www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:671f Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Submission: On June 21 via manual (June 21st 2023, 3:09:37 am UTC) from MX — Scanned from DE

Summary HTTP 151 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 52 IPs in 4 countries across 42 domains to perform 151 HTTP transactions. The main IP is 2606:2c40::c73c:671f, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.reversinglabs.com.
TLS certificate: Issued by GTS CA 1P5 on May 26th 2023. Valid for: 3 months.

This is the only time www.reversinglabs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
60	2606:2c40::c7... 2606:2c40::c73c:671f	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	151.101.129.181 151.101.129.181	54113 (FASTLY) (FASTLY)
1	2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6812:cfc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2606:4700::68... 2606:4700::6812:f0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8d65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.138.15.119 108.138.15.119	16509 (AMAZON-02) (AMAZON-02)
1	52.222.236.27 52.222.236.27	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	18.66.97.37 18.66.97.37	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	52.222.236.63 52.222.236.63	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
1	2600:9000:223... 2600:9000:223c:cc00:9:d7d4:1380:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.22.155.139 52.22.155.139	14618 (AMAZON-AES) (AMAZON-AES)
2	63.134.242.129 63.134.242.129	14992 (CRYSTALTECH) (CRYSTALTECH)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
5	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	95.101.111.184 95.101.111.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.213.12.174 52.213.12.174	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6811:d5f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
6	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c03::9a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:26d... 2600:9000:26db:ca00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
1	54.194.204.236 54.194.204.236	16509 (AMAZON-02) (AMAZON-02)
1	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2606:4700::68... 2606:4700::6811:d4f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:6dc7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8ace	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:18c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:816e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:75be	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:65ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:c8cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
151	52

60 2606:2c40::c73c:671f (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.reversinglabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.181 (United States)

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:cfc9 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6812:f0f (United States)

ASN13335 (CLOUDFLARENET, US)

3375217.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8d65 (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

cookieinfoscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.15.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-15-119.fra56.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-27.fra56.r.cloudfront.net

vidassets.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-37.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-63.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:cc00:9:d7d4:1380:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.metadata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.155.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-155-139.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.134.242.129 (United States)

ASN14992 (CRYSTALTECH, US)
PTR: www.visitortracklog.com

code.visitor-track.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 95.101.111.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.12.174 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-12-174.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d5f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c03::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:26db:ca00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.204.236 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-204-236.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.215 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d4f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:6dc7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8ace (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:18c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:816e (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:75be (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:65ac (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c8cc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	reversinglabs.com www.reversinglabs.com	1 MB
10	hubspotusercontent-na1.net 3375217.fs1.hubspotusercontent-na1.net	176 KB
7	6sc.co j.6sc.co — Cisco Umbrella Rank: 6484 c.6sc.co — Cisco Umbrella Rank: 9628 b.6sc.co — Cisco Umbrella Rank: 4269	12 KB
6	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2890 www.google.com — Cisco Umbrella Rank: 3	929 B
6	gstatic.com fonts.gstatic.com	91 KB
6	linkedin.com 4 redirects platform.linkedin.com — Cisco Umbrella Rank: 3336 px.ads.linkedin.com — Cisco Umbrella Rank: 408 www.linkedin.com — Cisco Umbrella Rank: 563 px4.ads.linkedin.com — Cisco Umbrella Rank: 6542	165 KB
5	hubspot.com app.hubspot.com — Cisco Umbrella Rank: 5566 track.hubspot.com — Cisco Umbrella Rank: 2462 forms.hubspot.com — Cisco Umbrella Rank: 4653	4 KB
4	twitter.com platform.twitter.com — Cisco Umbrella Rank: 959 analytics.twitter.com — Cisco Umbrella Rank: 721 syndication.twitter.com — Cisco Umbrella Rank: 1131	132 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	376 KB
3	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4470 forms-na1.hsforms.com — Cisco Umbrella Rank: 7472	3 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60 region1.google-analytics.com — Cisco Umbrella Rank: 1832	21 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 749 script.hotjar.com — Cisco Umbrella Rank: 1067 in.hotjar.com — Cisco Umbrella Rank: 5501	74 KB
3	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1589 insight.adsrvr.org — Cisco Umbrella Rank: 592	5 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4971 forms.hscollectedforms.net — Cisco Umbrella Rank: 5088	26 KB
2	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027	754 B
2	google.de www.google.de — Cisco Umbrella Rank: 4835	562 B
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 stats.g.doubleclick.net — Cisco Umbrella Rank: 124	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	89 KB
2	visitor-track.com code.visitor-track.com — Cisco Umbrella Rank: 173333	985 B
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3763	1 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 5195	22 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3542	3 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4538	87 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2377	16 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2379	21 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 476	817 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 5923	161 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1590	637 B
1	t.co t.co — Cisco Umbrella Rank: 504	377 B
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 5104	2 KB
1	quora.com q.quora.com — Cisco Umbrella Rank: 4155	418 B
1	metadata.io cdn.metadata.io — Cisco Umbrella Rank: 40061	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1426	8 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 768	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 960	5 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 80	1 KB
1	terminus.services vidassets.terminus.services — Cisco Umbrella Rank: 22885
1	cookieinfoscript.com cookieinfoscript.com — Cisco Umbrella Rank: 98572	4 KB
1	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 5963	5 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 263	27 KB
1	hubspot.net cdn2.hubspot.net — Cisco Umbrella Rank: 8780	2 KB
1	vidyard.com play.vidyard.com — Cisco Umbrella Rank: 14071	23 KB
151	42

	Domain	Requested by
60	www.reversinglabs.com	www.reversinglabs.com js.usemessages.com
10	3375217.fs1.hubspotusercontent-na1.net	www.reversinglabs.com
6	fonts.gstatic.com	fonts.googleapis.com
5	b.6sc.co	www.reversinglabs.com
5	region1.analytics.google.com	www.googletagmanager.com
4	www.googletagmanager.com	www.reversinglabs.com www.googletagmanager.com www.google-analytics.com js.hsadspixel.net
3	track.hubspot.com
3	px.ads.linkedin.com	3 redirects
2	insight.adsrvr.org	js.adsrvr.org
2	cdn.linkedin.oribi.io	snap.licdn.com
2	www.google.de	www.reversinglabs.com
2	forms.hsforms.com	www.reversinglabs.com
2	platform.twitter.com	www.reversinglabs.com platform.twitter.com
2	connect.facebook.net	www.reversinglabs.com connect.facebook.net
2	code.visitor-track.com	www.reversinglabs.com code.visitor-track.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	forms.hubspot.com	js.hsleadflows.net
1	api.hubapi.com	js.hsadspixel.net
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	region1.google-analytics.com	www.googletagmanager.com
1	www.google.com	www.reversinglabs.com
1	syndication.twitter.com	platform.twitter.com
1	js.usemessages.com	www.reversinglabs.com
1	js.hsadspixel.net	www.reversinglabs.com
1	js.hsleadflows.net	www.reversinglabs.com
1	js.hs-banner.com	www.reversinglabs.com
1	js.hs-analytics.net	www.reversinglabs.com
1	js.hscollectedforms.net	www.reversinglabs.com
1	forms-na1.hsforms.com	www.reversinglabs.com
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	content.hotjar.io	script.hotjar.com
1	alb.reddit.com	www.reversinglabs.com
1	analytics.twitter.com	www.reversinglabs.com
1	t.co	www.reversinglabs.com
1	px4.ads.linkedin.com	www.reversinglabs.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	in.hotjar.com	script.hotjar.com
1	j.6sc.co	www.reversinglabs.com
1	app.hubspot.com	www.reversinglabs.com
1	ws.zoominfo.com	www.reversinglabs.com
1	q.quora.com	www.reversinglabs.com
1	cdn.metadata.io	www.reversinglabs.com
1	www.redditstatic.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	static.hotjar.com	www.reversinglabs.com
1	fonts.googleapis.com	www.reversinglabs.com
1	vidassets.terminus.services	www.reversinglabs.com
1	js.adsrvr.org	www.reversinglabs.com
1	cookieinfoscript.com	www.reversinglabs.com
1	static.hsappstatic.net	www.reversinglabs.com
1	cdnjs.cloudflare.com	www.reversinglabs.com
1	cdn2.hubspot.net	www.reversinglabs.com
1	platform.linkedin.com	www.reversinglabs.com
1	play.vidyard.com	www.reversinglabs.com
151	59

This site contains links to these domains. Also see Links.

Domain
register.reversinglabs.com
support.reversinglabs.com
rli.reversinglabs.com
www.secure.software
www.npmjs.com
blog.reversinglabs.com
github.com
twitter.com
www.linkedin.com
www.youtube.com
www.facebook.com
www.instagram.com
cookieinfoscript.com

Subject Issuer	Validity	Valid
www.reversinglabs.com GTS CA 1P5	`2023-05-26` - `2023-08-24`	3 months	crt.sh
*.vidyard.com GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-09-27` - `2023-10-29`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2022-08-11` - `2023-08-11`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2023-04-06` - `2024-04-05`	a year	crt.sh
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3	`2023-01-26` - `2024-01-25`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
hsappstatic.net Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
cookieinfoscript.com E1	`2023-06-14` - `2023-09-12`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.terminus.services Amazon RSA 2048 M01	`2023-02-22` - `2023-11-14`	9 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
*.metadata.io DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-18` - `2024-01-07`	a year	crt.sh
*.quora.com R3	`2023-06-21` - `2023-09-19`	3 months	crt.sh
*.visitor-track.com Sectigo RSA Domain Validation Secure Server CA	`2022-10-18` - `2023-11-18`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-03-30` - `2023-06-28`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-06` - `2023-11-06`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh
6sc.co R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2023-03-02` - `2024-03-30`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Frame ID: BA1EBB1B5EA80ADF3C94B456A9F710BC
Requests: 148 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Frame ID: AD433FB9AD75DF5D7AA987C782CAD4BD
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&upid=8t4axvj&upv=1.1.0
Frame ID: BA169BD60DD1F1F85B53E22E07CD3A27
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&upid=8t4axvj&upv=1.1.0
Frame ID: FBC6DB9D183DFAA39165D739D5192A66
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RATs found hiding in the npm attic

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Lightbox (JavaScript Libraries) Expand

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

151
Requests

99 %
HTTPS

65 %
IPv6

42
Domains

59
Subdomains

52
IPs

4
Countries

2791 kB
Transfer

6104 kB
Size

38
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://register.reversinglabs.com/demo
Title: Demo

Search URL Search Domain Scan URL

URL: https://support.reversinglabs.com/hc/en-us/restricted
Title: Support

Search URL Search Domain Scan URL

URL: https://rli.reversinglabs.com/accounts/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.secure.software/
Title: Developer Portal

Search URL Search Domain Scan URL

URL: https://www.npmjs.com/package/agent-base
Title: agent-base

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_1.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_2.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_3.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_4.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_5.png

Search URL Search Domain Scan URL

URL: https://github.com/AliTefeli02/TurkoRat
Title: TurkoRat GitHub repository

Search URL Search Domain Scan URL

URL: https://www.npmjs.com/package/pkg?activeTab=versions
Title: pkg

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_6.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_7.png

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_8.png

Search URL Search Domain Scan URL

URL: https://twitter.com/reversinglabs
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/reversinglabs
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/reversinglabs
Title: Youtube play

Search URL Search Domain Scan URL

URL: https://www.facebook.com/reversinglabs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/reversinglabs
Title: Instagram

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/blog/rss.xml
Title: RSS

Search URL Search Domain Scan URL

URL: https://cookieinfoscript.com/
Title: cookie script

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 112

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1687316972577%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%252Fblog%252Frats-found-hiding-in-the-npm-attic%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJiDaEgEl2LJQAAAYjb7ci5VILohpZ5Kf4_chp72Q2RdmR-JlqY3bg0LrpbimX_iw

151 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request rats-found-hiding-in-the-npm-attic Show response
www.reversinglabs.com/blog/ 120 KB
25 KB 118ms
59ms Document
text/html 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

60081aded64161f61825305d90da71fccecd1a8bf5cbdd49204e074ba0cf3f5f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-ray: 7da90da14b7891ea-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 21 Jun 2023 03:09:31 GMT
edge-cache-tag: CT-115811496016,CG-3375217,CG-5901382633,P-3375217,L-11118979719,L-11735000539,CW-103636562700,CW-10782554896,CW-11119297579,CW-11395370497,CW-114796045952,CW-115016303498,CW-115021731904,CW-11538883136,CW-23776629869,CW-23799638916,CW-28186900061,CW-36845096476,CW-6520974104,CW-79001037452,CW-80857835930,CW-80864562095,CW-80864563080,CW-80868056874,CW-87757605656,E-10528761402,E-10777459487,E-11119463588,E-11190015046,E-11395370929,E-11395383304,E-11708570900,E-21052151416,E-23712622487,E-28203361861,E-38216899954,E-5951651806,E-6021532803,E-6021916068,E-6519964395,E-70521421874,PGS-ALL,SW-1,B-112999115134,B-5901382633,B-70179327783,B-94488163452,GC-103819429689,GC-115009898400,GC-115015365221,GC-115020232564,GC-25875947801,GC-25876057703,GC-26129507391,GC-28186555742,GC-80858624881,GC-80970810765,GC-80971492144,GC-81200326231,GC-87768577627
etag: W/"dfc37ae4eb23e7fbd132af8bc869b6fb"
last-modified: Wed, 21 Jun 2023 00:38:27 GMT
link: </hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js>; rel=preload; as=script,</hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hB8rk5xKGseBOzUWgPUmC4gq3Ph4nI4mXUc2N7TL3o7nBWj4LaQnp1OYIfdQMyVPk04w0AYnvfeDDu1gOAF6C%2F%2FUX3JcEUirZ6Zg19tfIsO%2B6vkJUyap%2FL%2FuCmleEkXRllyosbBowudbAWbu5Mv%2BDLK%2BRA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-hs-cache-config: BrowserCache-5s-EdgeCache-180s
x-hs-cache-control: s-maxage=10800, max-age=0
x-hs-cf-cache-status: HIT
x-hs-content-id: 115811496016
x-hs-https-only: worker
x-hs-hub-id: 3375217
x-hs-prerendered: Wed, 21 Jun 2023 00:38:27 GMT

GET
H2 200 index.js Show response
www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/ 11 KB
5 KB 60ms
58ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 a355d8f903a0cf5525893c863fcdf216.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 5226260
x-amz-cf-pop: CDG52-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: inhS2tX2f2C4tITR3p2haS.uhsvA9eGz
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 21 Apr 2023 15:17:56 GMT
server: cloudflare
etag: W/"0bbd63c0750f141fd5cec04a9393647e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3E7PtFvevqrheKTw1c1ZcfPoZNRxOhjWgT%2B7fESxzoTTk1xFEuWED4SmaQuqdeRiqfhAZ71b%2Fw270lFQ8gN6bUlzNkOJwtW3QdOV9FwIWSNvbaoLfuAwK3KKyYr33Zx874Qwlv1qPBqNSgbAJ546Gza85w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7da90da1bbbe91ea-FRA
x-amz-cf-id: TYHgsp09grVKpYA9dxiozj2UAW4tlG6PoALJeeeJ-H2x7PoACqsm6Q==
expires: Thu, 20 Jun 2024 03:09:31 GMT

GET
H2 200 project.js Show response
www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 58ms
57ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 4659687
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kP2JAlgZqz%2F85%2BKBE8x6kLdYYYf%2BuK9VAB389DFM8PBARyGVU5qf0MvxP12zR%2Bsd2ZS4Wm5gvmCZF6t83t4h2DK10ZmaGxj2ppAFT11wFdvkdxHtDtCrWOoReUyrY0fCIq%2FVHpe9c35CGIP%2FzfrKPy9zFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7da90da1bbbf91ea-FRA
x-amz-cf-id: npDRtHLjVqh8zeihJtuF2gyuTq3Qaqk2QrNbNCcHimg8EpZG5wWqkA==
expires: Thu, 20 Jun 2024 03:09:31 GMT

GET
H2 200 v2.js Show response
www.reversinglabs.com/_hcms/forms/ 526 KB
172 KB 62ms
61ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 345
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7da9053344089232-IAD
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-evy-trace-listener: listener_https
etag: W/"ae5063d72b58cf4bd6e3b1970722d727"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.3339/bundles/project-v2.js
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 68a3b1d5c75429221abc685a453afb60.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: .lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
x-amz-cf-pop: IAD12-P3
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 42c0ddf9-e068-438c-8e8a-71c5b62bad96
last-modified: Tue, 20 Jun 2023 10:30:05 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ibMvrdufNrV95DB%2Bpvo7JbqRp6lMe25N7xCbVbZmj7M87ifAQUu%2FExGc5alLwmtr3Z3I0ILj54y9sXwxl7IzgL5Os4TuDyaL1AUTftBGXn5DSnCykxG7vw5zGW2OuwtG7h8MWfnRwHHD5Y0H4hnoYK%2FrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
cf-ray: 7da90da1bbc091ea-FRA
x-amz-cf-id: pR3CmBYTty--npKGQTA9qXXx1bWqJTQsQk_zciVyPsuEiYifIEeZOA==

GET
H2 200 stickybar.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/ 4 KB
2 KB 57ms
53ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/38216899954/1683495050466/Modules/StickyBar/stickybar.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: A1EP1F3CR54NCV7Q
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"424627ea38e47986af8095e0d67d40e2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683495051068
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 814e6200dbb5865e94b7b0c1ba6129fe.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: jgLYEQ4EOqvxpqZTyxVIjrm84TepXoQY
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 114
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Lc6djJd1ckKCs+aBHkYMonVKhz1sxjFxH09hsCTMR2phNMdXw4mGMkPvk2JbdJkNU/5N8So/Jf8=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 2adbc651-67b9-4ddb-8b5e-19f4d1a74cbf
last-modified: Sun, 07 May 2023 21:30:52 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6PNGxTwJzbz12zwxq3nAbB2JMMXYwMP7jyS1TPIUa4xzmNbZss7kKqnpWDe%2FvEkK0SwTzkx9uSnd9OhtZjKpHSQmodqWGVwCSgRff6ydvvvaDLVLeK%2Bh8KEA0D506U0uc2OBD4xdH1MR35mxAE%2BeID1tyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7da90da1bbc491ea-FRA
x-amz-cf-id: Xe60HxEZc2yldg7dFlLAwerCj3PHyAGkt5L1BTEeWIilFZDlnvsUIw==

GET
H2 200 site-menu.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1628866683213/Redesign_june_2019/Coded_Files/CSS/Components/ 6 KB
2 KB 60ms
55ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11119463588/1628866683213/Redesign_june_2019/Coded_Files/CSS/Components/site-menu.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

