www.securonix.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Submission: On October 08 via api (October 8th 2024, 12:38:53 pm UTC) from IN — Scanned from DE

Summary HTTP 147 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 30 IPs in 5 countries across 22 domains to perform 147 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.securonix.com.
TLS certificate: Issued by WE1 on October 7th 2024. Valid for: 3 months.

This is the only time www.securonix.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	172.67.39.148 172.67.39.148	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
29	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700:310... 2606:4700:3108::ac42:2bc5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
3	2620:1ec:33:3... 2620:1ec:33:3::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a99	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	2600:9000:264... 2600:9000:2644:5600:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6811:f5cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2620:1ec:29:1... 2620:1ec:29:1::64	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	18.245.86.77 18.245.86.77	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	216.58.206.67 216.58.206.67	15169 (GOOGLE) (GOOGLE)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:710... 2a02:26f0:7100::210:172	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a05:d018:cc3... 2a05:d018:cc3:fe04:1b3:4333:51ee:414b	16509 (AMAZON-02) (AMAZON-02)
3	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
3	20.114.189.70 20.114.189.70	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	13.35.58.58 13.35.58.58	16509 (AMAZON-02) (AMAZON-02)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.16.117.43 104.16.117.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.16.118.43 104.16.118.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
147	30

43 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.securonix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3108::ac42:2bc5 (United States)

ASN13335 (CLOUDFLARENET, US)

embed.formhq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:3::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a99 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2644:5600:6:9280:1080:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f5cb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:29:1::64 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.245.86.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-77.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.67 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100::210:172 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:cc3:fe04:1b3:4333:51ee:414b (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.114.189.70 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

t.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.35.58.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-58.fra60.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.117.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.16.118.43 (None, )

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	securonix.com www.securonix.com	988 KB
39	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 b.6sc.co — Cisco Umbrella Rank: 3611 eps.6sc.co — Cisco Umbrella Rank: 11869 v.eps.6sc.co — Cisco Umbrella Rank: 16729	34 KB
8	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2896	154 KB
8	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 4352	32 KB
7	adroll.com 1 redirects s.adroll.com — Cisco Umbrella Rank: 3395 d.adroll.com — Cisco Umbrella Rank: 1624	121 KB
5	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4482 ws-assets.zoominfo.com — Cisco Umbrella Rank: 11155	30 KB
5	driftt.com js.driftt.com — Cisco Umbrella Rank: 6590	71 KB
5	clarity.ms www.clarity.ms — Cisco Umbrella Rank: 634 t.clarity.ms — Cisco Umbrella Rank: 6202	28 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	3 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 5671	4 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 348	15 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	305 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4401
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 797	4 KB
2	formhq.net embed.formhq.net — Cisco Umbrella Rank: 148318	4 KB
1	google.de www.google.de — Cisco Umbrella Rank: 11271	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 136	547 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	3 KB
1	gstatic.com fonts.gstatic.com	50 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	932 B
147	22

	Domain	Requested by
43	www.securonix.com	www.securonix.com
24	b.6sc.co	www.securonix.com
8	dev.visualwebsiteoptimizer.com	www.securonix.com
8	static.addtoany.com	www.securonix.com static.addtoany.com
6	s.adroll.com	1 redirects www.googletagmanager.com www.securonix.com s.adroll.com
5	v.eps.6sc.co	j.6sc.co
5	js.driftt.com	www.securonix.com js.driftt.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
3	js.zi-scripts.com	www.securonix.com js.zi-scripts.com
3	t.clarity.ms	www.clarity.ms
3	eps.6sc.co	j.6sc.co
3	c.6sc.co	j.6sc.co
3	px.ads.linkedin.com	1 redirects snap.licdn.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.securonix.com
3	www.googletagmanager.com	www.securonix.com www.googletagmanager.com
2	ipv6.6sc.co	j.6sc.co
2	region1.analytics.google.com	www.googletagmanager.com
2	www.clarity.ms	www.googletagmanager.com www.clarity.ms
2	unpkg.com	1 redirects www.securonix.com
2	embed.formhq.net	www.googletagmanager.com embed.formhq.net
2	j.6sc.co	www.googletagmanager.com www.securonix.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	d.adroll.com	s.adroll.com
1	px4.ads.linkedin.com	www.securonix.com
1	www.google.de	www.securonix.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	cdn.jsdelivr.net	www.securonix.com
1	fonts.gstatic.com	fonts.googleapis.com
1	cdnjs.cloudflare.com	www.securonix.com
1	fonts.googleapis.com	www.securonix.com
147	31

This site contains links to these domains. Also see Links.

Domain
partners.securonix.com
in.linkedin.com
twitter.com
www.youtube.com
www.addtoany.com
socradar.io
www.rewterz.com
3gstudent.github.io
gchq.github.io
securonix.force.com

Subject Issuer	Validity	Valid
www.securonix.com WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
static.addtoany.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
formhq.net WE1	`2024-08-25` - `2024-11-23`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
s.adroll.com Amazon RSA 2048 M02	`2024-05-03` - `2025-06-01`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
drift.com Amazon RSA 2048 M03	`2024-07-30` - `2025-08-27`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.google.de WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
d.adroll.com Amazon RSA 2048 M02	`2024-09-09` - `2025-10-09`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M02	`2024-08-29` - `2025-09-27`	a year	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
zi-scripts.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
zoominfo.com E5	`2024-09-14` - `2024-12-13`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Frame ID: A4380A35BB53418938428361D48F5F35
Requests: 137 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 0BDA5FB6EAC1593E1B20E4CE4D0A9163
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=3077e9db-3d0b-4d78-bfcc-30434296fe0a&sessionStarted=1728391127.793&campaignRefreshToken=8a74181b-2846-4303-97ca-2690ed384126&hideController=false&pageLoadStartTime=1728391126353&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F
Frame ID: F320055D9F772A5AA464C600BB72B390
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1728391126353
Frame ID: 26C12966EE259BB31D60B465881B7C0A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SHROUDED#SLEEP: A Deep Dive into North Korea’s Ongoing Campaign Against Southeast Asia - Securonix

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

147
Requests

95 %
HTTPS

48 %
IPv6

22
Domains

31
Subdomains

30
IPs

5
Countries

1861 kB
Transfer

4165 kB
Size

25
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://partners.securonix.com/
Title: Partner Portal Login

Search URL Search Domain Scan URL

URL: https://in.linkedin.com/company/securonix
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/Securonix
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@securonix
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&title=SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia
Title: Teilen

Search URL Search Domain Scan URL

URL: https://socradar.io/apt-profile-kimsuky/
Title: Southeast Asia countries

Search URL Search Domain Scan URL

URL: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-apt37-aka-goldbackdoor-group-active-iocs-3
Title: earlier campaigns

Search URL Search Domain Scan URL

URL: https://3gstudent.github.io/Use-AppDomainManager-to-maintain-persistence
Title: documented technique

Search URL Search Domain Scan URL

URL: https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,false,-7)
Title: Cyberchef recipe

Search URL Search Domain Scan URL

URL: https://securonix.force.com/
Title: Partner Portal Login

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.securonix.com%2Ffooter%2F&title=Footer
Title: Teilen

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js

Request Chain 67

https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 76

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&tm=gtmv2&e_ipv6=AQLkmGAsFjraIwAAAZJsI5_onEQZatxUJWFZX309TE0nyWST73eeYsvwyPLU3bdVGDk-sDBleef2

147 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/ 167 KB
30 KB 331ms
233ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

86957a5978fc6fbbd60b65f11ff158e2f7edb9c42f9350a774c775a03944f42b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8cf6309a4c873a86-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 08 Oct 2024 12:38:46 GMT
link: <https://www.securonix.com/wp-json/>; rel="https://api.w.org/" <https://www.securonix.com/wp-json/wp/v2/blog/31198>; rel="alternate"; title="JSON"; type="application/json" <https://www.securonix.com/?p=31198>; rel=shortlink
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 4
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine

GET
H2 200 jquery.powertip.min.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/ 2 KB
497 B 146ms
143ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fd8f31-70d"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 02 Oct 2024 18:21:37 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce633a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 maps_points.css
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/ 7 KB
2 KB 145ms
143ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.8

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fd8f31-1c2f"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 02 Oct 2024 18:21:37 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce683a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 default.css
www.securonix.com/wp-content/plugins/tablepress/css/build/ 6 KB
2 KB 55ms
53ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.4.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

515c6aeb5bbc4d469db65515d4ddaf33154927aeee13b2637239343c097ccab8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66e49b7b-17fe"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 13 Sep 2024 20:07:23 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce693a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 tablepress-responsive.min.css
www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/ 9 KB
1 KB 103ms
101ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66334865-22aa"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 02 May 2024 08:01:41 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce6b3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 addtoany.min.css
www.securonix.com/wp-content/plugins/add-to-any/ 2 KB
598 B 94ms
92ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66aab13e-644"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 31 Jul 2024 21:48:46 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce6e3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
932 B 84ms
28ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 08 Oct 2024 12:33:48 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 select2.min.css
cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/ 15 KB
2 KB 65ms
39ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/select2.min.css?ver=1.2.64

