cca56635d8b60422a95ec52208e3dde8b9760490e39d3b63932ec963b16d8f61
d1de799ec3c2d3f26217fc03ca2596b6fb1a89565221360493de21ae75b91381
d8865a5cc2331c6d0d661017cde904dc6a19753c0ed178dbbcf104ac8c7df798
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
d9ea8a8cab935e18796b1a064b1644c0f5db2d967a60e5f7cb8b37066b2399a4
da0183f97db8d8d2af9a74abfdf38270689dec5cc34c7b0ec229ba69e9bcc756
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e492e5bd630a86a679a9ead911fc5e1e155d75098344c375131c40470e97396d
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
e9841d9258210b13f0870a80d02ce8f3224c8798d1c0d618f210a573ce96038e
e9b8906a8b7540b8accfd2a491c0821d6bd6d8ccbd4ab53a56da8906ff028423
ecdd82fe677d7643614f490e727c913fbaa86d9c74f89651a611ca3349062e63
ed494b949fc8d336fd3202e09bf19a84014bfbae61c89993da76f2f35dd6eaae
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3e7e94fc36d961b807c8fa6c2bbbd5cf60a746a95c0d01f331d847156b198c
f21cac7faf25c912fb299aca317c87403c753ae72c04b5a0ff663e31f9a2bd28
f366636f36127d2b1058843b3d522a4ed46d82bb726716a6c83d1f30a8c023f0
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f9b683e35080765c2e29e6c8211dbaed29cd4755f4f9aea898a0a1940e101437
fa97d5a93f1d1e252fd0259295827c1a0713d434e3acbd2e33786adfceb534ce
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fd091571851b8cdb06a588dc6a11fa4552d07f9b095f8c60daa8303dcc524477
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe1bd72522e47500bbf691586c52219533d6de0801edee024de76ad787f12ae0
fef74616aa24738b68090a9710dc428553b2d3e01c97d04150477cfabed0dd44