41ac7f7c2a05d8a7ac157e7b70327e9ac39639c2a1e92bd7d53ef4ac80ce5888

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 1b6db55df4d0459558669f7d008cda9c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3366
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: XWKW89P1XNRT18R3
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: cxPHNJ74n_ZvU1wXhXG0xE8bUu81u..8
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: AG4F4imkk/rVku+nmYr2uvTO/wHAxTfOFDcPY1KO5peaOvVANNbKlxdTgxGzGlPDFyib7wvLEzI=
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
etag: W/"125299a966355b832b69ef7ea9eb1058"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866683280
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LWuyjk3etPcxF6Hn%2FMnyYsLzoTtl6olx8%2FGZGu9fMCvqndqfc2kkHZnhyWB3Y%2BiS%2FyiZBpZnuqqHdhHITmv8nuzwynOmrK8DtpYxJzgsDaTHjCQj3N%2FbxUKG1BL9i3la4VHw28Y3VuUx8NmeaJy96sOZjA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da1bbc891ea-FRA
x-amz-cf-id: WSJcUhguLjo0sXJvRRAhNwBeYGJX772XmMgyZne6wOanHYipGNWYWA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 micromodal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/ 4 KB
2 KB 58ms
53ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395383304/1628866683496/Redesign_june_2019/Coded_Files/CSS/Components/micromodal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3366
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: 2YS7J1XDFTRMGGVY
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: e3VxwMWpNWQvL0ZQahFb1P28o.8Kjgu5
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: nz1mOdCCQju0kYhIrRsgASldTGuIaEddI1UPSlHxkgDFTj0XP9C41a2DrMFo0TT5JHQ/55iE6hA=
last-modified: Fri, 13 Aug 2021 14:58:04 GMT
server: cloudflare
etag: W/"20c2f66e9f10bed15056fd6b975b8a75"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866683533
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sfn073t%2BfUpcDhtOjVfeIAMdSccKTIrbCas3KkrUHWz43H8BdStAq7Vq5IwDeYniasgrrGfdEASwNznaDPoOYtcp4IBFAvVyju1%2FNWTgEjvkgYKqmWzqVrSGeQ1fVh1zz8uXO62i2DnYlgmg3L%2Bm3UWHVA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da1bbc991ea-FRA
x-amz-cf-id: 2-IU40prcFtbX0JqzoEuY1N3dTR8BB10tPvrumPAv3CT_d3C7hDKag==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/ 610 B
953 B 99ms
95ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647497/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3366
x-amz-cf-pop: IAD89-P1
x-amz-request-id: VSEXTJJ8TXTDG8M8
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: n_rdB5Zjo6jQpLlilRmMi5fLWw35sgNj
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: zS7gpyK4ngg++6o2GlW32zj366QwJqv+/gzWYXmB24zV0gk2AuOWvTrlQDcBw6J6yiTezglW09I=
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
etag: W/"6b50e831aa1329ecfc246611e5b73e07"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niBUDDkErDDC5%2F88htiRTa4MBCBvO2R1InGvxSXzT68spmsW4OUM1Wlo15p791YUiYg7JazogI5N5T9yEOXUB9FlgdEjqgdLtXJGgIUAs3kvuOiJzaV9WxBc0b3JbRjoa47%2F7kifyhFGGzXcs0IMprixlg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da1bbca91ea-FRA
x-amz-cf-id: j4lWry9rsENA-M56NhWXljQae9YwySDV6RjDp2O8FxZICdiu9_tX2A==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 module_103636562700_Footer_Categories_Text_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/ 89 B
1 KB 58ms
54ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/103636562700/1677161481432/module_103636562700_Footer_Categories_Text_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3132
x-amz-request-id: 7VDYX6YBDPYEPK88
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"0e24424bd7a91e1adc940105ffcd26d9"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1677161481432
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: S9Og3Ezj9hRyblXN9qKf01bBpHlkGn4t
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 176
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GCHdKb6pnWl1WMzThxaVjLEgaktKu4Dzwu/H97avc0A6/xZYrjMa3kbjx4cC4hY98fTdWtsEqO4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: ae72356c-c3d9-4835-8240-cc1e4f163bd0
last-modified: Thu, 23 Feb 2023 14:11:22 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QCoPW4h62tX1Lwi1JBDs9WzGVygAN4zfKSIthxySL3p9HUCQT%2FUHCCX5Mbw6fQsYqhk5iUPLccL4alfjLkjC3YCe6SCZ1FyvS%2BuXVIJTTQNIzp8%2FviA%2BGMO7KVRRLrhA0xkS%2FiVeZ%2F5vRaePu0YCLUclyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7da90da1bbcb91ea-FRA
x-amz-cf-id: CImszaV4YIMSP4JFrvyBwfFpdiSyee4TfELHa435cwuv9_1HdjF1gA==

GET
H2 200 module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/ 135 B
967 B 67ms
63ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/87757605656/1666371595958/module_87757605656_Footer_Categories_Blog_Listing_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-request-id: D74FPRYJNFTQMN6R
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"13b7e92cbbf8ac04eec1f7b100347115"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1666371595958
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kLOdiFo6YnWIpiP8BLnJdzSgnAZ9CfEh
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 153
alt-svc: h3=":443"; ma=86400
x-amz-id-2: wub4Acwpo/m1Flmy198CNdNCJxymaQXVix7rNiOPdcYjWK4FKPC03U6Y+8SIbgmV8H0aky1/U3Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 37b60999-6a79-4c42-81ca-5263c79b6ea9
last-modified: Fri, 21 Oct 2022 16:59:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dqUfOJ1M%2BfQc498M3i257p9YEEX%2F%2BQNNFzLapDsR0WEE6xohGgcRvEYVyFSTWLyJUReOVk51cnAU1FOXx7R81VdQHuCizZZ2YGp%2FkayTdd%2FHHObbwv8QAKbTazaRrbkdkhij6RJcx%2BHtHlXdAJM3wpzSlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7da90da1bbcc91ea-FRA
x-amz-cf-id: mU5A7Ymzz61NFh6QGzlkrWieFv6u3IpIztHCGH69_vxN2QPRdb5Drg==

GET
H2 200 module_36845096476_Blog_listing_card_grid.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/ 304 B
965 B 88ms
84ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635695217/module_36845096476_Blog_listing_card_grid.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 493BPZ3TQ3W0EMJR
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"bfd6c45ad0a0ed80b73460eea867fdb6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635695217
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 0cba74644cedf83bb6fb7dc90d8b0980.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: QEtrj8a5Jw.zNpvkZ3KAKAvL2xgpFoi3
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 112
alt-svc: h3=":443"; ma=86400
x-amz-id-2: MMxDYlGAKstu6xcv7FF1yOTH82QSEPxgsUHCfDREspFI3X/rVg/KSkoCdSqFHVVi7kUtUPPCOns=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 70a882f2-5814-44ee-a5ae-368b05624550
last-modified: Tue, 09 May 2023 12:34:56 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9kP7FgFnW6OdeoPL9riJZuDeqgTXLQb2yL%2FyGZ61yFIvIn0GTaNxgxU72ZI%2ByJej4y9N02n3hD0Br5%2Flh5lPNvHqsWhljr7mibTCcKBJpMjwJZwCOEQqcUKy2bfWCMLYXcbA5M1VAZk%2FgxA9gFf8GAq0KA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7da90da1bbcd91ea-FRA
x-amz-cf-id: nFSROtreYfVNhvwYYd0UDd-5eq1Mmw_0_LvzBmqdiBlPGjVMp0yAdw==

GET
H2 200 module_80864562095_Sidebar_Categories_Blog_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/ 419 B
1 KB 91ms
88ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864562095/1659712321004/module_80864562095_Sidebar_Categories_Blog_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 6W16ES4SCS9XH8K0
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
etag: W/"d7c0ecedc0f1ad068aa363dbf6f552be"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659712321004
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 126bc2e5c4c1b9ac0ffa004edc6f02c4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kytFTmhcx66YfyEHUvgGyzju7VPEYvXs
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 247svM98eSgNwCNMIOcsqdYwLUhwi228+gEuetmZFvuptxhq5YZps9wz3WZgF4DtF7EG8wuGalEFHIWZGjaqNXSUu1ga3ilCc66VdmG2doE=
last-modified: Fri, 05 Aug 2022 15:12:02 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hV81rDdIdCoOhdJXdlJ380LQ63YhOFr0EgK3YgVYCM4cUjWLIOeO%2FR5HkitSf6HFhd%2BggZ0VgFRvu35xc3%2BQwONWgvS3VZthMEpcWGB%2BLarR31pJk6UA3PLaBK7UL7XmSw%2FpfhoY5o%2Fx3%2Fm7soMBBVYUow%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7da90da1cbce91ea-FRA
x-amz-cf-id: qx_aguf2ba7WAg9viLCYpQ1cDT4zSCDuvGvgfCRisX3PwORWXov9bQ==

GET
H2 200 module_80868056874_Sidebar_Social_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/ 298 B
1 KB 68ms
64ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80868056874/1659702739351/module_80868056874_Sidebar_Social_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 98NB269N0E5B3BGZ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"ea0c94f5b1324d7913f6a18ec1f3fe14"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659702739351
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 9b097dfab92228268a37145aac5629c0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: shmO1QlyhGMyDoImESYiUCU5phlmEXau
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 172
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lSaiJ+khQb0Samuok6dlEzLOoqMgHk31Tz8Q4h5JJv1Syr0xvdW/m2ogOiQeZHajxkcO74hExM3rZxDVwerTYQ==
x-evy-trace-route-configuration: listener_https/all
x-request-id: df15e28b-cd7d-4883-84b9-a224f2b23284
last-modified: Fri, 05 Aug 2022 12:32:20 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BdRGg%2BahUsYtEDonTfJWsKOnKk%2BY%2Bmcl%2FkzHTinlDd1Jb6chyG1levOosQy9Jj2XGmeEhO1wJgSu4bkLXFEUCSky14La48eBSYbtToUTls0qsSWCOmbD97ukT7tJg5m9xv79hhei9jr4wjQtMVM7l%2FT4gA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7da90da1cbcf91ea-FRA
x-amz-cf-id: uKuhaBOnVQBZIJ7QPGBv_7uN4OVvIUJO7CRAT28hiq66nN5XB3Cx6g==

GET
H2 200 module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/ 620 B
1 KB 64ms
61ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80857835930/1659449374148/module_80857835930_Sidebar_Blog_Subscribe_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 0CPD67HGP2T4VTGR
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"058524ab080d84460f7e7c6d2ecb4d89"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659449374148
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 a251e31740a6e166e8fdccf296c41644.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: e1cZxYRKfUgD2rKmkLGGtFZUzq.7EtsO
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 113
alt-svc: h3=":443"; ma=86400
x-amz-id-2: bCDnldKnN76qEWzQaXcoZtvxtXp5x4LpXnT0mIjgzv39px+tYwFovBBTeI4wNMaTu1STGAKufvc=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 578d693d-5549-42d7-8647-3673bba6f8c6
last-modified: Tue, 02 Aug 2022 14:09:35 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwnP5TDxjmbaUtOlC8s78yXaWNBDlZ9i5c0GsyGFtpM5FGoWHHVg8t7DaOkBZIXxSz%2FJgbu1HI6vODFTLv5moSV%2Fm5gPb0sHx7%2FrzbVPb5PiYof7nE38YnQew%2BGWcPtbymTX5TRs%2FIlAadc6huTgwoWTfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7da90da1cbd091ea-FRA
x-amz-cf-id: tAy8LPGZD01OtX2us_cOxCSc8m88XLHg8AWtggdKSL5WxDifIdK6lQ==

GET
H2 200 module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/ 581 B
899 B 59ms
56ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/80864563080/1670427753922/module_80864563080_Sidebar_Blog_Favorite_Post_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: TN8JRPSHNZXRKZ1T
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"c2bccdea5694cead22c9370560abd5e0"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1670427753922
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 979084a90b32fe3f5fdc377fb6e67b76.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: wr_YakpyxY_udxaEA70Z09_FgvspAnTj
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 9sfkui2lNOR9HKXf6QfZearJZoYc0emHrBP83j3aY7vY+2brJY7jYGZoDJWFmJrFJb6N0xmaw1+Ls7OvihVQ6w==
last-modified: Wed, 07 Dec 2022 15:42:34 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ImboCtEjvDJbKDp3ZQXg6zwfFGlQ2D9uNYM%2F289Vz4aC978eBdxifOkJAqr3eeHJzVcvqDqRWfHsHma9QizfUPSj1bJnHFVUbC9vPr9u4nHvw0XHOH0hePc7DyXhYBOcdEUEzUA9agWx0Ub9fwWIn7WEJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7da90da1cbd191ea-FRA
x-amz-cf-id: o2TRwN4aGb9oEUiEbVp07433bxR0UkfScK3-5CyU0yLXB4cisUJZrw==

GET
H2 200 module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/ 449 B
1 KB 63ms
60ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/114796045952/1683726402031/module_114796045952_Sidebar_ConversingLabs_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 1ZWPRY4T8RG5FBX9
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726402031
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 90ac509e6263ee9fa7bb3f1ed1f46118.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AQN4k9CjDjzeOb4WGe179iRQS2cuvN7I
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 123
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 6K0VBtV/5SlAb1taN90asHPq5fzkTfPUeUwGYp3puajuy/55zsup7qAFUEik9P06pIXqOUgK3CU=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 776cbc17-31d8-444d-a4fa-8237b1225682
last-modified: Wed, 10 May 2023 13:46:43 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cJlZdMJh2gwrNEsRbthrVDAoWsIt0ska6BnEa8BbWD24UrvlMvjT9v02daaJcV7XuB%2FyeC68fT4MEuCTvIgY2qGl9VQPiWCHj8HD8wi1iWGvvoM9DlmAJbiCElvevqlMa5%2BzA7IXjzka92yMrrtQ73iWYw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7da90da1cbd291ea-FRA
x-amz-cf-id: aCcoQlUlrPmuTAJpQvqlVfR-qxCZTPQFToO94h0EwgY4qOIQY1r2zg==

GET
H2 200 module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/ 449 B
1 KB 61ms
58ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115016303498/1683726382481/module_115016303498_Sidebar_ReversingGlass_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 0WSX39427J1AS112
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683726382481
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 b64454e3c1123ac098282f1036154740.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: kE2bMXeYWn_ktJqXj7KUhR8Fu5cHi1x4
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 135
alt-svc: h3=":443"; ma=86400
x-amz-id-2: PW5+eWD9+xuuphm0jZbqbs12I5xghMcILTCbUgQxi2xPmBxVBs2q5a6cC6+jJLZGKMXQe6Tng7s=
x-evy-trace-route-configuration: listener_https/all
x-request-id: bf630b5b-dfad-40fb-be66-6907bb0b9973
last-modified: Wed, 10 May 2023 13:46:23 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9JzODznlKl8vC1sBXbTHmjkGaZK8Uo%2FPRMRnRD4DIp2DERjdK6ffEsW8SFKgq%2FTW%2FeEdfhRLmpvlI96hzjefTOD%2BZcPgdJjRc9WnbyuKiLRnG5kXw31s5pSDe29gEkhQpqCk00RPIbXNDqMb1wJgphIIOg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7da90da1cbd391ea-FRA
x-amz-cf-id: uuvQbsRPHfQRoKUdPc9CdrHq4khVP5eIig2tHSi4wmDEv8XOJo5d4w==

GET
H2 200 module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/ 449 B
1 KB 72ms
70ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/115021731904/1683728917797/module_115021731904_Sidebar_SPD_Latest_Post_Block_-_global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: FZ7AC83PSS98SKD7
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"8518a5951d9ad4d2295f309cf6fca5e1"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683728917797
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: _NB7Ho2f9mjVTOSpgbcz46QGtgjcNPEf
x-amz-cf-pop: IAD55-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 134
alt-svc: h3=":443"; ma=86400
x-amz-id-2: VFqhNEo69Eom5zdF27L0BoBqLcEsNE+6NT4gvpsJwKDcqBUCspDQOL27i0/xPUFMy1z6BIDvln4JjkfAEwvByH5rewwErVDf7pCBZOvWyt4=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 48b01650-ff18-4237-a242-538decc54d8d
last-modified: Wed, 10 May 2023 14:28:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x0%2BW4F4%2FnfTWw0B3kyovGTwziyTEU%2B%2FBsnXjDbPOfQc7ZpNgYPQMRQnRIdjD0hEPFlanbrH5bZ1avaYoGAl9BotVgb77asaKhYxVW0YjNfm1wmu4Pvd0g1UpaFV1Q5DUxecxT0k5RlYZrkbG6E0mmw4n9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7da90da1cbd491ea-FRA
x-amz-cf-id: ML-o27nR3DM5iAcRNOXPn07RaCZMoZxnkpdGul3CDRqf1SxiLLfAxg==

GET
H2 200 footer-redesign-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/ 1 KB
2 KB 99ms
96ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10777459487/1628866681200/Redesign_june_2019/Coded_Files/CSS/Components/footer-redesign-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: WSFB17NDP7WVXHDC
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"74345f5a0d3875bb7f758b06d4778849"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866681235
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 d1cde188ada6755fe03b8541b71fce4a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: KkIg9v6XZx4VO697E4AlyOGL9YPPr5d0
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 168
alt-svc: h3=":443"; ma=86400
x-amz-id-2: NTSW39LESqcpEzbdKO4Sp9EssZbi2rZke+7eplwYSYjEAGP5fu0TBEJHLi0+m1yM0YbvViu3aAMKM2hhTwxdrQ==
x-evy-trace-route-configuration: listener_https/all
x-request-id: d47d7ef7-1f8a-4a92-bbb5-81d1ff5e909c
last-modified: Fri, 13 Aug 2021 14:58:02 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M9AYIR39ijcgFWxNBmzJ2dEHgpxT%2BMQZnQbGILf0Dve%2FBQklfZSui9uWetRijDOuIKrrC6EhlWDt3ZH4lKl3H4Lqsk9%2BjTpg%2FYoeGfhVAcidvj8u0bJvVnsAmd1XoyZJWNKyKBpa8TqA8Y95hrGCfwG%2FrA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials: false
cf-ray: 7da90da1cbd591ea-FRA
x-amz-cf-id: Py1daG-4qDMY_6piUCte2gArFkk6RFnYsjFmo-O7skAEor7gpWQa2A==

GET
H2 200 module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/ 126 B
1 KB 85ms
82ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/10782554896/1684325396009/module_10782554896_Footer_-_Redesign_-_2019_-_Global.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 7X42C64NHK6DKKZ6
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: PENDING
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"d5024537c90d258c2752af5a17a95367"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1684325396009
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ojCcsa3Hbm8KsKBjYnw5U.TUyefQWjmM
x-amz-cf-pop: IAD12-P3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 121
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jViwf9FZMI3kLz81OlMSSEAWGIfG1h+N5HMjut2XqQyD4f6sd57vNh+/LOTvlzEnwFAGwQi7P7Q=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 99334791-2074-4d1b-b287-4a3c755b37a1
last-modified: Wed, 17 May 2023 12:09:57 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MpvZVeVFMebzmIiu4ND9%2FQwlG0L%2FpF3zSDEPg37re0UriMWntNBQCrtnZdbSL4lxrSEJS4OUXSgdQ%2BhwzTbWRYUJl2dbHwjVXgf3gIIMlRoOQxb7A3hYCFv7SZz2sszerfwhc9biRpyyOK6nCrQiXmbQcw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-mxtb7
access-control-allow-credentials: false
cf-ray: 7da90da1cbd791ea-FRA
x-amz-cf-id: McaJ-7R67LJK9XZmYCQNRIwGIRwHpUu9pqoObAk1pDUcS76W5xy71w==

GET
H2 200 Reversing_Labs_November2018-style.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/ 143 KB
25 KB 90ms
87ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 9BY06TDA00GEHJTS
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"3d0f457bdc611022c3f48f57eb877977"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1685359417818
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 22ab92a35add26b3d8027870bbb6c672.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: AcrfIRW95QY88SeuDIXAFoVt.4x1ZQWb
x-amz-cf-pop: IAD12-P2
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 162
alt-svc: h3=":443"; ma=86400
x-amz-id-2: GkxM6CyUTGG0PBFgMJaDRztxsWFbJcPlZ0/7OioWm4zjLouo3IjGbhgJ83dkKDN715dWTz+6LH0HE9fsUUy+aoo105Uo0mmZotlTj0R0A+k=
x-evy-trace-route-configuration: listener_https/all
x-request-id: e6113863-3c76-4459-89f3-6474f92af4cf
last-modified: Mon, 29 May 2023 11:23:38 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i2%2F%2FTd5eBx73ZQJ3G7knIewXoSbRIT6%2FmBJYC302QkwOP%2F3hMcB6c3bICAmKRJLuRQJw2WJ7hJtVeKAqXBKp6lwSJt2i9hg94WLrYYI4lFSKO%2BC6UnaQ9nobe%2Bq1x%2FAl8GjGNkLlVGvxoWyt1hc46fER5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-fd8f7bc74-qbhrx
access-control-allow-credentials: false
cf-ray: 7da90da1cbd991ea-FRA
x-amz-cf-id: 2HFjr7dYEb_MaDmUaRi7lNKNUNNyRfw5Ytq-cI-1HM5OaXDJAOr5kQ==