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5ecc8659-3dcf"
age: 429425
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NdnFZWt6ymno0VJpOwEFjpCs%2FiToUwFwL2XerUFhgofbXGhg2EQpG8Zy1VSqoJfg%2BwiwlxJCXEe83qKvOgAnnGmkhgBMmYsQryqkef1GaLcnJRSuDrskb%2F2y4xgNb2wO%2BwTAZ2dT"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 28 Sep 2025 12:38:46 GMT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 26 May 2020 03:00:41 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cf6309beecf190d-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1676
server: cloudflare

GET
H2 200 single-common.css
www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/ 21 KB
4 KB 51ms
49ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/single-common.css?ver=1.2.64

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f841581ffe22a4cbefabfed9e15456d709300e5697d6f6e2d97141ae48d6cbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fc5dbb-55ef"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Tue, 01 Oct 2024 20:38:19 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce703a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 avia-merged-styles-12e817da6aede8e56cbebfc142e35488---67044e755f19f.css
www.securonix.com/wp-content/uploads/dynamic_avia/ 130 KB
22 KB 57ms
56ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-12e817da6aede8e56cbebfc142e35488---67044e755f19f.css

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e86bab24c18c6130a8a5e924ef4f60a723bc76b9ae6f3884f72122023b97ad9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"67044e75-207d3"
age: 54917
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Mon, 07 Oct 2024 21:11:17 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce723a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 83ms
46ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"b57737a151d7fd411c90e2eb8cdb171e"
age: 21679
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pfnC%2BCGDvDXI3TItENz3BnfZ11nzgzguRKSlSgrHAVylPBz6CaV6E6vYh0YJiLcPFea6uSlgVy8ZLRorpqJR4LnQ8dTq4SjT0kt1OR83PlXij0RCUh8K5Zq9LA6YEOKrCUkIyOEI6ZEKN%2BaYfLXIS3RQ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cf8702be8-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 jquery.min.js Show response
www.securonix.com/wp-includes/js/jquery/ 86 KB
31 KB 49ms
48ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"64ecd5ef-15601"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce733a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 jquery-migrate.min.js Show response
www.securonix.com/wp-includes/js/jquery/ 13 KB
5 KB 67ms
65ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"6482bd64-3509"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce763a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 addtoany.min.js Show response
www.securonix.com/wp-content/plugins/add-to-any/ 129 B
413 B 57ms
54ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66aab13e-81"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
last-modified: Wed, 31 Jul 2024 21:48:46 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfd03a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Securonix-logo.webp
www.securonix.com/wp-content/uploads/2024/04/ 14 KB
14 KB 107ms
106ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo.webp

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-cache-status: HIT
etag: "6633485a-3870"
age: 317028
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/webp
last-modified: Thu, 02 May 2024 08:01:30 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309bce7a3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14448
server: cloudflare

GET d537ffb8-c733-4ebf-9bea-705a9a8f9eb7
https://www.securonix.com/ Frame 0
0

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 26 KB
9 KB 76ms
28ms XHR
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=915442&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&vn=2.1&x=true
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra3 /
Resource Hash: 63f8d5e3b5bacce08a0301d099bc1a269abbb4271d44a757f8683258c46c3cc2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.securonix.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: gfra3

GET
H2 200 image11.png
www.securonix.com/wp-content/uploads/2024/10/ 593 KB
594 KB 105ms
105ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/10/image11.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7eae41610a297f096ce558ac8ef31647ddc6c49741ec64ab82ce29048bd6e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-bgj: imgq:100,h2pri
etag: "66fdaf62-ef82c"
age: 284492
cf-cache-status: HIT
x-content-type-options: nosniff
cf-polished: origFmt=png, origSize=981036
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/webp
content-disposition: inline; filename="image11.webp"
vary: Accept
last-modified: Wed, 02 Oct 2024 20:38:58 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309beea03a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 606968
server: cloudflare

GET
H2 404 image11.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 145ms
145ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image11.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 135
cf-ray: 8cf6309beea13a86-FRA
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image10.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 54ms
51ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image10.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 135
cf-ray: 8cf6309cbfc53a86-FRA
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image12.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 85ms
81ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image12.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309cbfc73a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image4.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 54ms
51ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image4.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 135
cf-ray: 8cf6309cbfd13a86-FRA
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image1.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 116ms
113ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image1.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309cbfd43a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image14.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 131ms
128ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image14.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309cbfd63a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image13.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 146ms
144ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image13.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309cbfd73a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image9.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 144ms
141ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image9.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309ccfd83a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image8.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 95ms
93ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image8.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309ccfda3a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image5.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 132ms
130ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image5.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309ccfdb3a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image7.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 117ms
115ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image7.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 134
cf-ray: 8cf6309ccfdd3a86-FRA
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image2.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 208ms
206ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image2.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309ccfde3a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image3.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 79ms
77ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image3.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-ray: 8cf6309ccfe03a86-FRA
content-encoding: br
cf-cache-status: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 404 image6.png
www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/ 548 B
548 B 48ms
46ms Image
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image6.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
age: 133
cf-ray: 8cf6309ccfe23a86-FRA
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare

GET
H2 200 jquery.powertip.min.js Show response
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/ 11 KB
4 KB 108ms
105ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fd8f31-2ae5"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 02 Oct 2024 18:21:37 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfc83a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 maps_points.js Show response
www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/ 996 B
526 B 102ms
99ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.8

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

63a96f9cfd4742a3c061e96dd849083e4fcc8c62cf5aaf98503a4f2ba34e9a6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fd8f31-3e4"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 02 Oct 2024 18:21:37 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfc93a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 new-tab.js Show response
www.securonix.com/wp-content/plugins/page-links-to/dist/ 34 KB
13 KB 51ms
48ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.7

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66334868-8687"
age: 317344
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 02 May 2024 08:01:44 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfcb3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 smush-lazy-load.min.js Show response
www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 97ms
94ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.16.6

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

807419d5f60f78d0c2d04b0bf5e3f80410fe7ffaa2bfee30646e4c6f47838b4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66da1c3a-2016"
age: 317343
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 05 Sep 2024 21:01:46 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfcc3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 dropdown.js Show response
www.securonix.com/wp-content/plugins/gtranslate/js/ 13 KB
4 KB 104ms
102ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/plugins/gtranslate/js/dropdown.js?ver=6.6.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66fd8f31-326d"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 02 Oct 2024 18:21:37 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309ccfe33a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 avia-footer-scripts-3ed98e389c50a0963e755b4926f8155a---67044e762ef29.js Show response
www.securonix.com/wp-content/uploads/dynamic_avia/ 12 KB
3 KB 58ms
55ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-footer-scripts-3ed98e389c50a0963e755b4926f8155a---67044e762ef29.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0ebb3b6ada96f146ecd30e306c06b52413d015437b658fe57581a50133ad24b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"67044e76-31a1"
age: 54907
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Mon, 07 Oct 2024 21:11:18 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cbfcf3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 worker-79538be5036d68fac35e5fef3196a718br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 263 KB
63 KB 47ms
22ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-79538be5036d68fac35e5fef3196a718br.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2c9b7f672c08e0c4f095e71a3f4108423908117b7aae805a62b890432351d430

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=HS32bA==, md5=RofOEUbpjYGkyHcu08jhQw==
etag: "4687ce1146e98d81a4c8772ed3c8e143"
age: 20247
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 64970
date: Tue, 08 Oct 2024 07:01:19 GMT
last-modified: Mon, 07 Oct 2024 12:59:38 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AHmUCY1OL-JGaq4TE7oBMDYAPGYj7T9yd-4z-8A93uC6PjGj2TuKZBMQ6ZatRlODcDD4RXJuh4Q
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1728305978751757
content-length: 64970
content-language: en
server: UploadServer

GET
H3 200 va_gq-a78e04faa0bb57eb753075fceafbd3fbbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 274 KB
71 KB 50ms
26ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-a78e04faa0bb57eb753075fceafbd3fbbr.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 82f44c4dd8339893ebf2b1676a7771abd54fdfee11deeb2dff2cf83d058cb49a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=RMm9aw==, md5=kFQM7N2O87nzxBxYYvPUYQ==
etag: "90540cecdd8ef3b9f3c41c5862f3d461"
age: 2339
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 72490
date: Tue, 08 Oct 2024 11:59:47 GMT
last-modified: Tue, 08 Oct 2024 11:46:51 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AHmUCY0jXEBQg2-1op8GgBBkkWoCccIZX0Ij2QBuI1weDfwntPcIjjJpHAeX_Guplg0C_UvNkRI
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1728388011134844
content-length: 72490
content-language: en
server: UploadServer