GET
H2 200 v4.js Show response
play.vidyard.com/embed/ 70 KB
23 KB 54ms
7ms Script
application/javascript 151.101.129.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/embed/v4.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.181 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits: 7
date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 2071
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 23020
x-served-by: cache-fra-eddf8230083-FRA
x-china: 0
last-modified: Mon, 19 Jun 2023 19:37:16 GMT
etag: "4e2f211a0d5f0f0e82bcf94c1f18d11d"
vary: X-China, accept-language, Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 in.js Show response
platform.linkedin.com/ 510 KB
160 KB 64ms
12ms Script
text/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.linkedin.com/in.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CE6) /

Resource Hash

b568d3a45b39bf2cb3227fd72108e88e763358001b5d047fc7f7aee7c6671f0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 85
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 163637
x-li-uuid: AAX+mxOh+WlIsVx3gSc11g==
last-modified: Wed, 21 Jun 2023 03:08:06 GMT
server: ECAcc (frc/4CE6)
x-li-pop: prod-lva1-x
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
x-li-fabric: prod-lva1
cache-control: public, max-age=3600
x-li-proto: http/1.1
accept-ranges: bytes
expires: Wed, 21 Jun 2023 04:08:06 GMT

GET
H2 200 layout.min.css
cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1687290439098/hubspot/hubspot_default/shared/responsive/ 4 KB
2 KB 59ms
30ms Stylesheet
text/css 2606:4700::6812:cfc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/7052064/hub_generated/template_assets/1687290439098/hubspot/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:cfc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26333
x-amz-cf-pop: IAD89-C1
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-hs-alternate-content-type: text/plain
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 133
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 160cbc07-8bd7-47b1-9d34-3b1a570e5456
last-modified: Tue, 20 Jun 2023 19:47:20 GMT
server: cloudflare
etag: W/"94daf62e7e6df83595c6251fb0c7c055"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1687290439709
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8xY%2Fj7IB08cF%2BO7TwzP000wNrQNstQlJifyPKyPW6mEU6EcfHgQ5rGQ1pQ2U1rT15wr6ubyZmClHt%2BfoOb3g08diHZ%2B7aHbs86rvkLf%2FUTLOT%2BoEAKYr0%2FEKaNoynzCuTlx5NUTXuIehCVkWLDo%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-8dfbb9f7c-p9zkr
cf-ray: 7da90da1ee900404-FRA
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 RL-custom.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/ 12 KB
4 KB 95ms
93ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/5951651806/1659964887293/Reversinglabs_July2018_Theme/Coded_Files/RL-custom.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: WSFDFSSBK9N81HVZ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"87c5bc53e5805378faf6e71727ae7d28"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1659964888595
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: rddr3nP1mNXXwP_ajL22vN12Zg.dfVCT
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 159
alt-svc: h3=":443"; ma=86400
x-amz-id-2: UqeA8J80HdHOEez+UEItUcXFZiXPApxUbaH+hxOMVMVtReJig3r0S5AU15jOP+ae1v/qn/PqpOc=
x-evy-trace-route-configuration: listener_https/all
x-request-id: eae55deb-8363-4e52-acd7-5bf486a87765
last-modified: Mon, 08 Aug 2022 13:21:29 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lSF0bVU25GiKhAopLyxfUs4y%2F6U507Epg2Si8Sn6VHqhtzz3Lwv80ukzqonzhl4UEddH9fy%2BREFbhyr9rfuelpkY%2FU%2BJOUrrDKpM9t9oCcwCS2k7awcuDMd8%2Fs11u6PUxphE1tpr8LHhZpOg412CHtcMUw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7da90da1cbdb91ea-FRA
x-amz-cf-id: B9Yhy7rO2pUM57KSsEaozlTaUkMoatfztys-Nm__3BWZ8LERlt3rOg==

GET
H2 200 site-redesign-june-2019.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1628866684215/Redesign_june_2019/Coded_Files/CSS/Modules/ 12 KB
4 KB 86ms
83ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/10528761402/1628866684215/Redesign_june_2019/Coded_Files/CSS/Modules/site-redesign-june-2019.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

84967c4e03cea78139700967fe57d0acfd5fbe1002c2d08819ccfd21e095bc4b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: WSF5K4CSDGSGXA1Z
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"7ad492c80dfdc8d4d78c8cee08205b9f"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866684267
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: XScRDYT44B749k4nfR3f477irCsZic7F
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 188
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 9O+Q/MLV2ZH4IoHoBers44sKImvFwSe4hceFYzaeDUi9dqv4Liczlhk4zhUlw1brxyjBaZWluwA=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 489ec9d3-5d64-4d7b-9e4b-8f3c986ca384
last-modified: Fri, 13 Aug 2021 14:58:05 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OYXs5ceR6B4YwKt%2FOWEcf1TYBc7TvhU0tMq44zeIGLbJRRbmfwOVTu5WWhd9OnB2vvTJ%2B%2FGTGgJai4HgsYEOa%2Fezcp0UOBoNRVCqKeBPd%2FWOVBN1%2BUYp4yQucMivuDSyD%2FFagFJOiDK7hUmTS5zxyjPmRw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7da90da1cbdd91ea-FRA
x-amz-cf-id: OlW_Z1ngX-bT2VV0pAmVj3EJ4cev2cRbJ67k0B90ZDeiKxw9vEIUpA==

GET
H2 200 blog.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/ 3 KB
1 KB 83ms
81ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/23712622487/1628866682579/Coded_files/Modules/blog.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 0920aeb1eced22df07c9ece1cab0a554.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3366
x-amz-cf-pop: IAD89-P1
x-amz-server-side-encryption: AES256
x-amz-request-id: DNP27C5RWRB8DGE8
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-version-id: Mz.2Pn4CEDs4ZaIeZ_NrZ0_ijfcT5uxW
content-encoding: br
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: aF9DnAibKuggE3nwF/8DGE4otx8SyJ/0gV504ougeH9vk3FdM5ORhQGCBd+jn2+jF5PJDYw2ODs=
last-modified: Fri, 13 Aug 2021 14:58:03 GMT
server: cloudflare
etag: W/"86cceae70fe2cace0184968b3abea7a2"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1628866682656
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Vi39hY70DnvjB5QzchRn5hKMwN7BIGUYOjHasnqxjyuSYIsJldzREfoyiCVlg6O2LeaBRnH9yIrUdlZ7MvmNMuGFyGs8xfm098YAkh%2BPT52uVd2eWwlD%2FqEeWKow0hKsamzLd3LXWLIyphKM6nsX8koVw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da1cbde91ea-FRA
x-amz-cf-id: aG2xrv5xdEfuxj8b5AmMr5yoi7tmkED9dJ5TRo2fhQ4RNcrpAQyMMg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 conversing.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/ 2 KB
1 KB 84ms
82ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/70521421874/1671120024586/Redesign_june_2019/Coded_Files/CSS/Modules/conversing.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: J9KZTYZHNSHCZTGH
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"03194bf820a8d747a9c4e33f60a3d8a6"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1671120025512
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ezK3yCXod3kovn6QNb0kvlsgyxcpZGDT
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: TfcqbW0xVQnwmf18TMo1AkAfYCJmkgstNGmg5X2qr95N+mK8F8254KafmMO/Jc4dNP0IzXF4zDk=
last-modified: Thu, 15 Dec 2022 16:00:26 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AWD1Wr6Bd8KO08pmFuEcvkg5Qk1vESBu0iFQ7JPuxSu2%2BC1UH5wV%2F5AMT5jSRXKNDpWXcR3hhmbMQjLckB0uoIckZGftoGlSSQ0Z2Db%2BfkwY1lgV3caXDAxTk6oJ7baMcLjruEO5kC2R1hjKjBBgOQwcWw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7da90da1cbdf91ea-FRA
x-amz-cf-id: -yQe4VUatzkgzq19dzD6qBzt_6cJtKSfZ25qMzUppn8xeegJmw_-1A==

GET
H2 200 simplelightbox.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/ 5 KB
2 KB 65ms
63ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021532803/1569840493756/Reversinglabs_July2018_Theme/Coded_Files/simplelightbox.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 0501dadffc52b06a0cf6aadc57586acc.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 3366
x-amz-cf-pop: IAD89-P1
x-amz-request-id: J9KSC9CABFFESGP5
content-encoding: br
x-cache: Miss from cloudfront
x-amz-version-id: Y9o3twj1TmNPLtARM7I8GKUA.atzxWnP
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: oxraOPjJn53Br6tpYNTq5Te988jVxT29GqKa5BQPszxaSJH0rnsRC6Fcit7hN/U0NvIytO8gLRo=
last-modified: Mon, 30 Sep 2019 10:48:14 GMT
server: cloudflare
etag: W/"9c259f55b65931c5838c0f7cd5f58f93"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nsiWEsP4BD9CsJjGkV1c%2FPq%2FdbpFZpHaa5Ah%2Fij66XRalwIOo8UD2LXaICthgLTBF5CTGNM79IzOUN4tf145Iz8tw2RQyJz5DwgRlJP999sZgh662SfW14UXcha2wQo4YXyIwJRwP4lIL%2Fhx6HiWyQQ0ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da1cbe091ea-FRA
x-amz-cf-id: Sg3oF4j5w_b49xgy_GBQc2gzJh4yQ9ybxhTeniZzX9xDLZyfQvcKCg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 tag-list.min.css
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/ 834 B
1 KB 76ms
75ms Stylesheet
text/css 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11708570900/1657723424898/Modules/Tag_list_-_inline/tag-list.min.css

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 3366
x-amz-request-id: 0BT4PNDSW2FRTFT2
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
etag: W/"d0f8005c0d02f9ea2078b355ed1700b3"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1657723425746
content-type: text/css
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 979084a90b32fe3f5fdc377fb6e67b76.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: R3vEp_hu.nAXB21yRaHK818uFUl.x7KV
x-amz-cf-pop: IAD89-P1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 6BrV+bMAW2zZcmI9DfbxJEdZiguADzTgIgd29gBp1JrcwylJMwHT6ixtc4O11/9zsH1HN5auy5o=
last-modified: Wed, 13 Jul 2022 14:43:46 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L2vKT2QzHnoFq6uRhe2GfXo0Dn4D9LVAnJmfThHKHdyKoOqgdik7zfQEPs0WQNCKjfMFEG3eU7zQwON73jbUyJRQ5Uc7jmgISH31%2FPXqeKDfWh4qj1ope83EIeyYxXDBn0z5KNcRzPGmfHVyPmG33sGSFA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 7da90da1cbe291ea-FRA
x-amz-cf-id: B2Ndioz5GayXkl4R1Beu6DulRkGVs9v4aFtUg-nl7BlU3EqgSN_87w==

GET
H3 200 rl-com-logo.svg
www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/ 3 KB
2 KB 71ms
60ms Image
image/svg+xml 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Reversing_Labs_November%202018/Images/rl-com-logo.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a0b7683a1d33d6d186965e831f2de96.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
content-security-policy: upgrade-insecure-requests
age: 548469
x-amz-cf-pop: FRA56-P7
x-amz-request-id: TCS6A009H1Z8J55K
content-encoding: br
edge-cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
cache-tag: F-6517800726,FD-6517800709,P-3375217,FLS-ALL
x-amz-version-id: BUsncvg3SahbgModZfK7dQUIXXLSPFen
x-cache: RefreshHit from cloudfront
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
alt-svc: h3=":443"; ma=86400
x-amz-id-2: CF1DyrWujCA9gzVlxLPyjJuFRufx+O4E0tSFV18/3aOjuz+FZHS112WYWzw4BJjtWfonCcvkeB8=
last-modified: Wed, 14 Nov 2018 07:33:54 GMT
server: cloudflare
etag: W/"86ace497147ac2cd02198f3cde44219e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wvzPlO8NE3UquF45ReHDJDsPGXK6Db6bAWzKVA5DGKSSKqLsR6Z0hnFT7aoqFanbmg3pGuUl%2B8k97JhN%2F7Xdng91RN0vJelhQIB0bzvUdPqgQ1H1BKxw%2FgMlaC7a9b%2BWE0ZzVk6bCtaxoB%2FBZF7PvGp3hA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da2bcb01a6d-FRA
x-amz-cf-id: 4_vWdfRTtwQMRhW3KWd3gl6z52FfOAn3x_fdKmBXOFgzqlqIc8FeZQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H3 200 blog_author_lucija_valentic.jpg
www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/ 41 KB
43 KB 79ms
68ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Imported_Blog_Media/authors/blog_author_lucija_valentic.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

acf17525014fa899516fd8f0b55b2e5122f8d9e2a42601e328858f32eb1a2b45

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-101837293613,FD-8444884887,P-3375217,FLS-ALL
x-amz-request-id: M34V3T4XH4SM7PHG
x-amz-server-side-encryption: AES256
edge-cache-tag: F-101837293613,FD-8444884887,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="blog_author_lucija_valentic.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
cf-bgj: imgq:85,h2pri
etag: "caabfc9506c418a301dade9a92f36fda"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1675946350592
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 56317bf75183e752b06c880e8a1e502a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: LHdtrqZdhhOrk_Wt53vSzaVBilTv0cIh
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=73811
x-cache: Miss from cloudfront
cache-tag: F-101837293613,FD-8444884887,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 42422
x-amz-id-2: H8y+hpZZvvLvgoiFZ1tU38cZmrkP/RLVApafwr5d25cr3LHryaLN7Qd/Hr/oIF//rGeWKJGwlFI=
last-modified: Thu, 09 Feb 2023 12:39:11 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IF6K8%2FQ8hoB2mIn3KjlElm9e2mOHzHJzx6Qs2OXC6Us%2FzZdkUzr2%2BUtnSJ8nSbdCfp7MnGtT0LO2UCQRDZUDvVOZhaPHub5HAFSKAQhxKrnE1LmViflZPzvcWlDYsFu0RS4qSIUeQHSrCUDSWXe18bjXUg%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7da90da2bcb11a6d-FRA
x-amz-cf-id: 24QocFhCwOc5gcncAwDfgw6eRPhlloC0oTDmIsxIL87Jo2R0yTUNow==

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_1.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 52 KB
53 KB 186ms
175ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_1.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_1.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e6f86db36936507e3598ce0f7d5aba4fe33d0f670ee1dc223be1fac54cfb63f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115881536148,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 53662
cf-resized: internal=ok/h q=0 n=12+0 c=3+118 v=2023.6.2 l=53662
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfDtkcYkGxMBtSwV9CXoI3OMz-G4ubIV2ePdeCXg6EDQ:383c31d400ac41442d0c64ce005792bd"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xe5vPBDsIpSGCUHMlFwxDWs%2BMAP%2FPg9%2BRZ5xowFI%2FcTNxEtop5SMKWhV%2B907At%2FOm2Lrr2tajZ0ge6kJHhWO3ZC57ClRSfdedKwzNszGErrrjjZX%2F3eO8mvYbfU%2BVGMXTC6xdTjrlm6N4fALWo1JLiAnhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb21a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_2.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 51 KB
52 KB 1162ms
1151ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_2.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_2.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

58d64fd2e682de660c8739fe1f6161faec1903845acc2e19df71024a761c598a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
strict-transport-security: max-age=31536000
via: 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115890405284,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 52518
cf-resized: internal=ok/m q=0 n=962+0 c=3+91 v=2023.6.2 l=52518
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfsL8xycnPbQAszh47pE9AX0PWG4ubIV2ePdeCXg6EDQ:ec6e26c61c091af44f6be67fd85b933a"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rtFzoUJDATir6WL19y2JpjePczQZuRlOqPt3zJkwReNeFWIEIR6JkXnZP9FVhoN%2F20v3R9O8pQ4NTSg8ea5mkr0HIIygb6cI0lkW9wERepWUncj13OCBBCpfoYykek6Z9Kykn9BH%2BKLwxBGCpMG8b3q6kQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb41a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_3.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 47 KB
48 KB 183ms
172ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_3.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_3.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

51c44e74557b4d9af1b5ac48371ed285ee7f21b773c9d5c989f2adae169dd230

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 26f61e70ac4b967ea82841cbd2dc7cf0.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115889013126,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 48620
cf-resized: internal=ok/h q=0 n=12+0 c=4+104 v=2023.6.2 l=48620
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfNqBfbUMpaHwByx1B3dEn6iDvG4ubIV2ePdeCXg6EDQ:52d94499020ac51f33b13e80318880f5"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4RKG4fnCPwTCSjpkD0I0QAP%2F2OYWqvli9WQVjunCQGMw2PncCPHpZtcoYQwGTiqmBkvZTAFi9o86jiPAVRfySfv6n8XcQ%2F4Hrb1oP247EEAD5PKO1SJvfc7jQpwxbnt7oCUJZQ9sxDXDo9kCzcBRCDgTpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb51a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_4.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 47 KB
48 KB 295ms
285ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_4.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_4.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

39b586e6036e36b0347c1dea81780e8db5c055b6e9ad4a602f431757c4c0f2e0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115890405283,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 48572
cf-resized: internal=ok/h q=0 n=8+223 c=0+0 v=2023.6.2 l=48572
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfmH9H1aYTk-cnHgIS9Bs2AWPdG4ubIV2ePdeCXg6EDQ:bfed0e8ec0b0c3604633f4df44dfbc0f"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UI5ZY4odGdpJ0Ef3lBtXnVmRRHtPkK6DYCak8NrmPnqZanCMJx8BfrM%2B0NBvG6wvq5fhxVpIkju2DgbF%2F3ivXWtjTcOUvSZ0sO5q71Ait%2FDaio5IQuYLxogXWRcKzoEXWSs5Za%2Fym6ruqNGz70g8sOt%2FqA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb61a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_5.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 37 KB
38 KB 435ms
424ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_5.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_5.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e574399fded05f0056e582c86bc027b5619870521818d8dfe04c5ffbe1754d47

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 f3d57c6f1e03e389abd50b7f7535cee4.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115889339424,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 37844
cf-resized: internal=ok/h q=0 n=15+186 c=0+0 v=2023.6.2 l=37844
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfCY98jpe6qE1zMLF_M7jdBea_G4ubIV2ePdeCXg6EDQ:8363d31a5e788a0afee48ff84b7030eb"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wCOodyAgwM9mu9NipHLpOuWcepsPFO5UC%2BVLVWPABBPhbLwGY7ihb0TRDUnMOoDnfxGnxXuwans5BNJ078MQRuEUnngDSljIo9DOmRFGHkd%2BbRZXj81YKd749alaAlHeuNWJxpwko%2BUHRy5pCUZiXvg%2BKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb71a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_6.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 39 KB
39 KB 257ms
246ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_6.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_6.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce0c9eb1ca6a35fcba1cbaf022ab817e3565f9d56cfb40591ef03bdf71ca089c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115889308033,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 39464
cf-resized: internal=ok/h q=0 n=14+151 c=0+0 v=2023.6.2 l=39464
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf0QVJWCV-QxGoCo_lfdtpngzoG4ubIV2ePdeCXg6EDQ:f031d873275d954193df8690b6d4fcd3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UMx%2B8GPJk1ZJt8aAsTkEk3lazX0%2Bhvo2F9TW0xBjw0nAxahCFOgptsL%2BteNv%2Fu09EMhejgOCt15mIvQvzpwQdD5YtxK51DuLscHVQ8OnEcqxClmHBkOgXPR%2B6QWKUgZ811nzcsjUBMyG0qW6kSy9RHB9%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcb81a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_7.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 5 KB
6 KB 113ms
103ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_7.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_7.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0ce7f9729d1118a6c7ae2e3d0922b9fe681d73340ac96d05aecaaf2312151a5

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 fde85e7daa13f95cf6b8f5fa09c62ef6.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115890405282,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 5496
cf-resized: internal=ok/h q=0 n=15+0 c=0+14 v=2023.6.2 l=5496
last-modified: Wed, 17 May 2023 11:01:01 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfVx9fLqLdZQ6AP6PDZgV8YEoRG4ubIV2ePdeCXg6EDQ:6e8928c52b4d6bdd982fe1a7781e1a9b"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llT%2BovqF6bzrAM7XMqZSajYBM6Zyd6cZj7UyHOlPxdHgluCUTAiJSXYuA%2BZL86ItM0G429CmYwf3y9Q9Sz4sbL%2FXYk1XvsH31xnXtLX17M6Vad1BqWhBEqoVY4voH6UrGA5c9S318SyRRyhRQsr678s%2F4w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcba1a6d-FRA

GET
H3 200 RATs-found-hiding-in-the-npm-attic-figure_8.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 58 KB
59 KB 222ms
212ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic-figure_8.png?width=1400&name=RATs-found-hiding-in-the-npm-attic-figure_8.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c710baeea1e6c18176ac4d6100768f82144059cfaf4277cb00ae86ebe75e9cf3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 d76db2cbee553c8bb2de7fd88a960646.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115889339423,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 59740
cf-resized: internal=ok/h q=0 n=14+0 c=3+121 v=2023.6.2 l=59740
last-modified: Wed, 17 May 2023 11:01:02 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfvHBZzJ8T9I6HGdU9t0sugAmrG4ubIV2ePdeCXg6EDQ:ba5c9bc71efb318bf72cc197503ff003"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tiRtJnvBVt0qpWyb%2BdnebJkVYW2%2ByQdcJ5%2BRt%2BK0yMuWaeNoCDAJ6Kvx4C%2FwOYs89fQmxwShAXM9ACkxOCmzRs0Ijh8GfmuVg8%2BX%2BEVr8dZaPRho%2BglOoAyJenxsOnEmxo5MBIBncn5TDzOij4vgvmBRPA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcbb1a6d-FRA

GET
H2 200 GitHub-Copilot-OWASP-Top-10-LLM.png
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 14 KB
14 KB 210ms
174ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/GitHub-Copilot-OWASP-Top-10-LLM.png?width=480&name=GitHub-Copilot-OWASP-Top-10-LLM.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

686fc2ffff91be023d9492d94f27b02850460b634ca5ffa9fb0fd7152e3a6b10

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 dfbb70da951fe29769706870c1e4764a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-121070550535,P-3375217,FLS-ALL
content-length: 14094
cf-resized: internal=ok/m q=0 n=376+0 c=4+28 v=2023.6.2 l=14094
last-modified: Sat, 17 Jun 2023 01:02:28 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cffkkJZOZPi0PS6zvxp0xZf4MZzQG3Dz_JuxJXtzypDQ:fe452eb9365eed54eb3753c5f23f4d8d"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2ea1d9a0c-FRA

GET
H2 200 SBOM-a-rama-nutrition-facts.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 11 KB
11 KB 116ms
80ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/SBOM-a-rama-nutrition-facts.jpg?width=480&name=SBOM-a-rama-nutrition-facts.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9191b06fe12487d3f456e3c4be9b9da18583b4788dfe12883ef9c47d46ee325a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-120419453583,P-3375217,FLS-ALL
content-length: 10882
cf-resized: internal=ok/h q=0 n=148+0 c=8+24 v=2023.6.0 l=10882
last-modified: Thu, 15 Jun 2023 20:18:42 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfDOHrvE13pxN0TwopcrAhAaxHzQG3Dz_JuxJXtzypDQ:445f7ebf68c9fe80f8d101a615bed2b4"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2ea1e9a0c-FRA

GET
H2 200 ukraine-apt-attacks-russia.jpg
3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ 21 KB
21 KB 112ms
77ms Image
image/webp 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3375217.fs1.hubspotusercontent-na1.net/hub/3375217/hubfs/ukraine-apt-attacks-russia.jpg?width=480&name=ukraine-apt-attacks-russia.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccb2a355b322b6476a8796c76802c14a9748c41b054ebf5fdc88275c911488d1

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 478a7b771498cb2871727b0293c8b1ea.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-120390342249,P-3375217,FLS-ALL
content-length: 21116
cf-resized: internal=ok/h q=0 n=41+0 c=7+27 v=2023.6.0 l=21116
last-modified: Thu, 15 Jun 2023 16:43:20 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfBX73b7klJsBFKE7DDLv08akNzQG3Dz_JuxJXtzypDQ:17ee940190d63efd719ddde962738899"
vary: Accept, Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2ea209a0c-FRA

GET
H3 200 tag.svg
www.reversinglabs.com/hubfs/ 946 B
2 KB 115ms
104ms Image
image/svg+xml 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/tag.svg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
x-amz-meta-cache-tag: F-79211394341,P-3375217,FLS-ALL
age: 513981
x-amz-request-id: WK9HKJM4498R0JG9
x-amz-server-side-encryption: AES256
edge-cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
etag: W/"27594f47645e4d58406fd3cf3d07e0a2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1657811796583
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: aRYhGFr8YswkXmWbJnGhRE6TAiUwxgKw
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-79211394341,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Ch1aw31o/d/8xx18+3P7D95bGcj5JjTiQDkSo15XAR6w0NtoQRnUs+V+pBruVFCS5HSbOeqoVJslbCnIDJ3C5w==
last-modified: Thu, 14 Jul 2022 15:16:37 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X14LbqwikIk0VGY0YKYk8tT6G0ADYQT0yyBC%2FCS9XQCEVdyIwO7PSBe12H0SgKBeJaUcUCozGuHHXwixVA9MI7D4JGKGykZ5hJM2y9yASO%2BBPfzwt%2FtWmVbeutP4x3R%2Bf2LAFLO9jhCyGmjgxb%2Be%2F8B5QA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7da90da2bcbc1a6d-FRA
x-amz-cf-id: yJYoojC0o89ufEYKnmN9ngKB0p8BifOnaZISsQix1yQ1Zidp-CHgmw==

GET
H3 200 puzzle.png
www.reversinglabs.com/hs-fs/hubfs/images/ 190 B
1005 B 115ms
105ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/puzzle.png?width=24&name=puzzle.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80971515058,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 190
cf-resized: internal=ok/m q=0 n=586+0 c=0+0 v=2023.6.0 l=190
last-modified: Wed, 03 Aug 2022 11:16:38 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfTEUp8Ew9ax83YU-aC7YLXg9u1csUNuQbJ8Ycnj_pDQ:e388a2e47cf27a736b1d0bbd369fa3d1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tXA5MuiqRrEsAE9OLy522QcVnf07m%2Bz1ODRZ4YMkcoi%2BGktUVc5Xo8OjTPDPaAsVo8DJr86OISV%2BGlxmOjFz1cyGvyP24gvseZWzxrAyWFDOY6HKYnl5XbNnvoyPD7rMCQJJUebkSazGxy8VIEdOHEeZkg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcbd1a6d-FRA

GET
H3 200 tag-dev-devsec-ops.png
www.reversinglabs.com/hs-fs/hubfs/images/ 170 B
988 B 115ms
105ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/tag-dev-devsec-ops.png?width=24&name=tag-dev-devsec-ops.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-85478930439,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 170
cf-resized: internal=ok/m q=0 n=846+0 c=0+0 v=2023.6.0 l=170
last-modified: Tue, 20 Sep 2022 12:31:04 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfv7c03z3Ffq_nGeIA5yKSc4mh1csUNuQbJ8Ycnj_pDQ:9183b185622ef93c463aaa428f1f5ec1"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PHrwu%2Btqsx%2Ba6CHztrf5ci6sWqzhxdDqhgtValty2%2BmlspgaBhs0bfMX2HPqUAqAG2ntsQZbRuTPZWaAnJKr%2BRqyMFq401%2Bd8wzTyRnOi4aB5h028okJ0DdJqwYIY4OdvvU1%2B6AUmJYFL0vkjECG4ylPcA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcbe1a6d-FRA

GET
H3 200 ico-threat-research.png
www.reversinglabs.com/hs-fs/hubfs/images/ 292 B
1 KB 116ms
105ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/ico-threat-research.png?width=24&name=ico-threat-research.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80135253149,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 292
cf-resized: internal=ok/h q=0 n=14+0 c=0+0 v=2023.6.0 l=292
last-modified: Mon, 25 Jul 2022 15:07:22 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfUSLvJ4c4Cy57IRZiA1hwxqgf1csUNuQbJ8Ycnj_pDQ:e7151140ece53d72171148a7324d4b11"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RE8vJB%2BVMQiIPwoOMVk8eJ7U%2B3e%2BMU8OFj%2FcoNsrqYP4D1BVyUkmqi3eUiRzmWGhPG4IWRLVN3aYz34q9qsT2EPwR7xUtksDvNpqSyZDgMHBuK6it4H0v%2BbJyT6JmImV%2Ba7gEBbM9MWJiMRO3EyykDm2ow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcbf1a6d-FRA

GET
H3 200 alarm.png
www.reversinglabs.com/hs-fs/hubfs/images/ 224 B
1 KB 82ms
72ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/alarm.png?width=24&name=alarm.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517010,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 224
cf-resized: internal=ok/m q=0 n=850+0 c=0+0 v=2023.6.0 l=224
last-modified: Wed, 03 Aug 2022 11:17:23 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf8LPChb5JPnuX8S6grriML_Pq1csUNuQbJ8Ycnj_pDQ:e129885aca10039ee2de1413175bc2d5"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dlAWllTaNkuB%2Frq7rmN8AAXaR37zgY1gWYczB22sSs9mxBhUhyL3y7%2FjTlCyfMsHcsE0b27m8dMPhoPM7%2F10ACT1yf3Qn89rfTz3lzekIEML7cpPeTqV4AF4rOxkuE1R7BY7p3LcFjdohJfkhsyJCvAqbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcc01a6d-FRA

GET
H3 200 terminal.png
www.reversinglabs.com/hs-fs/hubfs/images/ 198 B
1015 B 116ms
106ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/terminal.png?width=24&name=terminal.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80972444337,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 198
cf-resized: internal=ok/h q=0 n=14+0 c=0+0 v=2023.6.0 l=198
last-modified: Wed, 03 Aug 2022 11:18:30 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf6bMIImIWOdGtWqvTkruXE1Mt1csUNuQbJ8Ycnj_pDQ:df29f53ad31749ce8ebed7c59dfda5a3"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7lrfhejt8b%2FUk1EterjzHFWDxFy6qU%2FgpHEwo4uF%2FAlH6RmoJ05UZa5clkQsppgS%2Bn5iA1sB2Uohn8sOhuBtKIVpPqmJ0q%2F71PUpJBa5ezdTH5wqBb7ysBqNdeqOww%2BuefmTrBpW8ji02a2bwg22gdlIjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcc11a6d-FRA

GET
H3 200 calendar-three.png
www.reversinglabs.com/hs-fs/hubfs/images/ 222 B
1 KB 116ms
106ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/images/calendar-three.png?width=24&name=calendar-three.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-80978517087,FD-41794900664,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 222
cf-resized: internal=ok/m q=0 n=862+0 c=0+0 v=2023.6.0 l=222
last-modified: Wed, 03 Aug 2022 11:19:08 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cfSCUVVewrbUrCezSPDCvLRaq61csUNuQbJ8Ycnj_pDQ:18503effdeb9c9bf3130e4d9c19e5f39"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cIKoc10S2JWAaKUKbFOlVtrL6phTfoUuC1vUghzHUG35ak0YM%2FIxfc64P%2B6e0qUZ9eLJAjsM7TWaUrBDyGtGNjCkCAs7UR%2BacPG9TBqAqDjIT9gnKDtyhDMscGZQ1NUjH0rkW7GqXIGKCw2a%2BMsztHNqQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da2bcc31a6d-FRA

GET
H3 200 ConversingLabs-How-Do-You-Trust-Open-Source-Software.jpg
www.reversinglabs.com/hubfs/ConversingLabs/ 85 KB
86 KB 95ms
85ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/ConversingLabs/ConversingLabs-How-Do-You-Trust-Open-Source-Software.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2ba07210f1d72787dc1705b2c92ec9dfb1203f8d42df45ee4488e85a2852661

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-119033248879,FD-69168798251,P-3375217,FLS-ALL
age: 499743
x-amz-request-id: G5H057F4E999NFHS
x-amz-server-side-encryption: AES256
edge-cache-tag: F-119033248879,FD-69168798251,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="ConversingLabs-How-Do-You-Trust-Open-Source-Software.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
cf-bgj: imgq:85,h2pri
etag: "89ac225ca66eaf3a1e16605ecfbd9aea"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1686057759152
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: duA1PkjGQuSJOouy8Fexc9l_fKF0H3zK
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=233156
x-cache: RefreshHit from cloudfront
cache-tag: F-119033248879,FD-69168798251,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 86954
x-amz-id-2: 4mo8q5rPt4iga5uXHUWKZ3T/zN7uF2JceU2fABr/CO1bLc1ydCbBmLTjPlOe2lTjIMfD6zZW+qY=
last-modified: Tue, 06 Jun 2023 13:22:40 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hYlcNj3vFjiFfbo5fnyoijqr2zuJxIxaFPKXY6DZ2ucE3hWhFBcjZu7Z%2F87BGVFON%2BSX0BUpm6IS%2FlEDfL%2Bo1%2F18raIgm8XAq3TyBagl4s8KucRw4v7RBrBfGOtMNYx7z8GvZrsJZ%2BulX6l1t%2FxXkuicuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7da90da2bcc41a6d-FRA
x-amz-cf-id: RlEMcT_wDqJ_LoJdprM-qgOEpsg0R9cJjKFE4FLCBoJA4ADP3bkDEA==

GET
H3 200 Untitled%20design-1.png
www.reversinglabs.com/hubfs/ 461 KB
462 KB 103ms
93ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Untitled%20design-1.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0459c28c94c8d05cb55e0098607a9abd55688f2f37d0a7c81b7eab7cb608934c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-120368301840,P-3375217,FLS-ALL
age: 415435
x-amz-request-id: 0V4JPNT7Q4MF9KXC
x-amz-server-side-encryption: AES256
edge-cache-tag: F-120368301840,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="Untitled%20design-1.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
cf-bgj: imgq:85,h2pri
etag: "ce4cfbc6db2a45bdfa62bf50180b3e99"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1686838151186
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 a811170f30183becd909b501e545e756.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: ksH415C0URg08T99Ou5QiBselp3abv0K
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=854801
x-cache: RefreshHit from cloudfront
cache-tag: F-120368301840,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 471600
x-amz-id-2: qH59PLURnHdNufs9d6b5lZEbgLyymA+kEz46Bzxj4YSRGk6z+TumsPd3L9r6gmhOpx9cC++aMqc=
last-modified: Thu, 15 Jun 2023 14:09:12 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2FYa%2B1VnJCU15YL1YI3hEVkCzlHLzRsJeFRbvX1o1lMnERDX5TkbQjKNv4hsI%2F%2FLpFd8jH5UQ5y3b7WEmZe7MMwiKof11FB89%2BxGNwiLLDpZ1Zr9MOo0B4uOmIFGwJyQja3cK3GtLhocfWuqnuamDYjJ0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7da90da2bcc51a6d-FRA
x-amz-cf-id: XNrPdq961Hh1y8ZJfQZq4KJQ7NfHou_jZFhpyXuOo42cQF6CDXHEFQ==

GET
H3 200 Software-Package-Deconstruction-Crypto-Wallet-1280x720.jpg
www.reversinglabs.com/hubfs/ 78 KB
80 KB 128ms
117ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/Software-Package-Deconstruction-Crypto-Wallet-1280x720.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8cff242d8243d06c4f5e633c11a01311b277e66694ffab6e9736c201349c92b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-119081002280,P-3375217,FLS-ALL
age: 513981
x-amz-request-id: WK9T2AAZ25YC9445
x-amz-server-side-encryption: AES256
edge-cache-tag: F-119081002280,P-3375217,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
content-disposition: inline; filename="Software-Package-Deconstruction-Crypto-Wallet-1280x720.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
cf-bgj: imgq:85,h2pri
etag: "e437cb496a0759b472451dc45521847f"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1686072887279
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 ca339b9e98820e424be1609317fd0314.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: h8ovb9fkAeu55QBnIkKQYdvD5te5_vJm
x-amz-cf-pop: FRA56-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=203804
x-cache: RefreshHit from cloudfront
cache-tag: F-119081002280,P-3375217,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 80328
x-amz-id-2: rpf8dSBsVz/ZqQ30o9ppSv8ilasTlW0xfcgUmb4Lq3IZ/xuegVQHJlam2SpUu5UXRJjMOguH7bm1ttSBc4PE0w==
last-modified: Tue, 06 Jun 2023 17:34:48 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fSC9ZTFazQEE4rq8AWjWDFU%2BNcABxFBMcWpeUO7RgAOyADGhR60vFQNUtvLv3X36M3mjFxkxCg1BQEtj84bHwyx5y2Dzv%2F8r3rgXD5p9jEQIJl1msLoQbZ7jsMOmKC2ed3B8JbzfLvcwOH1KMkmVF08zWA%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7da90da2bcc61a6d-FRA
x-amz-cf-id: n-NZSibpmvMgv8Yt2U0fbpmuqvFa_SqMlflG-PPmqcpJXuD37gwTOw==

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/ 85 KB
27 KB 36ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2426067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27437
last-modified: Fri, 12 May 2023 02:05:12 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "645d9ed8-6b2d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G7i4oVWmPnmmTMm1NnVWr%2BOdlrZuO%2FbLTXMlpz1zjmPHQh1%2BRdykYs9Jdg91dajq5%2F9%2FMCdLFAsdapfMW%2B98AJAomzTwn3dhGE%2FL8VOeJz5ja2iR%2FZdEDifgxQSRI1iU0UESFmtAcj6dNniR8SnE9lhg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7da90da27a1c6933-FRA
expires: Mon, 10 Jun 2024 03:09:31 GMT

GET
H2 200 embed.js Show response
static.hsappstatic.net/content-cwv-embed/static-1.240/ 11 KB
5 KB 48ms
16ms Script
application/javascript 2606:4700::6812:8d65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/content-cwv-embed/static-1.240/embed.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7944796ddd5fcfea5a16d0a01e0179972a31c071aa2fda7ba986323a6790752

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
x-amz-version-id: 2PIZat4k7iqlwfOTJtCspFj5G31rDKpK
via: 1.1 72924c94ff0d4750acacefc815e7e14c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: HAM50-C3
age: 628788
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 15 May 2023 19:59:44 GMT
server: cloudflare
etag: W/"bf8f264c31eb93db41268dd04256be85"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ruYu2%2BDHVcpsJepCDbTiin3gxCPKIWMqVqPuvpSW2ASvvKkRPw9Blc9T63ikoO4A%2B42hSpPQYGBpZA2kK2twtCBK1XbUIiQWxbpyCx%2FO2yS5IVA49St2on4gyKDDUNvmSQP9QRtKpzMuIe0bW4rsB%2BYVsg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 7da90da2de339007-FRA
x-amz-cf-id: xQBlhsM1WcKqXjmYhe7rhOOH_imN0HoEXT8kWskjfH-tGkFc8Zlx1A==
expires: Thu, 20 Jun 2024 03:09:31 GMT