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
146 B 109ms
108ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=915442&d=securonix.com&u=DFB5682516BD35E4E2A8F83F1331224B6&h=306787bde51fa3d55c178ccd9c963060&t=false

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv01c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: public, max-age=43200
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/gif
server: gnv01c

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 337 KB
112 KB 98ms
48ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

43a622512333cc8eae9ab25356b9940de2b1144c6b6b35e77434f5928ae91f3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 08 Oct 2024 12:38:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 113688
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 QGYsz_wNahGAdqQ43Rh_fKDp.woff2
fonts.gstatic.com/s/worksans/v19/ 49 KB
50 KB 54ms
23ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://fonts.googleapis.com/

Response headers

age: 46018
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 07 Oct 2025 23:51:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 23:51:48 GMT
last-modified: Thu, 14 Sep 2023 01:13:52 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50668
x-xss-protection: 0
server: sffe

GET
H2 200 securonix-icons.woff2
www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/ 13 KB
13 KB 62ms
61ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/securonix-icons.woff2?ver=1.2.64

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d137bc7b7127aaf5d686f13af5fefc562b4bf4d92cb4b0365171530fdfa9465c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-cache-status: HIT
etag: "66621328-32b8"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: font/woff2
last-modified: Thu, 06 Jun 2024 19:51:04 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309ce8063a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12984
server: cloudflare

GET
H2 200 fa-fontello.woff2
www.securonix.com/wp-content/themes/punch/assets/fonts/ 5 KB
5 KB 105ms
105ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/punch/assets/fonts/fa-fontello.woff2?ver=1.2.64

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-cache-status: HIT
etag: "66334863-121c"
age: 127727
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: font/woff2
last-modified: Thu, 02 May 2024 08:01:39 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309ce8083a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4636
server: cloudflare

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.png
www.securonix.com/wp-content/uploads/2024/04/ 98 KB
99 KB 107ms
107ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

70d874aaef4d2cdd3b25081afc3a7311d6163d7903467c374cfad24c60b7d8bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-bgj: imgq:100,h2pri
etag: "66ba6e88-24839"
age: 317029
cf-cache-status: HIT
x-content-type-options: nosniff
cf-polished: origFmt=png, origSize=149561
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/webp
content-disposition: inline; filename="Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.webp"
vary: Accept
last-modified: Mon, 12 Aug 2024 20:20:24 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cf8113a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 100686
server: cloudflare

GET
H2 200 image10-1030x1004.png
www.securonix.com/wp-content/uploads/2024/10/ 100 KB
100 KB 90ms
89ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/10/image10-1030x1004.png

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

157400e7ac3ff31a01de0bbbdaaef518197b826c0992e43dfac0e368ad4ac1ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-bgj: imgq:100,h2pri
etag: "66fdaf68-29a96"
age: 284481
cf-cache-status: HIT
x-content-type-options: nosniff
cf-polished: origFmt=png, origSize=170646
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/webp
content-disposition: inline; filename="image10-1030x1004.webp"
vary: Accept
last-modified: Wed, 02 Oct 2024 20:39:04 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309cf8123a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 102284
server: cloudflare

GET 75f5ad9e-73fb-44f6-a765-490d2521e1e0
https://www.securonix.com/ Frame 0
0

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 114ms
114ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=915442&u=DFB5682516BD35E4E2A8F83F1331224B6&s=1728391126&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1728391126596%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1728391126602&v=cfd59ee00

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv01c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/gif
server: gnv01c

GET
H2 200 ecef1e1d-da84-47a8-9b0f-cd1203fb284a.js Show response
j.6sc.co/j/ 5 KB
5 KB 635ms
557ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/ecef1e1d-da84-47a8-9b0f-cd1203fb284a.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 6bf4b704aeaf53e261ae34a4f8c870a375c31bea1cafb2bc016f8cd592d3b565

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-amz-server-side-encryption: AES256
content-type: application/javascript
cache-control: private, max-age=1800
x-amz-version-id: T0WUScV009kIdR1nm2gAPdAo1RR77NlX
etag: "93c8d61fdb478a961fc42ae75ac0df23"
expires: Tue, 08 Oct 2024 13:08:47 GMT
accept-ranges: bytes
content-length: 4761
x-amz-cf-id: MmwGn2ne_aGs8bamWS6tVWXPTMcxjCr3rNvcQdYC_w7M_7AjEp30VA==
date: Tue, 08 Oct 2024 12:38:47 GMT
last-modified: Wed, 07 Aug 2024 17:45:09 GMT
vary: Accept-Encoding
server: AmazonS3
x-amz-cf-pop: FRA60-P8
x-amz-meta-content-type: application/json

GET
H2 200 base.js Show response
embed.formhq.net/v1/ 6 KB
3 KB 124ms
65ms Script
application/javascript 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.formhq.net/v1/base.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"63612f3e-18f1"
age: 1910
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cmnIM4OQ2rhKIvh6Hijob4dwc8OkIigviQ7Fo%2FZ%2BqeMpMPbSPH%2BVs3nUMdkhwou%2FnCVwxifUhSA9R3QAhrYwgIrWTj46cv%2BfjjAb7UMoNndK4rEjCxfQassugxe9Wt34eVIQzp%2B5tjzhSDfDc%2Bec"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=6385
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 01 Nov 2022 14:37:50 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cf6309e6eb48f41-FRA
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 289 KB
99 KB 41ms
40ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c2a0a6de81aab7075ea388814ea7f007f1810ee9f4bfe8275d5b9ccc90a9b007

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 08 Oct 2024 12:38:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101548
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 179ms
105ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

13122b3fd48d530470d735824c63b0b25a895931f5728921f8cc1eb5848fe2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66f5de53-111d7"
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 15:38:46 GMT
accept-ranges: bytes
content-length: 18830
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Thu, 26 Sep 2024 22:21:07 GMT

GET
H2 200 attributor.min.js Show response
cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/ 7 KB
3 KB 78ms
21ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg"
age: 39832
x-content-type-options: nosniff
x-jsd-version-type: branch
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220031-FRA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2823
x-jsd-version: master

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 40ms
40ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6ff473db60a89ae99613ca388444ce80a8e644be627647babd17016874ef8929

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Tue, 08 Oct 2024 12:38:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96050
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 163ms
46ms Script
application/javascript 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 63ECA23E219141B99A75678B2E584C43 Ref B: LON212050706003 Ref C: 2024-10-08T12:38:46Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 132ms
37ms Script
application/javascript 2a02:26f0:3500:10::210:a99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=57411
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Tue, 08 Oct 2024 12:38:46 GMT
last-modified: Thu, 22 Aug 2024 10:43:55 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 88 KB
28 KB 88ms
25ms Script
text/javascript 2600:9000:2644:5600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:5600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0641409d1c3cdd9d398534537a3e3d0e158460b7c1e4238cbcd3f14d401a4896

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

Access-Control-Max-Age: 600
Content-Encoding: gzip
X-Amz-Version-Id: .Fua6NBvbeFgt3YS8TrI.AAUhGMnBc.Y
Etag: W/"134913a92e99352a5bf756fefc528ffc"
Age: 2129
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: V2gAJ46QWhp13keRpahQ2GFuMeGL5_VOVMQbjDUL_yQXW_1r-4NH8Q==
Date: Tue, 08 Oct 2024 12:03:18 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Last-Modified: Mon, 30 Sep 2024 15:57:53 GMT
Access-Control-Allow-Headers: *
Transfer-Encoding: chunked
Cache-Control: max-age=3600, must-revalidate
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@4.2.3/dist/
Redirect Chain

https://unpkg.com/web-vitals/dist/web-vitals.iife.js
https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js

7 KB
3 KB

33ms
32ms

Script
application/javascript

2606:4700::6811:f5cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Server

2606:4700::6811:f5cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e6b3272816c9b6efeb0b3ccc16326c123d9860f38d7c7c4fc215334559996e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: "1c28-4f+2/GWZhXlozjo2GiBA+7VB9Ow"
age: 630199
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01J93972KYYHR48ZP01B52WFV6-fra
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
via: 1.1 fly.io
cf-ray: 8cf6309e985bdc6a-FRA
access-control-allow-origin: *
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, s-maxage=600, max-age=60
location: /web-vitals@4.2.3/dist/web-vitals.iife.js
content-encoding: br
cf-cache-status: HIT
age: 318
x-content-type-options: nosniff
via: 1.1 fly.io
cf-ray: 8cf6309e5f8fdc6a-FRA
access-control-allow-origin: *
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/plain; charset=utf-8
vary: Accept, Accept-Encoding
fly-request-id: 01J9P1XGER1VVE51ZYRBFS26QK-fra
server: cloudflare

GET
H2 200 o4omknd0z9 Show response
www.clarity.ms/tag/ 514 B
770 B 296ms
211ms Script
application/x-javascript 2620:1ec:29:1::64
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/o4omknd0z9?ref=gtm
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f48ceaa67ce25c74a6deec619470c4f9f601e6fc57acca95e6b88cce17203490