GET
H3 200 simple-lightbox-min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/ 7 KB
3 KB 53ms
52ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6021916068/1569840500063/Reversinglabs_July2018_Theme/Coded_Files/simple-lightbox-min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-amz-cf-pop: IAD89-P1
x-amz-request-id: 7Z8YKTKDXNWP3GQY
x-amz-version-id: FsEJuIr7CYCWLWb_isdf3JLdbLwDP7p.
content-encoding: br
x-cache: RefreshHit from cloudfront
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: TA1nvniMSYF7A0TKv+ddTJ7ltlQ+as5oZ2Ez0zutazwxuEZ70M8PEVY6YtqpbDLZ0aDYjw8yXSM=
last-modified: Mon, 30 Sep 2019 10:48:21 GMT
server: cloudflare
etag: W/"d02c339064b8d2b370bc4e18fa6ae421"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I%2FhjlBkSXLUr2O%2B4XiOWW3RmkohBhFkEb4Kc018%2BSnw6%2BbUE6H8UkycX32pFEsPrWAQIOqxkV0UcqfSFPPQdFTq6yob3gXRDf%2BtsoIolyAUiaL2TZxuiDK2TqIX%2Bh2EFIVqtzhmKTnbzqLYrBy3vtb6OGA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da25c5d1a6d-FRA
x-amz-cf-id: DSP-Osxn4sWzomuZ0ipUBNeN3j_AQO-jcauXiPOrpGupKKZF6g6e7g==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 rd-2019-main.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/ 2 KB
2 KB 59ms
52ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11190015046/1639664698263/Redesign_june_2019/Coded_Files/JS/rd-2019-main.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1461
x-amz-request-id: CW0ND36GAHHZPERE
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"b2a254916a67659b4df42aa3c333359a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1639664698586
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: I5.cidQ.vGRls6iGZkmuPTBztEr2IVdj
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 133
alt-svc: h3=":443"; ma=86400
x-amz-id-2: h2pTKPKTFlGArXOYiGno1zEVG3E6yNbzI+sJNU4eDPCDnBO28ujxmt5L+/a8x1Yg/LfIKF4RYc0=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 190f7082-188f-45dc-9bfd-b26ccf91f26f
last-modified: Thu, 16 Dec 2021 14:24:59 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FSbMEkAHMfMqXo3xzBp4AUe1mJCuA0oL%2BSUiu00uk8PWFsb%2BlmxoD%2BmPZ5kGTwM0GYXV762bB6ebi9t%2BCY%2FP1aYBajaVH%2Bu%2FNUEsVCvgABjp9ifsI2XAO45J2RX6h7ME5xtg2p%2B6Sj0srzvbV%2B0yQh1sAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-7hqzq
access-control-allow-credentials: false
cf-ray: 7da90da2ac9f1a6d-FRA
x-amz-cf-id: FOPTCwq3iEwwbHCrnFkkFy10ziP4c3FILCAExIygQAdvzDR_3pfHaw==

GET
H3 200 jscookie.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/ 1 KB
2 KB 56ms
45ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/28203361861/1586494134457/Redesign_june_2019/Coded_Files/JS/jscookie.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1461
x-amz-request-id: QTG7XAAATKNP13C0
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"93c12b195cd05418a85b4eafc15c92fb"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: _PdfjdMgm8.M2DiCSVpcYFrpWe519SIO
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 134
alt-svc: h3=":443"; ma=86400
x-amz-id-2: FkqAqmuuhmhW6hsDVcKx2cDpcWAlfe6lSOJo3XC3pm76f6yqOupJiFJDWSvpdxVCesWtuX+qUvTvIfGrHp7pHBMERbkdwc0mjDcUwwyVGRU=
x-request-id: e9a15e8d-350a-49ee-a4f1-b214cda50bbb
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 10 Apr 2020 04:48:55 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6fuXNmH%2FdDcQRHITRlqoaVJ%2FbnmjvoTOjJP6oPvtKufmXVKxNH7v1c9UcQtx2T3n%2FWY9LxYY0OYDu0Eq9loBUYGI%2Bs2DX7y7cCnCcR8l9wb5C%2B3IeILiYnvY5w3V%2BMLVwPeFhp%2BUwqEJ2FiaM9xhWZeW8A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-hlzsf
access-control-allow-credentials: false
cf-ray: 7da90da2bca81a6d-FRA
x-amz-cf-id: kdjJlGsK3persOy9ZlZ5u-G135OqmaXATF7dHJcCELAll6ZMurC-DQ==

GET
H3 200 tiny-slider.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/ 31 KB
14 KB 63ms
52ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/21052151416/1577281626952/Redesign_june_2019/Custom_Modules/Sliders/JS/tiny-slider.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1461
x-amz-request-id: CW0SA7RCRQKTECT7
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"6603e5d1b1eded8b550dc3ef7fbe687d"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: a_gzCem69enGGi103.H.X02BRl8OY0mV
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 209
alt-svc: h3=":443"; ma=86400
x-amz-id-2: H0LPHw6/nM6dxB73NxlkuGo9K/i4vMXUotMRa4b62Xe/7Lz0QMiqsbihA9vWRi7nGkn64akE3Sw=
x-request-id: 63765baa-378d-44ea-b6af-07e508a7db31
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 25 Dec 2019 13:47:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0XUYNmZJdf0MhSQkcuiKpz246lnBtE6P1psPyNvGwQPfwM4RHxD8gX7QKml%2BqwprvGfkSJR9s9uJooMXd4T6mcQHv6TZAxheAK9Xz5JRmFjuuE9lFL4xYmoqJ90KEXZsVN8YqQHQu4ZJQwHqszbAB83ZhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7da90da2bca91a6d-FRA
x-amz-cf-id: c7NiB9yHTLR86Pfc06owzhrTid5tjgnhdV5kn9xsHKNTYZmfcfiPlA==

GET
H3 200 module_28186900061_StickyBar.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/ 1 KB
2 KB 63ms
53ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/28186900061/1683494323317/module_28186900061_StickyBar.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1461
x-amz-request-id: 80GNJQM6FRHN4BA8
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"05f529f2d7b3ca476f37bdcf0b96ef7e"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683494323317
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 7a99ed3f39c18af8fe138a695e5f657c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: Dj1AN92dBhP0GYrdJYdEZgTGEMSZDLdS
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 98
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1hy2ztk0sACwGhSaHXYGJTePyK2ElHBN6n6KqLJWX/hSVZLtLds/IPQ+WQYqlA9cxxggdjz4BtA=
x-evy-trace-route-configuration: listener_https/all
x-request-id: f572166f-83a7-408e-93ef-ff2c31e30e6d
last-modified: Sun, 07 May 2023 21:18:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lk98yi3MeSFyoR0yibS7pKOu%2FikTlFoIjKqmGnmuOiFx7hg0SxSGJ85U%2BDhcPIhDYQlfD4JcMYsVxKZs79QT%2B6GcUu5b8iijWkDNdqHcnrPHB%2B1LnvISQqEWUGOKtTGh4x5nz2sdU66hU49pXCEp4hLGnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-rwfnd
access-control-allow-credentials: false
cf-ray: 7da90da2bcab1a6d-FRA
x-amz-cf-id: nXR_gmwXMnT_HcUaEkIukORt9QClCbVkQ6HKo-u93_Kum0m6YhmVKQ==

GET
H3 200 micromodal.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/ 5 KB
3 KB 64ms
53ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/11395370929/1569840498778/Redesign_june_2019/Coded_Files/JS/micromodal.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 1461
x-amz-cf-pop: IAD12-P3
x-amz-request-id: DH3YHWCBPAWYR0GG
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-version-id: 3FilIB6THj7cvPLh93UnKYXf5w_lQZsq
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400
x-amz-id-2: H4yVQ47lxBKOsu4E4DcRU082QJyRgJ9mxvqZPQLU3lb2Xg2K5AsKMwMAGWdknf43qY5fAMTvbQSMZzEDLIEAbQ==
last-modified: Mon, 30 Sep 2019 10:48:19 GMT
server: cloudflare
etag: W/"84194eded494d011e2828f00329b15c6"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aBSITZPdZPK9aFxJxR8yOxa8YFISPwrTWH4i2wySsevvTwIqeap31CJUdw7ZzZUfrJP4OzM2I8P91TGY%2Frz1er2EExvb5%2BzDS1EMruaYDOsxKhwZ3nYawoAGbvYPOc7Js5Mm8IJW%2FcMa66RMNZs23siPOg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 7da90da2bcac1a6d-FRA
x-amz-cf-id: orqWMajDb6ig-xGyklFUIcQ1lLJdn1mqXvNlOmj3HZgusjgthSsETw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H3 200 module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/ 3 KB
2 KB 73ms
62ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/1563505647431/module_11395370497_Redesign_june_2019_Custom_Modules_Site_Search_Input_-_Header_Modal.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1461
x-amz-request-id: 66FXCNJZ5WWAP1SK
x-evy-trace-route-service-name: envoyset-translator
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"c27b7b6ea1f66fa47d64742279aee97a"
vary: origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=31536000
via: 1.1 7f7e359e1c06a914d3d305785359b84c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: uYaggxrRRLpm1_Oqgp40jmGQ7KENtM4f
x-amz-cf-pop: IAD89-C1
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 131
alt-svc: h3=":443"; ma=86400
x-amz-id-2: wp7HP3TuABXpp2KoRuOPboEeeSb3kcKpDwGZTBDqm+EUTPl/WoXuj6COpM4f4uwJbSDbE6lYjG8=
x-request-id: 80731ddb-ef82-427e-afa1-b62a2d39dfb6
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 19 Jul 2019 03:07:28 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1e%2FyeATr0XnckzFkU1eQaz%2FyzXVm9dKVObZPWMupyVohI3X7d9bKSdIb4SHyUPkdZzA%2BI66k%2FK8jvTHxzvLAoEoPlA77yvQOUKYq6WITqj%2BavXpBht%2FBQqlP0EMZgcJ0Nie9NW3Q9nubNoKaUKO%2FNkpvMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-r4k2f
access-control-allow-credentials: false
cf-ray: 7da90da2bcad1a6d-FRA
x-amz-cf-id: D2u0L8iiFJSMjFRToRKvkKhVO8lxpDheorXf3gRSd7CVH2ZoaLMNWg==

GET
H3 200 module_36845096476_Blog_listing_card_grid.min.js Show response
www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/ 723 B
2 KB 94ms
83ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/module_assets/36845096476/1683635694467/module_36845096476_Blog_listing_card_grid.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 1462
x-amz-request-id: 49376P20C5N2Z5NJ
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: COMPLETED
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-evy-trace-listener: listener_https
etag: W/"a26b824a33500d5b24e748588dd1c35a"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1683635694467
content-type: application/javascript; charset=utf-8
x-evy-trace-virtual-host: all
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 624a1750702d82319b25f17c35c73d04.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: vX4VGHX7oLkggy1lxnxWYDLA5rVHVqKM
x-amz-cf-pop: IAD89-P2
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 114
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lIjufGA3ZDty/JYLu572sxuNz17BFUtLeN1DL+Fk3VccVQXeBz49aN972HyHJBYd+XhB3bkzLZg=
x-evy-trace-route-configuration: listener_https/all
x-request-id: 988abf89-8a76-45b9-b1b2-c1393cc5ac83
last-modified: Tue, 09 May 2023 12:34:55 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Krj%2FLXPcDsSQtneERHIk4G2%2BN97OF9Jya%2BNVXeMl6yCueG5CuuQuOf%2F%2FEZKY7XbYuIyif0ZxOdGzxrFBm1inyWWzbyS3j6GVT9VcfmjaKfE7fuU3Hp2bq66k7buDcbtla8e2ZDNQsoHhaUtAPclv48gG5A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-55b7d448b-fwhk5
access-control-allow-credentials: false
cf-ray: 7da90da2bcae1a6d-FRA
x-amz-cf-id: p-enmljeQRSm9qto_xg_OQ_4375sVjbuPKBVHvIjeyUn05v21cU0pg==

GET
H3 200 3375217.js Show response
www.reversinglabs.com/hs/scriptloader/ 3 KB
2 KB 428ms
417ms Script
application/javascript 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/hs/scriptloader/3375217.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

954d110fcaa3d2b8c0fe2b962123a6f064646c2c56be4efbf42f0edf6f11d090

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: bc476e09-4785-49f3-b6eb-94f90fca37b7
x-envoy-upstream-service-time: 4
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9e14d03b-f080-433d-a88c-2d01dc22eca6
last-modified: Wed, 21 Jun 2023 03:00:57 GMT
server: cloudflare
x-trace: 2B4B1BBDF55E4EC71707DDACAD4370148A3B52D7B4000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-6wnvv
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VczewKduGJdwhW6OvCntRt0n4BCm0gfK24yRxNjefv3Imuyb3WcsOmNeq7Kqt3CqX0gX2A%2FZOM9stUZfdTsW3p4gpu22xHD48wfDnn%2FlRW5ZOSyattcRxBYjqevr466XUwtg23xmCB5KGtNwc%2BNts8yNLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7da90da2bcc71a6d-FRA
expires: Wed, 21 Jun 2023 03:10:32 GMT

GET
H2 200 cookieinfo.min.js Show response
cookieinfoscript.com/js/ 7 KB
4 KB 57ms
20ms Script
application/x-javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cookieinfoscript.com/js/cookieinfo.min.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: XBYSJ4G14H06R2QP
age: 1450
x-amz-meta-cb-modifiedtime: Tue, 16 May 2023 07:42:23 GMT
alt-svc: h3=":443"; ma=86400
x-amz-id-2: yDCRzmKIPk5KeA2PZC7fvrkpTy4njNdUH4+8pCuVnm9CrNO+EXlHmnEXoWH3RN7DqTVtKJ76VYo=
last-modified: Tue, 23 May 2023 08:24:42 GMT
server: cloudflare
etag: W/"d15d93068c1121f63008407d339bd819"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FdeIr2Qk56wRme98x6bfHCk4LcH3fJNwkPsvEFFAZ2%2F6kb9mVavcUEZPKTExPjLfLG8tlIXM95WzfGNAo81Zrrtsgr5tHiGyOnZFSBx42jPH6zAfHfJ04yf2XB3W9WuR4YN1OqomKG%2FIBkR8DduUjUoG4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: max-age=2678400
cf-ray: 7da90da2ee1c3a67-FRA

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
5 KB 54ms
7ms Script
application/x-javascript 108.138.15.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-15-119.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 02:20:04 GMT
Via: 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-P7
Age: 2968
ETag: "98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4593
X-Amz-Cf-Id: 6Bi3Ml820fKN3L_Ms310lJRktWs_KpWFaT64YKLcyPNuZ_Xhajx78Q==

GET
H2 404 t.js
vidassets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/ 0
0 48ms
8ms Script
application/json 52.222.236.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vidassets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-27.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 41ms
17ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 21 Jun 2023 03:09:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 21 Jun 2023 03:09:31 GMT

GET
H2 200 hotjar-3176008.js Show response
static.hotjar.com/c/ 9 KB
4 KB 85ms
41ms Script
application/javascript 18.66.97.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.37 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-37.fra56.r.cloudfront.net

Software

Resource Hash

fe66f723854aa886051ef2701d1ff24ec32a256a1f730ce96729f1c56de8d87f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 21c2c1b3872c539a34b64bcf45f4054c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/8ef9f6e44be0203225bc4fa43b08753a
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
cross-origin-resource-policy: cross-origin
x-amz-cf-id: ReuLWSTPlWbn4s6exS1-54WJR40zKGNKj7nj-O_deinouQsCdh9q_w==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 264 KB
91 KB 61ms
23ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

987aa5616df410de697a840378d902f1af64f394ff6b42bdec2736d61793f6b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92406
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Jun 2023 03:09:31 GMT

GET
H3 200 hero_bg_small_2019.jpg
www.reversinglabs.com/hubfs/images_redesign_2019/ 21 KB
22 KB 51ms
51ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hubfs/images_redesign_2019/hero_bg_small_2019.jpg

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
x-amz-meta-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
age: 415435
x-amz-request-id: ETAWNZ1DXE2QGNJ1
edge-cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
x-hs-https-only: worker
content-disposition: inline; filename="hero_bg_small_2019.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
cf-bgj: imgq:85,h2pri
etag: "1f3df8332048ad0295bff3a1c64cc9a4"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 4b69099d64ffa1fbe8adbe1235065a14.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: a5PUnngJgc3ZEsbtfbAJjo5eXZD8MNrM
x-amz-cf-pop: FRA56-P7
cf-polished: qual=85, origFmt=jpeg, origSize=95096
x-cache: RefreshHit from cloudfront
cache-tag: F-11448703956,FD-11023975807,P-3375217,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 21652
x-amz-id-2: 3EbBSNYeIaxuUSU1OcncL0yUIyFDWss9KA/UgKrB5nglzXlWsJfQbimK8xLv4DUdTM0sPqzSBdU=
last-modified: Sat, 20 Jul 2019 18:01:05 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=730AJOdOh252r%2FEM6i56AFx%2FEgzZ2TOHREpnfjsxQa1PRt%2BdI%2B7y3FHRdzVJ4Zq58i8wr8Kotwclv8kAUSVSg1dpIFJ7T61MdD3fKwFdVOVEwWCoWRpwnsNlU2d%2FIp3GimueNrOe4%2FurU3RtSEiMsZgSVw%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7da90da2dcde1a6d-FRA
x-amz-cf-id: 5UMB6EF8yoSr292Ft052K8NAwwjh6nl-f2lZuQh2qBJqDHKxgbzwaw==

GET
H2 200 Tungsten-Semibold.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 20 KB
20 KB 714ms
695ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Semibold.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: zHy7ciep2n8U9dRoPSeIZ0ms5UoFs.HW
age: 568741
x-amz-cf-pop: FRA56-P7
x-amz-server-side-encryption: AES256
x-amz-request-id: 9HES1HN2AB3CW3X4
edge-cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-28202642064,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: G0rx5jzH1sa0akP/ogiaVC008jTdSMUKBtd+TQzYvdE3eUMlL+H/mOs45mBeWu7B7M/+aTkDvDc=
last-modified: Fri, 10 Apr 2020 04:06:19 GMT
server: cloudflare
etag: W/"c4cba999623da66f241554c075076b87"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da309722c1b-FRA
x-amz-cf-id: kai8iPgsCStSXfyujR7d1hI1ngOMEm_jOq-IYaatJWW67MyuMHJxIA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 Tungsten-Book.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 750ms
732ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Book.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 f3d57c6f1e03e389abd50b7f7535cee4.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: DhZpSF_okm4kqA3d5rsX6px.W1gW4AHr
age: 568741
x-amz-cf-pop: FRA56-P7
x-amz-request-id: Q8TWEPY28DY1BG09
edge-cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651164052,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-amz-id-2: EI0koVxQ7XzPTjo0Tf87SpF0Jjfq7H4XtOGVXTb2efNin8ufd3H0nCTvxXkbA5EV2K/oKffE6b0=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"ab8a234e214dd3506e9fada6b6eafdca"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da309762c1b-FRA
x-amz-cf-id: xLotoem9XML5sDo7haYHXy5_kErHr_s62cJwwrilkFISJM3EWsuUqg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 rl-icons.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/ 4 KB
5 KB 211ms
192ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversing_Labs_November%202018/Font/rl-icons.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 158fcfe21f7e6b2462341c797edc267c.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-amz-version-id: 7Fg3.Df2IKZXcjymNQNOrpeZRI7DlXZ.
age: 568741
x-amz-cf-pop: DUS51-P3
x-amz-server-side-encryption: AES256
x-amz-request-id: Q8TKHNTDK5DQBNWD
edge-cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
cache-tag: F-6528836102,FD-6528836052,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-amz-id-2: PGOwG7WWs8Z4I3Nuph6HAg93pohQYRphlYBco75r1GzkFwFgGE1yyjTguGFcsTjCxIK7hhp0qvNesu5GIX4Msg==
last-modified: Fri, 24 Apr 2020 14:40:36 GMT
server: cloudflare
etag: W/"97ca286c0b94878b6b2adf44559b6265"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da309742c1b-FRA
x-amz-cf-id: DYMHrsxl9LZkx_xjxRZcB5vU_PliBbpGaogXxjvfAiYzZ5--fJuZ0w==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 34ms
8ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 00:26:19 GMT
x-content-type-options: nosniff
age: 9793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 00:26:19 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 35ms
9ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 03:30:27 GMT
x-content-type-options: nosniff
age: 344345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 03:30:27 GMT

GET
H2 200 TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 206ms
188ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age: 1764953
x-amz-cf-pop: FRA56-C1
x-amz-request-id: Z2FFE5K0EV8X2QVT
edge-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: 6Rn1EKkevDDSqoflO14gsNePsmuSML/tKbXPVbemk57xtTp5knbvGY+4A6FbbxQpiVd+qd0rnch4vzOPANWvtA==
last-modified: Tue, 18 Jun 2019 15:58:22 GMT
server: cloudflare
etag: W/"650100235aa1598769f1744ec1674c39"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da309772c1b-FRA
x-amz-cf-id: 3aJH--UkoiKA1j6Hfo7t2H9zNG9U1985UDQ8H3erVA67jAAOkRUBTQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 41ms
16ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 15:24:53 GMT
x-content-type-options: nosniff
age: 301479
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 15:24:53 GMT

GET
H2 200 Tungsten-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 19 KB
20 KB 203ms
185ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 64f5a3ab7bfb476c633b87746aced0ee.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: 8RS6BKpEUu5kELkbXI3oOka23XcEIvrY
age: 484297
x-amz-cf-pop: FRA56-P4
x-amz-request-id: ECRHAA8KBPGPF31E
edge-cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570055973,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: o9T2/mI1OHh12f3WfGPui3zISn5+wl7JP7gG5OXcBxr+kMEF40USv+u6+UnpXb+u62nHglDWBvk=
last-modified: Tue, 18 Jun 2019 15:58:23 GMT
server: cloudflare
etag: W/"e62b1278f1fdeb9765b266aa18905620"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da309752c1b-FRA
x-amz-cf-id: jh5Dv-FD1oBgSClsYcWm0HHvs3f6YyvUoqiEz3Fb0mrrsY0NxgYNNg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H2 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 42ms
17ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 05:13:27 GMT
x-content-type-options: nosniff
age: 338165
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17508
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 05:13:27 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 44ms
19ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 17:04:15 GMT
x-content-type-options: nosniff
age: 295517
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 17:04:15 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 38ms
21ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,300i,400,500,700,900&display=swap&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b076e86301cbee8c5c9aef51863a9c0a88e6f6d2aabdffca93e031113c6caa74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 01:30:36 GMT
x-content-type-options: nosniff
age: 5936
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11796
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 01:30:36 GMT

GET
H2 200 Tungsten-Light.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
22 KB 187ms
183ms Font
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/Tungsten-Light.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs-fs/hub/3375217/hub_generated/template_assets/6519964395/1685359416657/Reversing_Labs_November2018_Theme/Coded_Files/Reversing_Labs_November2018-style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 4b69099d64ffa1fbe8adbe1235065a14.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: oZWO71JPrAMaAkHUdMvYTNjF0GR2Ck4O
age: 568741
x-amz-cf-pop: FRA56-P7
x-amz-request-id: T16E8HBE2P178JDP
edge-cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-11651159874,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 20
x-amz-id-2: bd7LG2RDPGIfJ35J+iVCGVKgChqn5bZysDCnFBYDFFP+/XvuvGQROhVfWhOrakVlOd+JjGzZYoEFwxDSlKYqpwl2yhTyuPXx1k7tsv4CBzs=
last-modified: Sun, 28 Jul 2019 19:57:28 GMT
server: cloudflare
etag: W/"100aa5d32672286f544f73831e764ee1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da369bd2c1b-FRA
x-amz-cf-id: g76tsnC5ZzLBE2RSU2eBo3kv7UGg7MyaRhPZnsOvkdg5r6WtuT2fzw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 20

GET
H3 200 RATs-found-hiding-in-the-npm-attic.png
www.reversinglabs.com/hs-fs/hubfs/Blog/ 20 KB
21 KB 718ms
718ms Image
image/webp 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.reversinglabs.com/hs-fs/hubfs/Blog/RATs-found-hiding-in-the-npm-attic.png?width=1400&height=732&name=RATs-found-hiding-in-the-npm-attic.png

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d685080c8cbd71431b0899b348e4cfa9cdaa6489eecf859bf2f90bea9a81bb5

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
via: 1.1 4a0b7683a1d33d6d186965e831f2de96.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag: F-115919460238,FD-11822274822,P-3375217,FLS-ALL
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
content-length: 20650
cf-resized: internal=ok/m q=0 n=571+111 c=0+0 v=2023.6.2 l=20650
last-modified: Wed, 17 May 2023 14:54:40 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "cf6xZWL5KZeRax0QK6PBh0pIeDsvDsvdffkG1yWKzcDQ:fc5de023b8b4a46ef941062bb1c89d96"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9Au1PKIuxQ3wkRrK%2Bq%2B%2Bi9SJDtbqDtRON18%2BrquAiE%2B5xyJ%2FhW9mnfs0fNhfrAkdZm2Bljker0%2BxvkM%2BshEuIhok3XHTlQBMMr6Seg%2Ft94MVRdI%2BQJVQTZF3wHYTMAvcBEu27k0E3vE0hSxzAuvG6kl%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 7da90da36d5e1a6d-FRA

GET
H2 200 modules.eaf53d21f7615d018198.js Show response
script.hotjar.com/ 270 KB
69 KB 46ms
7ms Script
application/javascript 52.222.236.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.eaf53d21f7615d018198.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3176008.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-63.fra56.r.cloudfront.net

Software

Resource Hash

12f18ac76a714cd4ccd0efdf3020a85db1bfa90c3c251550c536e12fee746f0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 11:06:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 57805
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 70358
last-modified: Tue, 20 Jun 2023 11:05:41 GMT
etag: "f5171afe976b523c80342bb54eacae5a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: okGw0eVXwTEtDwCbhnGrywBFky4X7T1lN8yrSAAE2BzVgKfjmbB25Q==

GET
H3 200 json Show response
www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/ 16 KB
4 KB 140ms
140ms XHR
application/json 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/forms/embed/v3/form/3375217/24abef2a-a2f4-4889-8899-dd4026584fa9/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

179e2a22784bb51c2cea9b52e9d347c8c845e3466208fcfc41ab456715bb2fc0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-origin-hublet: na1
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 85fab476-7b91-4c13-81a7-727463dd8b8b
x-envoy-upstream-service-time: 25
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b6c50a81-aa59-4ef5-ab80-4209f617534c
server: cloudflare
x-trace: 2B16FB052A9797408780D6B3ACC0370EA6D9B4EF25000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-max-age: 180
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-qr8ft
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kJ2CHF5YR2vrXdXx2B8RNFEro95Fx86urxpi%2BxOfsY9fzaNQJY9Pyt0Zty%2FiFv9Ooqyj4XL0regE1l7UKFO9VqLtWrxtI8uDgBe1BjJyKQxKry2AzRCBnwcYtZuRkmUbOngujQP5Dee1n%2FXZKuysTuy%2FFw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7da90da43dea1a6d-FRA
access-control-allow-headers: *
x-robots-tag: none

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 43ms
6ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 21 Jun 2023 02:35:22 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2050
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 21 Jun 2023 04:35:22 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 43ms
8ms Script
application/x-javascript 2a02:26f0:480:f::213:7edd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=47181
accept-ranges: bytes
content-length: 4777

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 43ms
8ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230083-FRA

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 52ms
15ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 site-script.js Show response
cdn.metadata.io/ 6 KB
2 KB 117ms
8ms Script
application/javascript 2600:9000:223c:cc00:9:d7d4:1380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.metadata.io/site-script.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:cc00:9:d7d4:1380:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

647727ae0e75775384721910f7f8b4a34ead24d19734e9c2d5b7b5e55bafcd8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id: spTfb1gmcul985xGG_dfzGTOtoPBlFrt
content-encoding: gzip
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
date: Tue, 20 Jun 2023 04:16:40 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: FRA56-P2
age: 82373
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 03 May 2023 16:54:16 GMT
server: AmazonS3
etag: W/"d778e53882fab9f8d9fc1d0e1b413994"
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-amz-cf-id: NKqx14tjPYMl8otPuhBlSj8BZI7rN9MzcpH0R2tWzER3Nj_fCH7NBQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
103 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKL9P8B

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6a619f8dfcde38cf4170026a34814e51a6965948c8a402070d6adea84f93f1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 104910
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Jun 2023 03:09:32 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/ 43 B
418 B 384ms
93ms Image
image/gif 52.22.155.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/91aab57be1f94ec2a2ef647592767813/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.155.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-155-139.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:32 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,1950868425739cd5081093bde39d8cdc,10.0.0.75,50652,81.95.5.44,,265169099842,1,1687316972.550,0.001,,.,0,0,0.000,0.000,-,0,0,197,140,70,10,26847,,,,,,-,
Content-Type: image/gif

GET
H/1.1 200
OK VisitorTrack2.js Show response
code.visitor-track.com/ 358 B
661 B 771ms
144ms Script
application/javascript 63.134.242.129
CRYSTALTECH

General

Check archive.org

Show headers Download Go to

Full URL: https://code.visitor-track.com/VisitorTrack2.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 63.134.242.129 , United States, ASN14992 (CRYSTALTECH, US),
Reverse DNS: www.visitortracklog.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: a969e5f8c4950230af86fcc3fa95485eb505cb6c58574146b87115ee6bd7bfdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Apr 2019 22:27:51 GMT
Server: Microsoft-IIS/8.5
ETag: "3214e76daf3d41:0"
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 355

GET
H2 200 JrRu3vUM8j33QSR7Bwxw Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 187ms
153ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/JrRu3vUM8j33QSR7Bwxw

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

5379004c81d9e88acac827cfbb870707911cf48d07cee6be4176583a9b710cde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7da90da49a072ba3-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok
alt-svc: h3=":443"; ma=86400

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 40ms
8ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

860cd7df7d8d0b49562e6cd77817fb594be77e792dc49c74f9786b9773f6c3a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 21 Jun 2023 03:09:32 GMT
content-md5: cWUoehXoQSAQ51PAYjGbrA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
x-fb-debug: lrTWJ4GSqqdENtifiw1nWi6k9w2AU6qHgDO5V3+C2vMJz+u9KQHAzM+yLcVjlFwE5X6wA36S+Ttd7pDSKuN5ig==
x-fb-trip-id: 1679558926
x-fb-content-md5: e29d7d1ddbf538cbce9c32d940d0361e
cross-origin-opener-policy: same-origin-allow-popups
etag: "309f9f2701406ac20925001339922db1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 21 Jun 2023 03:11:07 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 34ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669F) /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:32 GMT
Content-Encoding: gzip
Age: 1313
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27630
Last-Modified: Tue, 24 Jan 2023 21:41:51 GMT
Server: ECS (frb/669F)
Etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H2 204 has-permission Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
977 B 188ms
165ms Script
text/plain 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=3375217&callback=jsonpHandler

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 4f912fa4-953c-46fd-8ff2-b61422d9942e
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=7da90da4b8219279&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: 9f1f2062-a5da-43f5-a1f1-3688ff8562bb
server: cloudflare
x-trace: 2B882CABA425D214E090C5ECBB7F24510A9F973B09000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-nnm64
x-evy-trace-virtual-host: all
cache-control: max-age=0
access-control-allow-credentials: true
cf-ray: 7da90da4b8219279-FRA

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 55ms
10ms Script
application/javascript 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

4585de074993b4da8a79534bcff1888de422aa3eeb91e4abe7c0717e208db0ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 23 Mar 2022 23:40:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "623bafe1-7ad3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 9828
expires: Wed, 21 Jun 2023 03:09:32 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/3176008/ 148 B
322 B 113ms
39ms XHR
application/json 52.213.12.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/3176008/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.eaf53d21f7615d018198.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.213.12.174 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-12-174.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ca9d3bdace9ebc26af8da67aaf1e2392aa60db9e2b889568f318a768773c3a68

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: br
vary: Accept-Encoding
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 TungstenNarrow-Medium.woff
3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/ 21 KB
21 KB 33ms
32ms Other
application/font-woff 2606:4700::6812:f0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Reversinglabs_July2018/Fonts/TungstenNarrow-Medium.woff
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e

Request headers

Referer: https://www.reversinglabs.com/
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-meta-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-amz-version-id: HmXdIK8Bc_0fkfivtLAcWmXE077h5rsG
age: 1764953
x-amz-cf-pop: FRA56-C1
x-amz-request-id: Z2FFE5K0EV8X2QVT
edge-cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
cache-tag: F-10570558853,FD-5926386258,P-3375217,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
x-amz-id-2: 6Rn1EKkevDDSqoflO14gsNePsmuSML/tKbXPVbemk57xtTp5knbvGY+4A6FbbxQpiVd+qd0rnch4vzOPANWvtA==
last-modified: Tue, 18 Jun 2019 15:58:22 GMT
server: cloudflare
etag: W/"650100235aa1598769f1744ec1674c39"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
cf-ray: 7da90da5fb8b2c1b-FRA
x-amz-cf-id: 3aJH--UkoiKA1j6Hfo7t2H9zNG9U1985UDQ8H3erVA67jAAOkRUBTQ==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
983 B 143ms
121ms Image
image/gif 2606:4700::6811:d5f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d5f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
CF-Cache-Status: DYNAMIC
X-HubSpot-Correlation-Id: 5a97f14f-a3c9-4a8d-9b8b-c37551349b64
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9f3ef024-51c0-4f1f-ab79-8c8590b3a734
Server: cloudflare
X-Trace: 2BCB5D8D26BE34A5B4642D0C9F36EB40D4308CEA47000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-2ls4d
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7da90da62c5592c6-FRA

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/ 3 KB
2 KB 47ms
24ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970567826/?random=1687316972511&cv=11&fst=1687316972511&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&hn=www.googleadservices.com&frm=0&tiba=RATs%20found%20hiding%20in%20the%20npm%20attic&auid=1351768697.1687316973&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f18973adba2fe668a4ea0acbaa50470f2d037b12d2b3dac14c36826c78333209

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1359
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 40ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je36e2&_p=1353237663&_gaz=1&cid=1337275839.1687316973&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1687316972&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 62ms
19ms Ping
text/plain 2a00:1450:400c:c03::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JVM9Z1XQPL&cid=1337275839.1687316973&gtm=45je36e2&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 34ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je36e2&_p=1353237663&cid=1337275839.1687316973&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1687316972&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&en=Hubspot%20Form%20-%20Listener&_c=1&_et=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 27ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je36e2&_p=1353237663&cid=1337275839.1687316973&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=3&sid=1687316972&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&en=LinkedIn%20Insight&_c=1&_et=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 23ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je36e2&_p=1353237663&cid=1337275839.1687316973&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=4&sid=1687316972&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&en=MetaData%20Script%20Landing%20page%20Conv&_c=1&_et=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 17ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JVM9Z1XQPL&gtm=45je36e2&_p=1353237663&cid=1337275839.1687316973&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=5&sid=1687316972&sct=1&seg=0&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&en=Reddit%20Conversion%20Tracking&_c=1&_et=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JVM9Z1XQPL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 44ms
20ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JVM9Z1XQPL&cid=1337275839.1687316973&gtm=45je36e2&aip=1&z=119124272

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
378 B 90ms
17ms XHR
application/json 2600:9000:26db:ca00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:ca00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 00:41:46 GMT
content-encoding: gzip
via: 1.1 a29f8f45a0707c5c9e054636ff51dce8.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 8865
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=37021
x-amz-cf-id: o3I_CdVcfQb8TBN5KxYFQsk6cXRV4wcPXtZq2kHpYEVwnoZIsNkkvw==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/ 36 B
376 B 89ms
17ms XHR
application/json 2600:9000:26db:ca00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/976924/domain/reversinglabs.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:ca00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 00:41:46 GMT
content-encoding: gzip
via: 1.1 a29f8f45a0707c5c9e054636ff51dce8.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 8865
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=37021
x-amz-cf-id: 5OL7eIiPV3dxduERpW90MzICwgkNnDQQMaJuiSglim7DDT2yW8zi4g==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D976924%26time%3D1687316972577%26url%3Dhttps%253A%252F%252Fwww.reversinglabs.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=tr...

0
265 B

696ms
667ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJiDaEgEl2LJQAAAYjb7ci5VILohpZ5Kf4_chp72Q2RdmR-JlqY3bg0LrpbimX_iw
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:34 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 980F74BDAEFA4708968446D04F4BA7E4 Ref B: FRAEDGE1808 Ref C: 2023-06-21T03:09:33Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+mxjinElRJF1E3bKe8w==

Redirect headers

date: Wed, 21 Jun 2023 03:09:33 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 8351E5B977734DF590C0F339B04D8301 Ref B: FRAEDGE1817 Ref C: 2023-06-21T03:09:33Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=976924&time=1687316972577&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJiDaEgEl2LJQAAAYjb7ci5VILohpZ5Kf4_chp72Q2RdmR-JlqY3bg0LrpbimX_iw
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+mxjX94Tw//Pb7/2FDQ==

GET
H2 200 adsct
t.co/i/ 43 B
377 B 153ms
114ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=34de5888-deba-47d5-a009-bd51f0bf7d7a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4c16989a-24ba-4518-92cc-64866d6494ee&tw_document_href=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=07cai&type=javascript&version=2.3.29

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time: 106
date: Wed, 21 Jun 2023 03:09:32 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: e242b96a61e3c5dd
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: f2d5ec1960c6245d6d8162b9f9dd2a4f5d4c307413c1a0d0cbbb15f37ec03ab5
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 135ms
109ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=34de5888-deba-47d5-a009-bd51f0bf7d7a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=4c16989a-24ba-4518-92cc-64866d6494ee&tw_document_href=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=07cai&type=javascript&version=2.3.29

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time: 102
date: Wed, 21 Jun 2023 03:09:31 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: bab9c0a04f12f8e6
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: c28ee04fdf431243f574c4ed3327d78ced981305be354f96b10be6179af9ea28
content-length: 43

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
225 B 16ms
15ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1353237663&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&ul=en-us&de=UTF-8&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=907644993&gjid=1376277038&cid=1337275839.1687316973&tid=UA-32828290-1&_gid=2010322088.1687316973&_r=1&_slc=1&gtm=45He36e2n81MKL9P8B&z=2126256947

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 142ms
111ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1687316972602&id=t2_neftrm6a&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=861087da-c50a-448e-831c-53e45acb9c92&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H3 200 all.js Show response
connect.facebook.net/en_GB/ 308 KB
87 KB 20ms
12ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=834a19f537f2ddeec157dd14bf1940e0

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d5936449fe01666e0d4dc73de1de96be3d7dd102fd2ff7495549bfc5533b6918

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 21 Jun 2023 03:09:32 GMT
content-md5: Gs5aL/3nOOnr5gYxS6X14g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88559
x-fb-debug: 5U2Hqd3FYxh3sSdd1a8ZHQQc4X3OAw9THun6LyzkK1m0ZXKqzCi/zOFYXEiwr5Jd+5dOiwqwHntZXrUWH4L93w==
x-fb-content-md5: 9e1c88e7833118912e75f2bce7f17dc5
cross-origin-opener-policy: same-origin-allow-popups
etag: "9f2c4876207f65db7b2a1964925d51a1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Thu, 20 Jun 2024 02:51:15 GMT