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 514
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/x-javascript
x-azure-ref: 20241008T123846Z-1588498f885ftqp6m8vf7mtck400000007n000000000zqtb

GET
H2 200 r32rm8p2zmht.js Show response
js.driftt.com/include/1728391200000/ 221 KB
62 KB 498ms
429ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1728391200000/r32rm8p2zmht.js

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

0d22728098d26a59ba9c4bffb846cab4fd983783c0a2d43826e293141ca8f0cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: gzip
x-amz-version-id: f.LmgCfCKtSyN1EMCfwrK3chF5jy4nsN
etag: W/"e17a2935bc266c4dbc328eb60c6055b3"
access-control-allow-methods: GET, POST, OPTIONS
x-cache: Miss from cloudfront
x-amz-cf-id: 0udzbVShRrAcDvivq_NltzB6X-iv2wNBLyw52FFSWhom0HclXZlOvw==
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Mon, 07 Oct 2024 18:20:57 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 33
access-control-allow-credentials: true
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P6
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 200 body.css
www.securonix.com/wp-content/themes/punch/assets/css/ 6 KB
2 KB 46ms
45ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/punch/assets/css/body.css?v=1.0.94

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"66334863-160c"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 02 May 2024 08:01:39 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309e29703a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 body.css
www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/ 36 KB
7 KB 42ms
41ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.64

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d14415c321f9cb31c8426d1940b14a8f1db8a84f9805feab221c048a8d007663

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"67005023-8ea2"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Fri, 04 Oct 2024 20:29:23 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309e79ca3a86-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 88ms
31ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je4a20v891181397za200&_p=1728391126.816&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=554719792.1728391127&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&sid=1728391126&sct=1&seg=0&dt=SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=817
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.securonix.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
547 B 90ms
28ms Ping
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=554719792.1728391127&gtm=45je4a20v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101671035~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.securonix.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 91ms
55ms Image
image/gif 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=554719792.1728391127&gtm=45je4a20v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101671035~101747727&tag_exp=101671035~101747727&z=2064528784

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 08 Oct 2024 12:38:46 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 loading.svg
www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/svg/ 713 B
807 B 99ms
99ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/svg/loading.svg

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.64

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

861f97da530c1a839539852f52b211b44a6cf9af4ae389bffc0d53920640c2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.64

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"6634030b-2c9"
age: 316932
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 02 May 2024 21:18:03 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309ecf1d693f-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

48ms
24ms

Script
application/javascript

2600:9000:2644:5600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: HTTP/1.1
Server: 2600:9000:2644:5600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

Access-Control-Max-Age: 600
X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 35009
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: jWTXTTjMxXWQ08v7dwGszm2Wshq6a9P6Mxw3cLcI9fRoEbLOBhbX4w==
Date: Tue, 08 Oct 2024 02:55:18 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Access-Control-Allow-Headers: *
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 0
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

Redirect headers

Access-Control-Max-Age: 600
Age: 25007
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ut-O8fzeaHBQNpdqRqoGzJz4jcpvrs8ylzF5GslEEO6-By8PvdW-yA==
Date: Tue, 08 Oct 2024 05:41:58 GMT
Content-Type: application/xml
Access-Control-Allow-Headers: *
Location: https://s.adroll.com/j/pre/index.js
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
Content-Length: 0
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/ 9 KB
4 KB 41ms
23ms Script
text/javascript 2600:9000:2644:5600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:5600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

Access-Control-Max-Age: 600
Content-Encoding: gzip
X-Amz-Version-Id: CQfjU8GJo6PgFkdF_r6HlrkE7XEk23wR
Etag: W/"706be4fd28aeb971d2ff83a528c2073a"
Age: 2493
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5VCgqLpnI5_RtFUfDogRguIZby8EgqLV5S4N72zOZLVJxzg50Mslrw==
Date: Tue, 08 Oct 2024 12:00:47 GMT
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Last-Modified: Sun, 06 Oct 2024 11:41:20 GMT
Access-Control-Allow-Headers: *
Transfer-Encoding: chunked
Cache-Control: max-age=3600, must-revalidate
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame 0BDA 0
0 76ms
53ms Document
text/html 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 6938
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8cf6309eff695c56-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 12:38:46 GMT
last-modified: Tue, 08 Oct 2024 10:43:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kRH7IlB4V2xXpiCAEifQ0BENKfh%2BTLrBM5aTXDESnxcR4DFoQy9uRExGaJlTyadCzqwckd7i%2BwkoKcYQg1BEsdhULCN0Ux%2Bhhf%2B%2F8L6El8f4WEZq2iydbNZ4wkgLyphmYsnbNozsdoVPbDJ3wyGrY56f"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.D0Uc7kY6.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 72ms
48ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"6fea96ea56ee4fff557b8776f9c8c3a6"
age: 25009
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D5fUkSfB%2BMqrCtkPBJ8jXItr6HNqmAwmV2kncH6ZN5Mn9%2FBBHG3VbZmth8e1m%2Fcm42Hj%2F%2Fr%2F8tsMb29XcWo7PzQg5%2Be2ldfwtGdNPBK3cC%2BFkhIz%2FSXTUabl4M3JvhvL8fe2bEzzxaZhtvnFwOpYsZvc"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=315360000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309efd02382c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 wp-emoji-release.min.js Show response
www.securonix.com/wp-includes/js/ 18 KB
5 KB 91ms
91ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"667d6e6f-4926"
age: 317343
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 27 Jun 2024 13:51:43 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309eef42693f-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 nc-955bf9be6d5d7736c267f5115f164034br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 17 KB
5 KB 22ms
22ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-955bf9be6d5d7736c267f5115f164034br.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 868d9d5aeab0b24deb9c5c65cbfeccd5b8d9ac3080a738a1200b686335b960e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=sw0qgA==, md5=3lM7gre+IEDFYHFDcbPEug==
etag: "de533b82b7be2040c560714371b3c4ba"
age: 2339
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5570
date: Tue, 08 Oct 2024 11:59:47 GMT
last-modified: Tue, 08 Oct 2024 11:47:38 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AHmUCY2mN27Sm6P1-dUWTel4IQ-bE325KBfWVLPnjM5Tbj_IETJygHdSgTiYpElnoEqYkLTntxkHZWoWkA
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1728388058068063
content-length: 5570
content-language: en
server: UploadServer

GET
H2 200 bWFya2V0bw.js Show response
embed.formhq.net/v1/platforms/ 422 B
578 B 35ms
35ms Script
application/javascript 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.formhq.net/v1/platforms/bWFya2V0bw.js

Requested by

Host: embed.formhq.net
URL: https://embed.formhq.net/v1/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"62e92e06-1a7"
age: 6461
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CM5JY%2Fnx3zr2EyxxhYxISfhjT5b5KI9WoDQt12oRUHdegluE%2BNefCh24p0iX%2FyeF1%2BYwdEOHs4f6GXW6RJCU9okYxvmxXUqqouWOtkPIulnP0hewZHWxHB6ddrU3RpKEBUY%2FweN4ZCzcm7ZjHTkw"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=423
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Aug 2022 14:00:38 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cf6309eff848f41-FRA
x-xss-protection: 1; mode=block
server: cloudflare

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
701 B 182ms
121ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 44891CF84E364629A2895DC0C42DC631 Ref B: FRAEDGE1305 Ref C: 2024-10-08T12:38:46Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYj9msoI8JUQllDuw2Riw==
x-li-proto: http/2
access-control-allow-origin: https://www.securonix.com
x-cache: CONFIG_NOCACHE
date: Tue, 08 Oct 2024 12:38:46 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
814 B 186ms
129ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.securonix.com/

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 000623f66b2824e442b55d94e4d95b16
x-msedge-ref: Ref A: 941BC2D63F844A5AAB1128948D15997B Ref B: FRAEDGE1607 Ref C: 2024-10-08T12:38:46Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYj9msoJORCtV2U5NlbFg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southea...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southe...