GET
H/1.1 200
OK widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame AD43 320 KB
104 KB 7ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 4599431
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105435
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Jun 2023 03:09:32 GMT
Etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:13 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 192ms
95ms XHR
application/json 54.194.204.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.eaf53d21f7615d018198.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.194.204.236 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-204-236.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 0974b9b2c435d30b1a5fddd8cb7370fd58ca33a65bcac19e2c0e5be16f863fd7

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 21 Jun 2023 03:09:32 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
80 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2e0befa860faca395187da6abbd240923a5315578d70ecfde344d7deecfd5d62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82188
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Jun 2023 03:09:32 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
817 B 31ms
9ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 03:09:32 GMT
AN-X-Request-Uuid: 00a93bd1-8fb5-4651-b4dd-dcff863946dc
Server: nginx/1.23.4
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.reversinglabs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 81.95.5.44; 81.95.5.44; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 15ms
8ms XHR
text/html 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.reversinglabs.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H/1.1 200
OK counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
983 B 403ms
372ms Image
image/gif 2606:4700::6811:d4f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d4f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:33 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
CF-Cache-Status: DYNAMIC
X-HubSpot-Correlation-Id: ea990811-3880-4570-9526-2e076166455c
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 1
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2e2a647a-ef9b-4f54-b602-b25c4a2d2a7e
Server: cloudflare
X-Trace: 2B1AAB70B4C9FA3FB60DBD034300C44DE003470E5F000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-2ls4d
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7da90da7abbe9bb0-FRA

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 149ms
122ms Script
application/javascript 2606:4700::6811:6dc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6dc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
x-amz-version-id: S1jmwKbmrdTaJO._teNI0LpuWSvl4WIJ
via: 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
content-encoding: br
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.378/bundles/project.js&cfRay=7da90da79fb9038e-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 293686a9-e6dc-4637-8e48-a030dfe91d8d
last-modified: Tue, 13 Jun 2023 09:45:35 UTC
server: cloudflare
etag: W/"b19afd994dc32a5784e74169cca8128a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-8rxrz
cf-ray: 7da90da79fb9038e-FRA
x-amz-cf-id: qNfXHWXzVWx3SWWYDPTA86Ib9s_Ojoo50wUSXejTk_n_In_5wTMp2A==
x-hs-target-asset: collected-forms-embed-js/static-1.378/bundles/project.js

GET
H2 200 3375217.js Show response
js.hs-analytics.net/analytics/1687316700000/ 66 KB
21 KB 539ms
513ms Script
text/javascript 2606:4700::6810:8ace
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1687316700000/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8ace , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aad2b3276e38ea3eb60824cd165a74761c3e0ae6be1e2b96ae390c35f64c14f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: B4PNKZQ3DX5MD3RT
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-envoy-upstream-service-time: 38
x-amz-id-2: ConN0AlG8QNyV7qCN/GgBz38CSHke5XWFQaKCSQrNqhhArfsfofDWUQpW4zikoWpAzPru/Hjy0RFnr33/VXHI85em23nE1Iy
x-evy-trace-listener: listener_https
x-request-id: f9d10231-2ad6-4bef-8444-5dc841b9f719
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 15 Jun 2023 14:43:22 GMT
server: cloudflare
etag: W/"480e918b237d26d38f89cd7c3d573b06"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-ns2gd
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7da90da79f915c74-FRA
expires: Wed, 21 Jun 2023 03:14:33 GMT

GET
H2 200 3375217.js Show response
js.hs-banner.com/ 60 KB
16 KB 421ms
395ms Script
text/javascript 2606:4700::6812:18c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/3375217.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
x-amz-version-id: bw3Z1oFRilBSp2nJoqwzp68d0FJwmW7g
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: VC7HA0TS3ETG90BX
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-envoy-upstream-service-time: 58
x-amz-id-2: MDU5C7puuN8gflEqBkPXwpiDsje1E+z8+iNGJauRYik26vRbMgxCChYJFCgVOZltAbKhxvYBj1E=
x-evy-trace-listener: listener_https
x-request-id: 7fa552ea-e343-4930-9d7d-c662f4f4f8e9
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 31 May 2023 09:21:10 GMT
server: cloudflare
etag: W/"4f3650703a78045f1ac9ea0084ff242e"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-hsbd9
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7da90da79c08364b-FRA
expires: Wed, 21 Jun 2023 03:14:33 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 545 KB
87 KB 50ms
24ms Script
application/javascript 2606:4700::6811:816e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:816e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae5bfbf6629277d9993e143b04fd081fdc22ac1790dbc4edf51165c3d9b52f0f

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Origin: https://www.reversinglabs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding: br
age: 14077
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1216/bundle/main/lead-flows-release.js&cfRay=7da7b5f5fe302c01-IAD
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"8f29c013ec69bca0f98e5c18d5d45d87"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1216/bundle/main/lead-flows-release.js
date: Wed, 21 Jun 2023 03:09:32 GMT
x-amz-version-id: v5..R77GwEs1PfJguIOtzHIVDGDmfqTH
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-request-id: d99d536e-0924-453d-a6d5-81016fef19ff
last-modified: Mon, 19 Jun 2023 09:39:47 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray: 7da90da79af92bf7-FRA
x-amz-cf-id: ShJIB4C5Gj8G1pQ6g1_sTfVZsANzCPtq4nGu1Q63Fuai3Hci6SHEuQ==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 45ms
15ms Script
application/javascript 2606:4700::6810:75be
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:75be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
x-amz-version-id: tZNqk9JR4hpL4HhK3M1JevHxbsFiShRO
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 101
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.382/bundles/pixels-release.js&cfRay=7da90b302fd8366c-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 0ad4e947-d65d-4681-bf28-4a48a5d937fc
last-modified: Tue, 20 Jun 2023 11:26:10 UTC
server: cloudflare
etag: W/"15e730192a32cd4563797f160ff1fd6f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-wd7jg
cf-ray: 7da90da7bac83688-FRA
x-amz-cf-id: CW86aIEu19L6tf8IW8QtTD85-0DvrbtWCJW-y8Dj9DV6FMnPNiH2zw==
x-hs-target-asset: adsscriptloaderstatic/static-1.382/bundles/pixels-release.js

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 75 KB
22 KB 54ms
23ms Script
application/javascript 2606:4700::6811:65ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/hs/scriptloader/3375217.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:65ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbbe9c4d273a13abdade0522f1d5323410659451ef72fb80c16f372ae206b282

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
x-amz-version-id: QamE4Oe0AGtrfJSqbw051Y47gukyknvh
via: 1.1 68a3b1d5c75429221abc685a453afb60.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 261
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13423/bundles/project.js&cfRay=7da907451db52baf-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 01b304f9-7cfe-4484-8833-a78ae6ffb2a6
last-modified: Tue, 13 Jun 2023 10:43:24 UTC
server: cloudflare
etag: W/"bd6464fa791153e75807e46f33ec851c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-8rxrz
cf-ray: 7da90da7db5c2bae-FRA
x-amz-cf-id: dTHxeDANGm3BZLg6qQi_qygt27Md6PZuBJ4eEqYZqmz9loD7qU9GYg==
x-hs-target-asset: conversations-embed/static-1.13423/bundles/project.js

GET
H2 200 settings Show response
syndication.twitter.com/ Frame AD43 869 B
659 B 135ms
112ms Fetch
application/json 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=f4f521e7882cb4ec579b92222007f939479f3db8

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.reversinglabs.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time: 104
date: Wed, 21 Jun 2023 03:09:32 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Wed, 21 Jun 2023 03:09:32 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: 46b383613d4c08b1
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: 12d61d3ba9fdac177c170aae29e8636e9f7c496a5d4d6cc66cb3f07f7b238fd7
content-length: 337

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 231ms
205ms Image
image/gif 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&session=1d1b92b1-ac5b-4822-8ae7-fce25037c79a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A32%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20researchers%20discovered%20two%20malicious%20packages%20that%20contained%20TurkoRat%2C%20an%20infostealer%20that%20lurked%20on%20npm%20for%20months%20before%20being%20detected.%20%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22RATs%20found%20hiding%20in%20the%20npm%20attic%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&pageViewId=ba212e32-5b6f-4f04-895c-03833d7e2f8b&an_uid=0

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:32 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/970567826/ 42 B
455 B 46ms
21ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970567826/?random=1687316972511&cv=11&fst=1687316400000&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&frm=0&tiba=RATs%20found%20hiding%20in%20the%20npm%20attic&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3783372992&rmt_tld=0&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970567826/ 42 B
154 B 21ms
20ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970567826/?random=1687316972511&cv=11&fst=1687316400000&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&frm=0&tiba=RATs%20found%20hiding%20in%20the%20npm%20attic&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3783372992&rmt_tld=1&ipr=y

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 28ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-6H8MZ60CSB&gtm=45je36e0&_p=1353237663&ul=en-us&sr=1600x1200&cid=1337275839.1687316973&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABA&ngs=1&_s=1&dl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&dt=RATs%20found%20hiding%20in%20the%20npm%20attic&sid=1687316972&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6H8MZ60CSB&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 03:09:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reversinglabs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 widget Show response
www.reversinglabs.com/_hcms/livechat/ 303 B
1 KB 155ms
154ms XHR
application/json 2606:2c40::c73c:671f
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reversinglabs.com/_hcms/livechat/widget?portalId=3375217&conversations-embed=static-1.13423&mobile=false&messagesUtk=984438fa89b74d1c8f5a4256833a4ae4&traceId=984438fa89b74d1c8f5a4256833a4ae4

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:671f , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

add351f16b0bcadcdca7135d02605136fa22f8516f2a958513b8838eab59f33c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d3bc8296-57a3-4b88-aab7-dfec7044229e
x-envoy-upstream-service-time: 9
x-hs-https-only: worker
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4354f2fd-c1e4-4d57-9995-857d7b9d1668
server: cloudflare
x-trace: 2B97F670894FD4CE5C65BC1CB3CAEA4540741BAB4A000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-26lc7
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C7oWvfBZueq5Nw9W9p%2Fa4R1FP7LLXxPMREB1Jf3ukCFF3DgdMpMC0kpV3TvjZR7X2FpJmNNgGrg7Kb1v7KpkjykQVut%2F5bRvrBbyF2uUxUUgJw%2FAvyXcK8fhW7Z1yaIX0NV7faD8mTQcvZA09yUC%2B9yaqA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7da90da8a93f1a6d-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
473 B 128ms
127ms XHR
application/json 2606:4700::6811:6dc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3375217&utk=
Requested by: Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6dc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 65c5577c-9a0d-42a2-ba29-a02d8da3460d
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e67da915-2094-4d17-b2e6-1cd4e85c4574
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-frzj9
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 7da90da908c3038e-FRA

GET
H/1.1 200
OK vt2.aspx Show response
code.visitor-track.com/ 0
324 B 146ms
146ms Script
text/javascript 63.134.242.129
CRYSTALTECH

General

Check archive.org

Show headers Download Go to

Full URL: https://code.visitor-track.com/vt2.aspx?v=6&id=110888&r=&u=https%3A//www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Requested by: Host: code.visitor-track.com
URL: https://code.visitor-track.com/VisitorTrack2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 63.134.242.129 , United States, ASN14992 (CRYSTALTECH, US),
Reverse DNS: www.visitortracklog.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 03:09:26 GMT
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 0
Content-Type: text/javascript

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
624 B 130ms
116ms Image
image/gif 2606:4700::6811:d5f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:d5f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 14479d7c-f5dc-4682-98dd-a417302ea473
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: fb8da1e7-9f52-45d9-984e-151ad6a292a1
server: cloudflare
x-trace: 2B4F82ACC4AF462A5AF959237496773E5033418CA6000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-zlsgj
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 7da90da9dcdf696f-FRA

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 115 B
1 KB 152ms
127ms XHR
application/json 2606:4700::6811:c8cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=3375217

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 55ca71e9-b711-421c-8960-267428b7c4b9
x-envoy-upstream-service-time: 8
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 34a3f2a6-63e2-4e65-8e80-6ecf0a14265a
server: cloudflare
x-trace: 2B13DEFDE6EDA7DC6E964814E1939F21D948DF3A56000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-gm8dw
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SBYuezb0nPSzo9MHrZmRI6gCk37TebppKAKv2d3BYCq1eP%2FXPdJUoCkQUA%2Ba1OQPYInfkAaXYT2oVdcRFANKYHxdDeF7k0OP%2BdW0KDCPfXUH9bV%2ByFfb9FLxsvO3pLk9b%2FgfSfeLQ%2ByUfat6"}],"group":"cf-nel","max_age":604800}
cf-ray: 7da90daa4b429b31-FRA
access-control-allow-headers: *

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
102 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-970567826

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9f058de3b8f05df6269696e4eb4cedab133b96257e0c5f74b4cebe09abbdad96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 104833
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Jun 2023 03:09:33 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 206ms
205ms Image
image/gif 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&session=1d1b92b1-ac5b-4822-8ae7-fce25037c79a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A32%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20researchers%20discovered%20two%20malicious%20packages%20that%20contained%20TurkoRat%2C%20an%20infostealer%20that%20lurked%20on%20npm%20for%20months%20before%20being%20detected.%20%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22RATs%20found%20hiding%20in%20the%20npm%20attic%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&pageViewId=ba212e32-5b6f-4f04-895c-03833d7e2f8b&an_uid=0

Requested by

Host: www.reversinglabs.com
URL: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame BA16 0
182 B 109ms
32ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Wed, 21 Jun 2023 03:09:34 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame FBC6 0
181 B 108ms
33ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=7qhctws&ref=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&upid=8t4axvj&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Wed, 21 Jun 2023 03:09:34 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
603 B 130ms
130ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=3375217&pi=115811496016&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&cpi=115811496016&cgi=5901382633&lpi=115811496016&lvi=115811496016&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&t=RATs+found+hiding+in+the+npm+attic&cts=1687316974556&vi=8a15d699eed76c2472530064e11d2161&nc=true&u=60854195.8a15d699eed76c2472530064e11d2161.1687316974552.1687316974552.1687316974552.1&b=60854195.1.1687316974552&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 66911a11-08d0-46ae-9225-20f6f080866a
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2bd75d2e-4a99-40cb-8112-59e65173979a
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oNUwpxtkFpHGQxzDf0AbXmDWc1tf1wBvRcQCH3xifzhnYqwaN5qGRiMCjqJsy7sSazQ3UF2ttFD1JyaigRBkEWjSpDbImEIGcB25NFqqCb1BZzzRbIs0QP%2Ba7hAH1pTUDYzFxneq%2BdUINAsoG6%2Fy"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-p7wls
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7da90db2febc9279-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
437 B 125ms
124ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=c4a1c82b-2f54-4ccd-8401-94b0d415a8a5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=3375217&pi=115811496016&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&cpi=115811496016&cgi=5901382633&lpi=115811496016&lvi=115811496016&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&t=RATs+found+hiding+in+the+npm+attic&cts=1687316974557&vi=8a15d699eed76c2472530064e11d2161&nc=true&u=60854195.8a15d699eed76c2472530064e11d2161.1687316974552.1687316974552.1687316974552.1&b=60854195.1.1687316974552&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 275bacc7-efae-47a6-9d92-0de6f57b2a3a
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: adb1a92b-dd13-4a91-b750-43cece0a6dd5
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0FQLUZR4KuLqBuF0c%2BEpYfogepNzGOvIE8YuXNndj8OzotvLNT9YQEwGdWMMeFXGudZGQXbsJGmvXqldb7FmDNDg1lxfGWsmN2xhPfmY2uthaRRXlc15UYy0czeFvy9HJHMUL5qggPWLC1HP%2Bjlg"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-z7z79
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7da90db30ec39279-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
434 B 127ms
126ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=24abef2a-a2f4-4889-8899-dd4026584fa9&fci=c4a1c82b-2f54-4ccd-8401-94b0d415a8a5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=3375217&pi=115811496016&ct=blog-post&ccu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&cpi=115811496016&cgi=5901382633&lpi=115811496016&lvi=115811496016&lvc=en&pu=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&t=RATs+found+hiding+in+the+npm+attic&cts=1687316974558&vi=8a15d699eed76c2472530064e11d2161&nc=true&u=60854195.8a15d699eed76c2472530064e11d2161.1687316974552.1687316974552.1687316974552.1&b=60854195.1.1687316974552&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 333a2597-4253-4e51-8f94-b688e5c70fb7
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3e8e1581-4c05-45ca-943b-b55a89045f0d
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HWjh6UcNiL9rTlPgEiPMtYBmPDJsM9koK9Xbtl%2FAaf%2FKJO4FFOihvQ0D7ptzVVd6Ykfc%2FQf3l7ZnY539RX504InWIss7dNxD90u1RngCiqPU1pLtu4npS9r52lhsWvYUYdJuSe%2BsQFnrxwsSDUQh"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-j9299
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7da90db30ec49279-FRA
x-robots-tag: none

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 220 B
1 KB 411ms
390ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3375217&utk=8a15d699eed76c2472530064e11d2161&__hstc=60854195.8a15d699eed76c2472530064e11d2161.1687316974552.1687316974552.1687316974552.1&__hssc=60854195.1.1687316974552&contentId=115811496016&currentUrl=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e23b4d2391811979a181fefb2ebd748a793e5fb608095298cfce77b568982d8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: bfa33e9f-89c2-4356-931f-5f11d35aa538
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f03e38f3-52e3-460d-b075-1b87fd6c85d2
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reversinglabs.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qbbr87Wo5HL2VlrpslHgyGxYB26w3Sysm%2FhZrAZBqPW6anKFhUEc5XOGdQFBqyyPejD6v9wQSpZqrdOEqLc6DG3g%2BkbQD5HO8OcpXSxfv0kL6BMUp27rbZG6%2Fk6tLpo2lTQfmp3GpPVj131StFMC"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 7da90db36f5b1e4e-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-w9hvc

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 206ms
205ms Image
image/gif 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&session=1d1b92b1-ac5b-4822-8ae7-fce25037c79a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A33%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20researchers%20discovered%20two%20malicious%20packages%20that%20contained%20TurkoRat%2C%20an%20infostealer%20that%20lurked%20on%20npm%20for%20months%20before%20being%20detected.%20%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22RATs%20found%20hiding%20in%20the%20npm%20attic%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&pageViewId=ba212e32-5b6f-4f04-895c-03833d7e2f8b&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 206ms
206ms Image
image/gif 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&session=1d1b92b1-ac5b-4822-8ae7-fce25037c79a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A34%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20researchers%20discovered%20two%20malicious%20packages%20that%20contained%20TurkoRat%2C%20an%20infostealer%20that%20lurked%20on%20npm%20for%20months%20before%20being%20detected.%20%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22RATs%20found%20hiding%20in%20the%20npm%20attic%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&pageViewId=ba212e32-5b6f-4f04-895c-03833d7e2f8b&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 204ms
203ms Image
image/gif 95.101.111.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=125cf4892bae30e8b53458235ef53f8d&svisitor=null&session=1d1b92b1-ac5b-4822-8ae7-fce25037c79a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20Jun%202023%2003%3A09%3A35%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22ReversingLabs%20researchers%20discovered%20two%20malicious%20packages%20that%20contained%20TurkoRat%2C%20an%20infostealer%20that%20lurked%20on%20npm%20for%20months%20before%20being%20detected.%20%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22RATs%20found%20hiding%20in%20the%20npm%20attic%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.reversinglabs.com%2Fblog%2Frats-found-hiding-in-the-npm-attic&pageViewId=ba212e32-5b6f-4f04-895c-03833d7e2f8b&an_uid=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 03:09:36 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

125 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

38 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.reversinglabs.com/	1970-01-20 12:41:58	Name: __cf_bm Value: K3BMOn3V3Pckr7QzISdii7TREIuUSfPxpHv.fEyaCiY-1687316971-0-AQIVa/NBlMORhmmdQEp0ssRbkuhagjTOY+09fxqdCxpCJU00MtMUGWqjTSb7SoxxI1Sbrtk+1DtJcfzJ7PAO60s=
.www.reversinglabs.com/	1969-12-31 23:59:59	Name: __cfruid Value: 436a2b82963c7626cd741bcc747ea17a71de6f58-1687316971
.reversinglabs.com/	1970-01-20 21:27:32	Name: _hjSessionUser_3176008 Value: eyJpZCI6IjNkZjViMjFlLWViMzYtNWVhNC1iYTJhLTNjNTNlM2NlYjhkOCIsImNyZWF0ZWQiOjE2ODczMTY5NzIzODgsImV4aXN0aW5nIjpmYWxzZX0=
.reversinglabs.com/	1970-01-20 12:41:58	Name: _hjFirstSeen Value: 1
.reversinglabs.com/	1970-01-20 12:41:57	Name: _hjIncludedInSessionSample_3176008 Value: 1
.reversinglabs.com/	1970-01-20 12:41:58	Name: _hjSession_3176008 Value: eyJpZCI6ImUwZmFkZDlhLTU3ZjktNDQyZi1iZTVlLWUxMTU2MGQ5MjFiNiIsImNyZWF0ZWQiOjE2ODczMTY5NzIzOTgsImluU2FtcGxlIjp0cnVlfQ==
.reversinglabs.com/	1970-01-20 12:41:58	Name: _hjAbsoluteSessionInProgress Value: 0
.ws.zoominfo.com/	1970-01-20 21:27:32	Name: visitorId Value: 70b46e174f6a66fee9c88ea19e258db0ff1b1ca5d1bd689e22716fa74ef7dddc
.zoominfo.com/	1970-01-20 12:41:58	Name: __cf_bm Value: TxAiVAU7vHAPJ0zgFB61.298HRKPWCtPmyU0ShIa1Vc-1687316972-0-AXj39mdq+t8+8hW4R9lKYi/9POjZxrTzgfsPGu3HRHc/REQKcXhM19SaRmdhjcXC4VO3eoqiCTMfbLLkZM6KbiU=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: oVUf3o8xvroYLGnRs11ECmUgAU_GOmXfh7vmx5fjAeI-1687316972402-0-604800000
.hubspot.com/	1970-01-20 12:41:58	Name: __cf_bm Value: smMaLhqQ2Y75Atq52jfgXDj9O9isSUvIc4Fj2gnTRtY-1687316972-0-AXP2Wd/GYbsUjvHIVelpJJI+0Jhx1CjyVPGqeibfmkFLLkLzAcS81cTkbmHBQXVoG6gVlb8/N+CKFkSGuI1+UIk=
.reversinglabs.com/	1970-01-20 14:51:32	Name: _gcl_au Value: 1.1.1351768697.1687316973
.reversinglabs.com/	1970-01-20 22:17:56	Name: _ga_JVM9Z1XQPL Value: GS1.1.1687316972.1.0.1687316972.60.0.0
.doubleclick.net/	1970-01-20 12:41:57	Name: test_cookie Value: CheckForPermission
.reversinglabs.com/	1970-01-20 22:17:56	Name: _ga Value: GA1.2.1337275839.1687316973
.reversinglabs.com/	1970-01-20 12:43:23	Name: _gid Value: GA1.2.2010322088.1687316973
.reversinglabs.com/	1970-01-20 12:41:57	Name: _gat_UA-32828290-1 Value: 1
.reversinglabs.com/	1970-01-20 14:51:32	Name: _rdt_uuid Value: 1687316972602.861087da-c50a-448e-831c-53e45acb9c92
www.reversinglabs.com/	1970-01-20 12:43:23	Name: ln_or Value: eyI5NzY5MjQiOiJkIn0%3D
.twitter.com/	1970-01-20 22:17:56	Name: personalization_id Value: "v1_6OYm8iMc+Q4NzWmPXWORGQ=="
.t.co/	1970-01-20 22:17:56	Name: muc_ads Value: 3729d6f4-f8d2-47f5-b101-5785b89ff89a
www.reversinglabs.com/	1970-01-20 12:52:01	Name: _an_uid Value: 0
www.reversinglabs.com/	1970-01-20 22:17:56	Name: _gd_visitor Value: ed625f4f-4248-45cd-8d43-e5862f749e24
www.reversinglabs.com/	1970-01-20 12:42:11	Name: _gd_session Value: 1d1b92b1-ac5b-4822-8ae7-fce25037c79a
.reversinglabs.com/	1970-01-20 22:17:56	Name: _ga_6H8MZ60CSB Value: GS1.2.1687316972.1.0.1687316972.0.0.0
.6sc.co/	1970-01-20 22:17:56	Name: 6suuid Value: b8d017025aaa1200ec699264e6030000f6030600
code.visitor-track.com/	1970-01-20 22:17:56	Name: cke110888 Value: 6/20/2023 11:09:26 PM
.linkedin.com/	1970-01-20 14:51:32	Name: li_sugr Value: b7db5682-1526-43a3-ad0a-6dee9e590f39
.linkedin.com/	1970-01-20 21:27:32	Name: bcookie Value: "v=2&15a02531-d0a5-424d-8752-7ee8cd7f8877"
.linkedin.com/	1970-01-20 12:43:23	Name: lidc Value: "b=OGST07:s=O:r=O:a=O:p=O:g=2575:u=1:x=1:i=1687316973:t=1687403373:v=2:sig=AQHF299jcILne5_cKJilBabYfX3I8atY"
.linkedin.com/	1970-01-20 13:25:08	Name: UserMatchHistory Value: AQJNNjfwP5H8wQAAAYjb7cdHAcO3gTMgl0RzV69gWyUdokg7Swir_ABEYlEDOl533L3hNNVlQxzGSg
.linkedin.com/	1970-01-20 13:25:08	Name: AnalyticsSyncHistory Value: AQK9B1wftof7vgAAAYjb7cdH6rh3Q1l9gERDNEyi7jPvHVY3LUCY6a7DVDroSsVz9fLmvtpaFfOehtjwfK--pw
.www.linkedin.com/	1970-01-20 21:27:32	Name: bscookie Value: "v=1&20230621030933f1904be9-18c2-49c8-84a0-ed602638d8daAQEE3gspAtDJs2-4K6-uzfDv1ilhbJ6G"
.linkedin.com/	1970-01-20 17:01:08	Name: li_gc Value: MTswOzE2ODczMTY5NzM7MjswMjHb9TMLetQSHsymff1PbvuT/iRgzCrBDYfzRX2ZKG1wRQ==
.reversinglabs.com/	1970-01-20 17:01:08	Name: __hstc Value: 60854195.8a15d699eed76c2472530064e11d2161.1687316974552.1687316974552.1687316974552.1
.reversinglabs.com/	1970-01-20 17:01:08	Name: hubspotutk Value: 8a15d699eed76c2472530064e11d2161
.reversinglabs.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.reversinglabs.com/	1970-01-20 12:41:58	Name: __hssc Value: 60854195.1.1687316974552

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://vidassets.terminus.services/492173fc-4b58-46c9-a3cc-09a5abedb64b/t.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3375217.fs1.hubspotusercontent-na1.net
alb.reddit.com
analytics.twitter.com
api.hubapi.com
app.hubspot.com
b.6sc.co
c.6sc.co
cdn.linkedin.oribi.io
cdn.metadata.io
cdn2.hubspot.net
cdnjs.cloudflare.com
code.visitor-track.com
connect.facebook.net
content.hotjar.io
cookieinfoscript.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
in.hotjar.com
insight.adsrvr.org
j.6sc.co
js.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
platform.linkedin.com
platform.twitter.com
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
static.hsappstatic.net
stats.g.doubleclick.net
syndication.twitter.com
t.co
track.hubspot.com
vidassets.terminus.services
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.reversinglabs.com
104.244.42.133
104.244.42.195
104.244.42.200
108.138.15.119
13.107.42.14
146.75.116.157
151.101.129.181
151.101.193.140
18.66.97.37
2001:4860:4802:32::36
2600:9000:223c:cc00:9:d7d4:1380:93a1
2600:9000:26db:ca00:2:53b2:240:93a1
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:234:59:254c:406:2366:268c
2606:2c40::c73c:671f
2606:4700::6810:650c
2606:4700::6810:75be
2606:4700::6810:8ace
2606:4700::6811:180e
2606:4700::6811:65ac
2606:4700::6811:6dc7
2606:4700::6811:816e
2606:4700::6811:c8cc
2606:4700::6811:d4f3
2606:4700::6811:d5f3
2606:4700::6812:18c4
2606:4700::6812:8d65
2606:4700::6812:cfc9
2606:4700::6812:f0f
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:802::200a
2a00:1450:4001:806::2003
2a00:1450:4001:806::2004
2a00:1450:4001:806::200e
2a00:1450:4001:80e::2002
2a00:1450:4001:828::2003
2a00:1450:4001:829::2008
2a00:1450:400c:c03::9a
2a02:26f0:480:f::213:7edd
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:200::396
2a06:98c1:3120::3
37.252.173.215
52.213.12.174
52.22.155.139
52.222.236.27
52.222.236.63
52.223.40.198
54.194.204.236
63.134.242.129
95.101.111.184
04245f85425b7978fbfd092971444a755772b93d9fb41f4c58f388e520403afd
0459c28c94c8d05cb55e0098607a9abd55688f2f37d0a7c81b7eab7cb608934c
0974b9b2c435d30b1a5fddd8cb7370fd58ca33a65bcac19e2c0e5be16f863fd7
09d01a00c23781420e6623249a514a995ea7dd8417159f308ca5391078243928
0ab31a97c236988bb6e415187b2197cdbf689664173015dffd6da8eb96b1626f
0e6f86db36936507e3598ce0f7d5aba4fe33d0f670ee1dc223be1fac54cfb63f
0f631dc190b0572010591fe489a4d434db77ce0ff6156e9e7e9aa745156c095c
12f18ac76a714cd4ccd0efdf3020a85db1bfa90c3c251550c536e12fee746f0d
130eb7bbe1dca232b6636767637e6bdc2a35fc2d412db3a601593d79c1d743a5
179e2a22784bb51c2cea9b52e9d347c8c845e3466208fcfc41ab456715bb2fc0
1a5131ba88c40e02e211f48163838569b854a383f19817b94db2f4e83f5d044d
1a5f6ffeb8930092b29aef8860e2c8ebbe25dd2dcdf70ab4b6b137c4b4592f70
249d08c8fde3e1912f9d6d25ff14eed26f4adea29df815b794933eb133f8ec37
257855f4e23a1e3d382077b15bfc30971c9c261fc23512c88abfdcda05f28bc4
27215dede1579d37bcf4ab9ef8fc7d968bd02081c4e61d77837a9bb8f6ca9511
2e0befa860faca395187da6abbd240923a5315578d70ecfde344d7deecfd5d62
2e0e46665e34d5b09152a1ab9be9e89802f26f40b6e1a29780bf07ae94bc2376
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
350dfd290fcaf704accd61883b7d6dd6e2fcb8d6f10c747ba96707c20bddc000
37eae8190baecf55f16575bf754238976116ad37b55f81e27db05743461cd507
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
39b586e6036e36b0347c1dea81780e8db5c055b6e9ad4a602f431757c4c0f2e0
3ac9f879f23b53c0856f5a719a5d2913f2890b5e06b60a8879945c245080fc52
3c50dd5c1727efe22037460b8eaa121b22932d39ab13865d1ecf5b8372d2da4d
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
41ac7f7c2a05d8a7ac157e7b70327e9ac39639c2a1e92bd7d53ef4ac80ce5888
4585de074993b4da8a79534bcff1888de422aa3eeb91e4abe7c0717e208db0ea
4bc7148ba69c82eccc86c4a9b90d4cf456d9129c9503ad143c8005735f3fb8ba
4ed697a94ae987ec690170223f411112068b61caf8678788cb4c37347249fd00
51c44e74557b4d9af1b5ac48371ed285ee7f21b773c9d5c989f2adae169dd230
5379004c81d9e88acac827cfbb870707911cf48d07cee6be4176583a9b710cde
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
589ec6096d83ed322d2e1cf7b85f978ecfe80dc19aab6ac106ef5e2352e32269
58d64fd2e682de660c8739fe1f6161faec1903845acc2e19df71024a761c598a
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
60081aded64161f61825305d90da71fccecd1a8bf5cbdd49204e074ba0cf3f5f
61ce08dbad99d88826d7e7d374b628662137c7893a943d6a541cf4b0455c5067
647727ae0e75775384721910f7f8b4a34ead24d19734e9c2d5b7b5e55bafcd8b
686fc2ffff91be023d9492d94f27b02850460b634ca5ffa9fb0fd7152e3a6b10
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ba44383bc980179d0772e2785fdb088c71034b7c54607e739bc56c0e1002250
6d685080c8cbd71431b0899b348e4cfa9cdaa6489eecf859bf2f90bea9a81bb5
70d1119d232eb54079a766d9e1564320f2c20e6e71683e31edf766c26e9c678e
716dcc9643502eb35aa1f08b4805ec1f377daad3e67c11f9d00d65c6fc6336cf
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b1ecc91aa14b48acb2f7655cc2f4285d7839ab8d239982d4473b02917cd55db
7d6d019be5fdd6ed212ab83345278024e52cb55e59e5a577644a58f1c29ae316
7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3
84240275eed2746f9d66bb0a5f46915d74ba6a7c6e210ba4634a16e03ca54270
84967c4e03cea78139700967fe57d0acfd5fbe1002c2d08819ccfd21e095bc4b
860cd7df7d8d0b49562e6cd77817fb594be77e792dc49c74f9786b9773f6c3a3
86bc7c25a3bf03fad86ce1733e1a562b1395d60635b29960b7b3f68aefa8bc7a
8ae4a0865523070959595a6df44d592fd924f6a8503d913a2cbfb81b5df45e62
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
8dc97419c862f91c4279fb9e2d9a0b7b9b63982ae1d3700a351ea1950c46f564
9103cd19fa0db417520474c8682d15529708804e7d5dcee981c8a19a7c083875
9191b06fe12487d3f456e3c4be9b9da18583b4788dfe12883ef9c47d46ee325a
94e9a5e460eda83b3532d27cbb92a176ac95f1429ae89f9164d47a29d3370ee2
954d110fcaa3d2b8c0fe2b962123a6f064646c2c56be4efbf42f0edf6f11d090
95fbf2ab9776737534e11c42ed7370e97aa96be93bdda3783a252eab6d9a0e70
96012ea1e665f4555d84592c02ed5ee2ae06ae12e7869c7878a9fb15cf2bd729
987aa5616df410de697a840378d902f1af64f394ff6b42bdec2736d61793f6b0
9a612c9ad7bdfdfeb71ed257ea676a5bca9db5694ee8a0f0c1f8a96330429ea3
9e634b615e771259a6dc723ef2cda097c480ad26dc92faa6450c5e4e16e3288a
9f058de3b8f05df6269696e4eb4cedab133b96257e0c5f74b4cebe09abbdad96
a6a619f8dfcde38cf4170026a34814e51a6965948c8a402070d6adea84f93f1f
a969e5f8c4950230af86fcc3fa95485eb505cb6c58574146b87115ee6bd7bfdf
a9ff889aa2badd5dcf9989574fa2006fb183febc1685353d19bf1dd28ed7c1b2
aad2b3276e38ea3eb60824cd165a74761c3e0ae6be1e2b96ae390c35f64c14f5
abe603cadd5d178715e8d259697dd4470bf63c6ad1115eb0af8715c778640133
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acf17525014fa899516fd8f0b55b2e5122f8d9e2a42601e328858f32eb1a2b45
add351f16b0bcadcdca7135d02605136fa22f8516f2a958513b8838eab59f33c
ae5bfbf6629277d9993e143b04fd081fdc22ac1790dbc4edf51165c3d9b52f0f
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b076e86301cbee8c5c9aef51863a9c0a88e6f6d2aabdffca93e031113c6caa74
b0ce7f9729d1118a6c7ae2e3d0922b9fe681d73340ac96d05aecaaf2312151a5
b568d3a45b39bf2cb3227fd72108e88e763358001b5d047fc7f7aee7c6671f0f
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb8007225d94a099cddbade7ea904667c0dd0b68d5e30778e5c6257589ab94d1
bbbe9c4d273a13abdade0522f1d5323410659451ef72fb80c16f372ae206b282
bc595999f7c46e3f7a293c86fcc256c35467e9947bf0051464628416f1db14f0
be806513bf84af0e310b27e6d4c7eaa56119e06690c7b0bc50d728b7e82b3c9f
c2ba07210f1d72787dc1705b2c92ec9dfb1203f8d42df45ee4488e85a2852661
c44bc92eb78d7b1596789095812e8c24f5c3f9b4835318cf329204d1efc37abb
c710baeea1e6c18176ac4d6100768f82144059cfaf4277cb00ae86ebe75e9cf3
c7d36be0a73651297b0f6b15b1aa2e63a204489bb9c552c11e0cf7db771081d4
c9b277f813652ab4fc3476fe4b9771d2d29e10204caef39416ad8d30e45fc5a2
ca9d3bdace9ebc26af8da67aaf1e2392aa60db9e2b889568f318a768773c3a68
cafcf576874435cca6e41394ae820ab1573b83f8b405d10d3ff8add93614c8fe
ccb2a355b322b6476a8796c76802c14a9748c41b054ebf5fdc88275c911488d1
ce0c9eb1ca6a35fcba1cbaf022ab817e3565f9d56cfb40591ef03bdf71ca089c
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d5936449fe01666e0d4dc73de1de96be3d7dd102fd2ff7495549bfc5533b6918
d6dc97993d7e4803aeb35d0e9a24f0393eceb43de5f7ff0f0e437f1b05aea4e2
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e23b4d2391811979a181fefb2ebd748a793e5fb608095298cfce77b568982d8e
e2d14bf82ef15e64d7503eed437a43ad5f26d4f5bcac6745870c32f1ed77a8a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40c8f9d7a3c7c71ee109b2ae4df7dd9b6e3b0cd287d77f9a98312c53392ae25
e574399fded05f0056e582c86bc027b5619870521818d8dfe04c5ffbe1754d47
e5808455786f658eccda5e658ffcc1073d757dd9b70ea3c931fa7a36d583abbc
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e8cff242d8243d06c4f5e633c11a01311b277e66694ffab6e9736c201349c92b
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f18973adba2fe668a4ea0acbaa50470f2d037b12d2b3dac14c36826c78333209
f35c317df74c5ceaca83bc620ab17f68e882a21e5378933002f20aae3af0517f
f419ad33d162aefac608940b47d2a524fca46eee0c82f877710a6369e68be33c
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f7944796ddd5fcfea5a16d0a01e0179972a31c071aa2fda7ba986323a6790752
fb71e0d749623b7c583b86934740d866e5f6fc000204c6b3cb7dfe25a888cc60
fc2fab7ad17829305a9146a6a0db45bf46dba8b104548a2777c5583c0aff059d
fd5e0c3a0682f03217f201588e51e77bf778d5506224074918f505423f0e25a2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe66f723854aa886051ef2701d1ff24ec32a256a1f730ce96729f1c56de8d87f

www.reversinglabs.com Open in urlscan Pro 2606:2c40::c73c:671f Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

151 Requests

99 %HTTPS

65 %IPv6

42 Domains

59 Subdomains

52 IPs

4 Countries

2791 kBTransfer

6104 kBSize

38 Cookies

22 Outgoing links

Redirected requests

151 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reversinglabs.com Open in urlscan Pro
2606:2c40::c73c:671f Public Scan

Screenshot
Live screenshot

Full Image

151
Requests

99 %
HTTPS

65 %
IPv6

42
Domains

59
Subdomains

52
IPs

4
Countries

2791 kB
Transfer

6104 kB
Size

38
Cookies

151 HTTP transactions
1 data transactions