0
482 B

186ms
124ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&tm=gtmv2&e_ipv6=AQLkmGAsFjraIwAAAZJsI5_onEQZatxUJWFZX309TE0nyWST73eeYsvwyPLU3bdVGDk-sDBleef2
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 8690135A498C4BC9B050CF7F64081E99 Ref B: DUS30EDGE0719 Ref C: 2024-10-08T12:38:47Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYj9msr0uGZzyMHTT3m+g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1728391126870&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&tm=gtmv2&e_ipv6=AQLkmGAsFjraIwAAAZJsI5_onEQZatxUJWFZX309TE0nyWST73eeYsvwyPLU3bdVGDk-sDBleef2
x-msedge-ref: Ref A: 35EFCFB17F44491C81B09F94B2BEC95D Ref B: FRAEDGE1305 Ref C: 2024-10-08T12:38:46Z
x-li-fabric: prod-lva1
x-li-uuid: AAYj9msoTstBtsPc6Nnknw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Tue, 08 Oct 2024 12:38:46 GMT

GET
H2 200 27010718.js Show response
bat.bing.com/p/action/ 370 B
421 B 47ms
47ms Script
application/javascript 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/27010718.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C6C2637B627D4117A2B317A18D3E3DC0 Ref B: LON212050706003 Ref C: 2024-10-08T12:38:46Z
x-cache: CONFIG_NOCACHE
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 268ms
253ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.securonix.com
content-length: 7
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 23 B
317 B 118ms
43ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 72cc2f91b041e44fac52826f0b0d3036d31741d4cfc73c0f0e7def705671b078

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:1b60:2:240:3247::5
expires: Tue, 08 Oct 2024 12:38:47 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1728391126966_34603374_856704211_25_4890_20_40_219";dur=1
access-control-allow-origin: https://www.securonix.com
content-length: 23
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 302ms
286ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&v=1.1.28

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 268ms
252ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&v=1.1.28

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 204 0
bat.bing.com/action/ 0
287 B 48ms
48ms Image
text/plain 2620:1ec:33:3::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=f126d8e7-49c4-4b24-b544-be62a0c71ac4&sid=430bf0b0857211efa5f20732ff58ebce&vid=430be9d0857211ef83d6f77c6b003271&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&r=&lt=847&evt=pageLoad&sv=1&cdb=AQoV&rn=509526

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:3::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 67289E6CB17E46F19C87F3C6B5972501 Ref B: LON212050706003 Ref C: 2024-10-08T12:38:46Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Tue, 08 Oct 2024 12:38:46 GMT

GET
H2 200 VJKZ2AZ6BRDQFPNHOW6CAP Show response
d.adroll.com/consent/check/ 527 B
620 B 138ms
44ms Script
application/javascript 2a05:d018:cc3:fe04:1b3:4333:51ee:414b
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?flg=1&pv=42210684353.5778&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&_s=152d81e9141767604d144e5e49fe087b&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d018:cc3:fe04:1b3:4333:51ee:414b Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: 7d7d99951f8f7406b052b39989959cbbdbb07e6cef4c9c76a6db5f22962f2581

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-length: 527
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/javascript
server: nginx/1.22.1

GET
H3 200 de.js Show response
static.addtoany.com/menu/locale/ 750 B
990 B 63ms
62ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/locale/de.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"86610d84a116a5704d658324728b063f"
age: 21579
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2FuhPW%2F4XqraMCaJzXqHyjsgcpGGWzD918D1JoZNzz7cyduA%2BLqcAxNcoP79dB%2FKrmu6eL0PC%2FcfBa1T26L3YkNHoXOZJSEs6TwQdvntmnymEGWlY%2FdSw448pUo2Jt9MHClDCOLz"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=902
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=86400, stale-while-revalidate=30, public
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309f7c282be8-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 linkedin.js Show response
static.addtoany.com/menu/svg/icons/ 435 B
822 B 41ms
41ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/linkedin.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"00b1b78053ab07c79bfea2e5a1db9d70"
age: 25009
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8UKdRzGUFqHKBCorxWSSlyIGJ2sZJZaBtiskkCyZ6vLsaCkT%2BN4KM6jmPalLAiTfFUe63tlAlRfzBav983ua2X5jEUD0R%2FQQHDZq7t44jiAnoaArr52ERNbzb%2BHjEuodaj30q4W"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=7776000, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309f7da6382c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 x.js Show response
static.addtoany.com/menu/svg/icons/ 297 B
737 B 36ms
36ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/x.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

122ed4db2019348aef89a605e3eb79c6004f5727f16144dc46b61f31ee131764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"7cdbf2d5d94ad6e7bf6e7cc1418dd608"
age: 25009
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QHLoPckJxRmQXb72DNTVuLIcM1wmAX1QlAUUI8%2BhxXayLEH%2F9UrKLCMVs94TONcnaC8WfN0CmLDCys9LsFCH7C4Fix9ofAy2gJkAwUpLLJ%2FwOSXLwZO0Vl2UiobbxwONK9d8IjpJ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=864000, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309f7daa382c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 a2a.js Show response
static.addtoany.com/menu/svg/icons/ 182 B
662 B 41ms
40ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/a2a.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"0aca4ea1e5f8f250126a8e0c597dd969"
age: 25009
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xgmeDj9HVPHWh1PsViLnR%2FrjR%2Bhlasyy9Af85Sq9j7vg%2FJMueDs6sL%2F4UUyj09xi%2Fc7No4%2B77uBqLjnYNWKLaxBFg82wSIgWSGE%2BtK5WVZqbyNyHspsjTzK5etgQTrQx6aht9Q18"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=7776000, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309f7dad382c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 email.js Show response
static.addtoany.com/menu/svg/icons/ 415 B
802 B 38ms
38ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/email.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.securonix.com
Referer: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"eb2119ad4221a9d01abc336e06962867"
age: 25009
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6aDZ82X%2BGw7TJHAyzOoGW2s1jyKq77iAwTCkzyWN%2BjEq0PE3EGb0Q0NcM3SRiZ8VHXjjPHw7YLpUL%2B1CSofOG%2B3iyAhXtavQPB%2FU5cDSmViIjKMbf%2FyM6nlXgFOH1RzrGwd866xh"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:46 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=7776000, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf6309f7db1382c-FRA
access-control-allow-origin: *
server: cloudflare

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.47/ 64 KB
27 KB 44ms
44ms Script
application/javascript 2620:1ec:29:1::64
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.47/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/o4omknd0z9?ref=gtm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 30adbc7e799238c336b56a1e20db67910f2a114fc3bc6ced6c550b4c873318aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-azure-ref: 20241008T123847Z-1588498f885ftqp6m8vf7mtck400000007n000000000zquk
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DCE6D934B3DB75"
x-fd-int-roxy-purgeid: 51562430
x-ms-request-id: bd9fef3a-c01e-002b-69ea-18ae17000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Mon, 07 Oct 2024 14:06:14 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 265ms
265ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 674 B
598 B 96ms
46ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 67d0d2c79b749f5fcaea29f5668143425fd73f0f153896b3fce7158dcc36de15

Request headers

Authorization: Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6
X-6s-CustomID: WebTag1.0 05b12115ad17914938bf7667643ca0d3
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.securonix.com
content-length: 337
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 78ms
23ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.securonix.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Tue, 08 Oct 2024 12:38:47 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 418 KB
85 KB 25ms
25ms Script
text/javascript 2600:9000:2644:5600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:5600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dc8d80275b5424166b5d382894515535e167388cfbad6ae3008b18ea0f1e172c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

Access-Control-Max-Age: 600
Content-Encoding: gzip
X-Amz-Version-Id: 8ETCE8t9zap6ixXqEEaKFHCQITOmoal5
Etag: W/"4fa0fae27db5bad9bb2635e3a23d52e1"
Age: 249
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: AxiSdJ0hYulhUfK6h_1WZpua1EFyB3P9IpmRCcJqUhYD9DyRlqNgIw==
Date: Tue, 08 Oct 2024 12:34:39 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Last-Modified: Mon, 30 Sep 2024 16:15:47 GMT
Access-Control-Allow-Headers: *
Transfer-Encoding: chunked
Cache-Control: max-age=300, must-revalidate
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

GET
H/1.1 200
OK nextroll-32x32.png
s.adroll.com/i/favicon/ 2 KB
2 KB 24ms
23ms Image
image/png 2600:9000:2644:5600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2644:5600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

Access-Control-Max-Age: 600
X-Amz-Version-Id: eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Etag: "403a0a7dcf2d617e7ea852bfb9d11945"
Age: 37557
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: UYWwLE3ehJ-OP2fqmnQzp93QBq8lIpuUZ1f9eE9awG_AzRp_JVT9zg==
Date: Tue, 08 Oct 2024 05:22:16 GMT
Content-Type: image/png
Vary: Accept-Encoding
Last-Modified: Mon, 28 Jun 2021 18:19:21 GMT
Access-Control-Allow-Headers: *
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 1615
X-Amz-Cf-Pop: FRA60-P6
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

POST
H/1.1 204
No Content collect Show response
t.clarity.ms/ 0
281 B 594ms
355ms XHR
text/plain 20.114.189.70
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://t.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.70 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.securonix.com/

Response headers

Request-Context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
Access-Control-Allow-Origin: https://www.securonix.com
Date: Tue, 08 Oct 2024 12:38:47 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 172ms
118ms Preflight
application/json 13.35.58.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-58.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Tue, 08 Oct 2024 12:38:47 GMT
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
x-amz-apigw-id: fVMpsGZhIAMEmrA=
x-amz-cf-id: v0RFuvyM6KwYqvAlO3ilRcJTeCkvoz_LWsxmbBiRSxi1LpwCdTrIDg==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: b272d3b2-2787-444f-aee1-4de61072c289
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
520 B 186ms
184ms XHR
application/json 13.35.58.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-58.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.securonix.com/

Response headers

x-amz-apigw-id: fVMptEm2IAMEIKg=
x-amzn-trace-id: Root=1-670527d7-22f742e91e5c02b91ee808d5;Parent=30cac85cb1f516e7;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: edb75585-a540-49bd-afda-310cbd448f7f
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: F0yBvJr0sDGCH4n3E7EF-NFv6xp9rMGZmw5jPQH-nhyq26y96EDsSw==
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 167ms
167ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1049.5%2C%22duration%22%3A177.30000019073486%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1049.5%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1226.8000001907349%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=&d=1&v=1.1.28

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 54ms
52ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.securonix.com
content-length: 7
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 147ms
145ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 266ms
264ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 149ms
148ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 147ms
146ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 150ms
149ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 140ms
140ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 165ms
163ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 138ms
136ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 200ms
200ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 142ms
142ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 183ms
183ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 149ms
149ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 136ms
136ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 83ms
29ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.securonix.com
content-length: 7
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 23 B
318 B 50ms
49ms XHR
text/html 2a02:26f0:7100::210:172
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 72cc2f91b041e44fac52826f0b0d3036d31741d4cfc73c0f0e7def705671b078

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:1b60:2:240:3247::5
expires: Tue, 08 Oct 2024 12:38:47 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1728391127388_34603374_856704796_1745_982_25_0_219";dur=1
access-control-allow-origin: https://www.securonix.com
content-length: 23
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: text/html
vary: Origin

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 674 B
597 B 54ms
54ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 67d0d2c79b749f5fcaea29f5668143425fd73f0f153896b3fce7158dcc36de15

Request headers

Authorization: Token ed71c2ff74493da228496ca2b3f1e44ce78a83d7
X-6s-CustomID: WebTag ecef1e1d-da84-47a8-9b0f-cd1203fb284a
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.securonix.com
content-length: 337
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/json
vary: Origin, Accept-Encoding

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
520 B 185ms
183ms XHR
application/json 13.35.58.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-58.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.securonix.com/

Response headers

x-amz-apigw-id: fVMpvGfMoAMEf8w=
x-amzn-trace-id: Root=1-670527d7-6e3306572f27769b16a385f7;Parent=54cc49d02770b966;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 3443668f-57af-4bda-a9ae-a496291f762f
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: 5rV7BHId5o46gl72aiLjA4vhu8PMyPBz8DI03odF4faK_xvvLWz2EQ==
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 138ms
138ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1502.5999994277954%2C%22duration%22%3A56.70000076293945%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1502.5999994277954%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1559.3000001907349%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=&d=1&v=1.1.28

Requested by

Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:47 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 core
js.driftt.com/ Frame F320 0
0 176ms
133ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=3077e9db-3d0b-4d78-bfcc-30434296fe0a&sessionStarted=1728391127.793&campaignRefreshToken=8a74181b-2846-4303-97ca-2690ed384126&hideController=false&pageLoadStartTime=1728391126353&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728391200000/r32rm8p2zmht.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 12:38:47 GMT
etag: W/"96c1787e195b872b861f8367c9cde0ec"
last-modified: Mon, 07 Oct 2024 18:20:39 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
x-amz-cf-id: wFIk2nGBQE9LLin1nEGWkQwsn5s69HupA4_RvOQNE9dS28Rm2uf2jQ==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: zK1mDGGoTmjUEADtOIuruAZL52uxDquQ
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 22

GET
H2 200 chat
js.driftt.com/core/ Frame 26C1 0
0 172ms
131ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1728391126353

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728391200000/r32rm8p2zmht.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.securonix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 12:38:47 GMT
etag: W/"96c1787e195b872b861f8367c9cde0ec"
last-modified: Mon, 07 Oct 2024 18:20:39 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
x-amz-cf-id: hoONXEWQQTeU3aZzM5maHqRTuVPYuRKIaBGia0K3ygTr97GrEaHAxQ==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: zK1mDGGoTmjUEADtOIuruAZL52uxDquQ
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 21

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 9 KB
3 KB 86ms
47ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-version-id: PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag: W/"b2877da906a3216c4f3fc4030b205e54"
age: 42550
via: 1.1 c9499008aa7e1acd11e9fbc171281d82.cloudfront.net (CloudFront)
cf-ray: 8cf630a5496f35e1-FRA
x-cache: Hit from cloudfront
x-amz-cf-id: HMYSVrHcJLhEPfDkPlqrJcoS3clQAvplOips6LKG0bNNOw_7LfaO3A==
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/javascript
last-modified: Thu, 18 Jul 2024 08:13:46 GMT
vary: Accept-Encoding
x-amz-cf-pop: FRA56-P4

GET
H3 200 Securonix-logo-alt.webp
www.securonix.com/wp-content/uploads/2024/04/ 14 KB
14 KB 57ms
57ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo-alt.webp

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-cache-status: HIT
etag: "6633485a-382a"
age: 317030
x-content-type-options: nosniff
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: image/webp
last-modified: Thu, 02 May 2024 08:01:30 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf630a53d83693f-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14378
server: cloudflare

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/dcdn/ 15 KB
5 KB 30ms
30ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=915442&settings_type=4
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra3 /
Resource Hash: 2a2266a9266f380e28971747077a314eab711e5d24a4e737cd02d31b632a404c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cdn_cache_status: miss
cache-control: public, max-age=900, s-maxage=900
content-encoding: gzip
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:47 GMT
content-type: application/javascript; charset=UTF-8
server: gfra3

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 134ms
134ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A46%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:48 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:48 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
564 B 332ms
332ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a47a89165d661cddef84b555c6e8da6650d3d335726ff039115023c7e8ccce06

Request headers

Authorization: Bearer 3e8e82dad11669757953
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
visited_url: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"cb-rG72eeFFIIb1s4vaJx5D9d4q7oE"
via: 1.1 34fdfb7c7c11559df7e622af2b62f5ca.cloudfront.net (CloudFront)
cf-ray: 8cf630a71cb56933-FRA
apigw-requestid: fVMp1gKyvHcESIA=
access-control-allow-origin: https://www.securonix.com
x-cache: Miss from cloudfront
x-amz-cf-id: fWWs2Ml824kJ-w4L0FuhC2-iTIKHyoqRQUPxYZ4Nuxf-S07KKCVidQ==
date: Tue, 08 Oct 2024 12:38:48 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Origin
x-amz-cf-pop: FRA56-P4

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 243ms
219ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods: POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin: https://www.securonix.com
apigw-requestid: fVMpziq7PHcES2w=
cf-cache-status: DYNAMIC
cf-ray: 8cf630a5bb6e6933-FRA
date: Tue, 08 Oct 2024 12:38:48 GMT
server: cloudflare
vary: Origin
via: 1.1 34fdfb7c7c11559df7e622af2b62f5ca.cloudfront.net (CloudFront)
x-amz-cf-id: _lp7IkVbdu806mwdPqshAzS_wknfpy46QAjoculP3lZbB1pnUzFPnQ==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H3 200 cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png
www.securonix.com/wp-content/uploads/2021/12/ 676 B
1 KB 97ms
96ms Other
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Response headers

cf-bgj: imgq:100,h2pri
etag: "6633485f-344"
age: 239496
cf-cache-status: HIT
x-content-type-options: nosniff
cf-polished: origFmt=png, origSize=836
date: Tue, 08 Oct 2024 12:38:48 GMT
content-type: image/webp
content-disposition: inline; filename="cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.webp"
vary: Accept
last-modified: Thu, 02 May 2024 08:01:35 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=31536000
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cf630a75f84693f-FRA
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 676
server: cloudflare

POST
H/1.1 204
No Content collect Show response
t.clarity.ms/ 0
281 B 126ms
124ms XHR
text/plain 20.114.189.70
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://t.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.70 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.securonix.com/

Response headers

Request-Context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
Access-Control-Allow-Origin: https://www.securonix.com
Date: Tue, 08 Oct 2024 12:38:48 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/ Frame 0
0 212ms
175ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.securonix.com
allow: GET,HEAD
cf-cache-status: DYNAMIC
cf-ray: 8cf630a97e0bdcb5-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 12:38:48 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 90 KB
27 KB 126ms
88ms Script
application/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA==
cf-cache-status: DYNAMIC
etag: W/"006455bd44ed289ddcc403d0ecd96ab0"
age: 1947
content-encoding: gzip
x-goog-stored-content-encoding: identity
expires: Tue, 08 Oct 2024 13:06:21 GMT
x-goog-stored-content-length: 91778
date: Tue, 08 Oct 2024 12:38:48 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 10:14:37 GMT
x-guploader-uploadid: AHmUCY1UPz6FqGkJcmZH8aOUlyzbyCakMJNImnAMAvOLqqIw-lljy29tgAFUeQXI07Pt3ZepVoM
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
cf-ray: 8cf630a978851c7f-FRA
x-goog-generation: 1715854477710382
server: cloudflare

GET
H3 200 / Show response
ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/ 3 KB
2 KB 264ms
263ms Fetch
text/javascript 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

88f762b8876acc311c578a7b784e05428ad1b41c1882840824ebde2ddbde3e02

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

_zitok: 42e0b31e2688a2c188671728391128
_vtok: MjE3LjExNC4yMTguMjU=
visited-url: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Referer: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/javascript

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8cf630aa8a0f1c7f-FRA
access-control-allow-origin: https://www.securonix.com
alt-svc: h3=":443"; ma=86400
date: Tue, 08 Oct 2024 12:38:48 GMT
content-type: text/javascript
vary: Accept-Encoding
x-powered-by: Express
server: cloudflare
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 170ms
169ms Preflight
text/html 104.16.117.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.securonix.com
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 8cf630aa28eedcb5-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 12:38:48 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 320 B
597 B 193ms
192ms Fetch
application/json 104.16.118.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Authorization: bearer f0ddbd6ba8265551bbe95c25bdf2a9
Referer: https://www.securonix.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-robots-tag: noindex, nofollow
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"140-/3+OW/4aU4/AnqAmyrwCzrd9buM"
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 8cf630ab3ae41c7f-FRA
access-control-allow-origin: https://www.securonix.com
date: Tue, 08 Oct 2024 12:38:49 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-powered-by: Express
server: cloudflare
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 122ms
122ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A47%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:49 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:49 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
BLOB 200
OK 4401f07c-32a7-4a6e-8840-1a5c37a73c06 Show response
https://www.securonix.com/ 3 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.securonix.com/4401f07c-32a7-4a6e-8840-1a5c37a73c06
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88f762b8876acc311c578a7b784e05428ad1b41c1882840824ebde2ddbde3e02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/javascript
Content-Length: 3033

POST
H3 200 u
dev.visualwebsiteoptimizer.com/events/t/ 0
36 B 110ms
109ms Ping
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/events/t/u?en=chat_playbook_fired&a=915442&v=cfd59ee00&_cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-
Requested by: Host: www.securonix.com
URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv01c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.securonix.com/

Response headers

content-encoding: gzip
access-control-allow-methods: GET, POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:49 GMT
content-type: application/javascript; charset=UTF-8
server: gnv01c
access-control-allow-headers: X-Device-User-Agent, Vwo-X-Forwarded-For

GET
H2 200 3.ee35dea2.chunk.js Show response
js.driftt.com/conductor/assets/ 158 B
850 B 22ms
22ms Script
application/javascript 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1728391200000/r32rm8p2zmht.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

x-amz-version-id: rYV3Tk3yEytdzde9thJ_AN9ul6xSrvB.
etag: "e6714addd36102488fb27a980401fd36"
age: 1859085
access-control-allow-methods: GET, POST, OPTIONS
x-cache: Hit from cloudfront
x-amz-cf-id: 6ow9ZL3Jce9oUJkAAD7IrD75z7ewU8_vefu5ot1fauOyo5Nne6OQtg==
date: Tue, 17 Sep 2024 00:14:04 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 10 Sep 2024 14:51:22 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=31536000
x-envoy-upstream-service-time: 13
access-control-allow-credentials: true
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 158
x-amz-cf-pop: FRA60-P6
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 206 notification.5f7c6014.mp3
js.driftt.com/conductor/assets/media/ 8 KB
8 KB 23ms
22ms Media
audio/mpeg 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.securonix.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: AJ3ftWhvW2h954Q3Lc0BJKBcX87AS953
etag: "5f7c6014cf73831f91963a668b71fbb9"
age: 6787680
access-control-allow-methods: GET, POST, OPTIONS
x-cache: Hit from cloudfront
x-amz-cf-id: _zRGeIVgk88edmwbghcBC8gDut7aHSRQtMe8Bw17F4zHdarIfuq_Lg==
date: Mon, 23 Sep 2024 18:12:32 GMT
content-type: audio/mpeg
last-modified: Mon, 18 Sep 2023 19:58:12 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=31536000
x-envoy-upstream-service-time: 16
access-control-allow-credentials: true
Content-Range: bytes 0-7754/7755
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 7755
x-amz-cf-pop: FRA60-P6
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 122ms
122ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:50 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:50 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 118ms
118ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A49%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:51 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:51 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H/1.1 204
No Content collect Show response
t.clarity.ms/ 0
281 B 116ms
115ms XHR
text/plain 20.114.189.70
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://t.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.47/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.114.189.70 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.securonix.com/

Response headers

Request-Context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
Access-Control-Allow-Origin: https://www.securonix.com
Date: Tue, 08 Oct 2024 12:38:51 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 122ms
122ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A50%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:52 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:52 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 34ms
32ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je4a20v891181397za200&_p=1728391126.816&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tcfd=10001&tag_exp=101671035~101747727&cid=554719792.1728391127&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&sid=1728391126&sct=1&seg=0&dt=SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix&_s=2&tfd=6231
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.securonix.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.securonix.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 12:38:52 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 120ms
120ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1502.5999994277954%2C%22duration%22%3A56.70000076293945%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1502.5999994277954%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1559.3000001907349%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=&d=1&v=1.1.28

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.securonix.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 12:38:52 GMT
accept-ranges: bytes
content-length: 43
date: Tue, 08 Oct 2024 12:38:52 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 186ms
184ms XHR
application/json 13.35.58.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-58.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.securonix.com/

Response headers

x-amz-apigw-id: fVMqiFo5IAMEOjw=
x-amzn-trace-id: Root=1-670527dc-1186ae0f24e3209666c4c022;Parent=47a4097f7741bcbb;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 72fea9df-f236-4b19-9c52-941d50c789f8
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: fdRimMSICCWlI-tDjny57bHMueVRXt8AmpduA93iHElz0_Sk85fStw==
date: Tue, 08 Oct 2024 12:38:52 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 118ms
118ms Preflight
application/json 13.35.58.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-58.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.securonix.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Tue, 08 Oct 2024 12:38:52 GMT
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
x-amz-apigw-id: fVMqhEP-oAMEgbw=
x-amz-cf-id: FxgR-bNJ5ydxaakqIVVVMCPRwM4IP0efuEqFtH-EATe28nWug8iVOA==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: e6f0f419-81b9-4746-be6e-7174ce51533a
x-cache: Miss from cloudfront

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.securonix.com
URL: blob:https://www.securonix.com/d537ffb8-c733-4ebf-9bea-705a9a8f9eb7

Domain: www.securonix.com
URL: blob:https://www.securonix.com/75f5ad9e-73fb-44f6-a765-490d2521e1e0

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=360a7c9c-8aeb-40ff-8962-bda794c66433&session=9ccd9e18-7b5e-468c-81da-e83176cce398&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Oct%202024%2012%3A38%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Explore%20Securonix%27s%20insights%20on%20CLOUD%23REVERSER%2C%20using%20Google%20Drive%20and%20Dropbox%20in%20sophisticated%20malware%20attacks%20and%20data%20theft.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22SHROUDED%23SLEEP%3A%20A%20Deep%20Dive%20into%20North%20Korea%E2%80%99s%20Ongoing%20Campaign%20Against%20Southeast%20Asia%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fshroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia%2F&pageViewId=957a3141-aafd-4301-8415-8c95da3fb908&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3A1b60%3A2%3A240%3A3247%3A%3A5&v=1.1.28

Verdicts & Comments Add Verdict or Comment

151 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.securonix.com/	1970-01-21 08:53:33	Name: _vwo_uuid_v2 Value: DFB5682516BD35E4E2A8F83F1331224B6\|306787bde51fa3d55c178ccd9c963060
.securonix.com/	1970-01-21 08:52:28	Name: _vwo_uuid Value: DFB5682516BD35E4E2A8F83F1331224B6
.securonix.com/	1970-01-21 00:49:43	Name: _vwo_ds Value: 3%241728391126%3A56.56203943%3A%3A
.securonix.com/	1970-01-21 00:06:32	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.securonix.com/	1970-01-21 02:30:31	Name: _vis_opt_s Value: 1%7C
.securonix.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.securonix.com/	1970-01-21 02:16:07	Name: _gcl_au Value: 1.1.430087774.1728391127
.securonix.com/	1970-01-21 09:42:31	Name: _ga Value: GA1.1.554719792.1728391127
.securonix.com/	1970-01-21 09:42:31	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
.securonix.com/	1970-01-21 00:06:32	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20set)%22%2C%22content%22%3A%22(not%20set)%22%2C%22source_platform%22%3A%22(not%20set)%22%2C%22marketing_tactic%22%3A%22(not%20set)%22%2C%22creative_format%22%3A%22(not%20set)%22%2C%22adgroup%22%3A%22(not%20set)%22%2C%22id%22%3A%22(not%20set)%22%7D
www.securonix.com/	1970-01-21 09:42:31	Name: _gd_visitor Value: 360a7c9c-8aeb-40ff-8962-bda794c66433
www.securonix.com/	1970-01-21 00:06:45	Name: _gd_session Value: 9ccd9e18-7b5e-468c-81da-e83176cce398
.securonix.com/	1970-01-21 00:07:57	Name: _uetsid Value: 430bf0b0857211efa5f20732ff58ebce
.securonix.com/	1970-01-21 09:28:07	Name: _uetvid Value: 430be9d0857211ef83d6f77c6b003271
.bing.com/	1970-01-21 09:28:07	Name: MUID Value: 1D2687C13523625502E592D3345A634B
.linkedin.com/	1970-01-21 08:52:07	Name: bcookie Value: "v=2&c5874bbf-8e42-4d9c-8047-99b1a6aca63b"
.linkedin.com/	1970-01-21 04:25:43	Name: li_gc Value: MTswOzE3MjgzOTExMjY7MjswMjEHN/J9SirTEzXu8p5ZUHg6ROZ2MAMJD9uhLXgIsKNXFA==
.linkedin.com/	1970-01-21 00:07:57	Name: lidc Value: "b=VGST07:s=V:r=V:a=V:p=V:g=3076:u=1:x=1:i=1728391127:t=1728477527:v=2:sig=AQGSSXJss55qmSqEnOWsGY96XN4j-dfE"
www.securonix.com/	1970-01-21 00:06:32	Name: drift_campaign_refresh Value: 8a74181b-2846-4303-97ca-2690ed384126
www.securonix.com/	1970-01-21 09:42:31	Name: drift_aid Value: 69ddef17-d67d-4fba-8343-1f07c91b6a53
www.securonix.com/	1970-01-21 09:42:31	Name: driftt_aid Value: 69ddef17-d67d-4fba-8343-1f07c91b6a53
.www.securonix.com/	1970-01-21 08:52:07	Name: _zitok Value: 42e0b31e2688a2c188671728391128
.zoominfo.com/	1970-01-21 00:06:32	Name: __cf_bm Value: 8X1NwVfBHiMdO3tlNHLeyAbfVLVp6jDiOPohPYtHEDI-1728391128-1.0.1.1-QcwpNmWmuV2sKflwKPBS6j3ClrgvRlfn.3u4k19Om.dkcWS6RuUt3Ayfg7U6g8a3QAeufqbWr2fWe_LkbGkKPA
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: dPHyD3HdO9XpIeWh4WHPGHXSyIc1xbqhqWhOM33mLxY-1728391128614-0.0.1.1-604800000
.securonix.com/	1970-01-21 09:42:31	Name: _ga_JPYDLXGD3Q Value: GS1.1.1728391126.1.0.1728391131.55.0.0

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image11.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image6.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image10.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image4.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image3.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image12.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image8.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image1.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image7.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image14.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image5.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image9.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image13.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/images/image2.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
bat.bing.com
c.6sc.co
cdn.jsdelivr.net
cdnjs.cloudflare.com
d.adroll.com
dev.visualwebsiteoptimizer.com
embed.formhq.net
eps.6sc.co
fonts.googleapis.com
fonts.gstatic.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
t.clarity.ms
unpkg.com
v.eps.6sc.co
ws-assets.zoominfo.com
ws.zoominfo.com
www.clarity.ms
www.google.de
www.googletagmanager.com
www.securonix.com
b.6sc.co
www.securonix.com
104.16.117.43
104.16.118.43
104.17.25.14
13.107.42.14
13.35.58.58
141.193.213.20
142.250.185.163
172.64.150.44
172.67.39.148
18.245.86.77
2.17.100.184
20.114.189.70
2001:4860:4802:34::36
216.58.206.67
2600:9000:2644:5600:6:9280:1080:93a1
2606:4700:3108::ac42:2bc5
2606:4700::6811:f5cb
2620:1ec:21::14
2620:1ec:29:1::64
2620:1ec:33:3::10
2a00:1450:4001:80b::200a
2a00:1450:4001:811::2008
2a00:1450:400c:c00::9d
2a02:26f0:3500:10::210:a99
2a02:26f0:7100::210:172
2a04:4e42:600::485
2a05:d018:cc3:fe04:1b3:4333:51ee:414b
34.96.102.137
75.2.108.141
0641409d1c3cdd9d398534537a3e3d0e158460b7c1e4238cbcd3f14d401a4896
09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a
0d22728098d26a59ba9c4bffb846cab4fd983783c0a2d43826e293141ca8f0cb
0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e
122ed4db2019348aef89a605e3eb79c6004f5727f16144dc46b61f31ee131764
13122b3fd48d530470d735824c63b0b25a895931f5728921f8cc1eb5848fe2ba
157400e7ac3ff31a01de0bbbdaaef518197b826c0992e43dfac0e368ad4ac1ee
195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b
27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db
2a2266a9266f380e28971747077a314eab711e5d24a4e737cd02d31b632a404c
2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4
2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423
2c9b7f672c08e0c4f095e71a3f4108423908117b7aae805a62b890432351d430
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
30adbc7e799238c336b56a1e20db67910f2a114fc3bc6ced6c550b4c873318aa
3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43
3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9
435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008
43a622512333cc8eae9ab25356b9940de2b1144c6b6b35e77434f5928ae91f3c
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
515c6aeb5bbc4d469db65515d4ddaf33154927aeee13b2637239343c097ccab8
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e
63a96f9cfd4742a3c061e96dd849083e4fcc8c62cf5aaf98503a4f2ba34e9a6c
63f8d5e3b5bacce08a0301d099bc1a269abbb4271d44a757f8683258c46c3cc2
67d0d2c79b749f5fcaea29f5668143425fd73f0f153896b3fce7158dcc36de15
6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438
6bf4b704aeaf53e261ae34a4f8c870a375c31bea1cafb2bc016f8cd592d3b565
6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9
6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1
6ff473db60a89ae99613ca388444ce80a8e644be627647babd17016874ef8929
70d874aaef4d2cdd3b25081afc3a7311d6163d7903467c374cfad24c60b7d8bd
72cc2f91b041e44fac52826f0b0d3036d31741d4cfc73c0f0e7def705671b078
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
7d7d99951f8f7406b052b39989959cbbdbb07e6cef4c9c76a6db5f22962f2581
807419d5f60f78d0c2d04b0bf5e3f80410fe7ffaa2bfee30646e4c6f47838b4f
80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8
814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1
82f44c4dd8339893ebf2b1676a7771abd54fdfee11deeb2dff2cf83d058cb49a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
861f97da530c1a839539852f52b211b44a6cf9af4ae389bffc0d53920640c2fc
868d9d5aeab0b24deb9c5c65cbfeccd5b8d9ac3080a738a1200b686335b960e9
86957a5978fc6fbbd60b65f11ff158e2f7edb9c42f9350a774c775a03944f42b
8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4
88f762b8876acc311c578a7b784e05428ad1b41c1882840824ebde2ddbde3e02
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8e6b3272816c9b6efeb0b3ccc16326c123d9860f38d7c7c4fc215334559996e2
907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49
9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f
9f841581ffe22a4cbefabfed9e15456d709300e5697d6f6e2d97141ae48d6cbb
a47a89165d661cddef84b555c6e8da6650d3d335726ff039115023c7e8ccce06
a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899
a791796f72eea3c5febcbe84acc17e5e8e434e71036ea481b168dc4f41f12a9c
b0ebb3b6ada96f146ecd30e306c06b52413d015437b658fe57581a50133ad24b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
c2a0a6de81aab7075ea388814ea7f007f1810ee9f4bfe8275d5b9ccc90a9b007
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727
d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382
d137bc7b7127aaf5d686f13af5fefc562b4bf4d92cb4b0365171530fdfa9465c
d14415c321f9cb31c8426d1940b14a8f1db8a84f9805feab221c048a8d007663
d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b
d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557
d7eae41610a297f096ce558ac8ef31647ddc6c49741ec64ab82ce29048bd6e1c
dc8d80275b5424166b5d382894515535e167388cfbad6ae3008b18ea0f1e172c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
e86bab24c18c6130a8a5e924ef4f60a723bc76b9ae6f3884f72122023b97ad9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f48ceaa67ce25c74a6deec619470c4f9f601e6fc57acca95e6b88cce17203490
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.securonix.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

147 Requests

95 %HTTPS

48 %IPv6

22 Domains

31 Subdomains

30 IPs

5 Countries

1861 kBTransfer

4165 kBSize

25 Cookies

12 Outgoing links

Redirected requests

147 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.securonix.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

147
Requests

95 %
HTTPS

48 %
IPv6

22
Domains

31
Subdomains

30
IPs

5
Countries

1861 kB
Transfer

4165 kB
Size

25
Cookies

147 HTTP transactions
1 data transactions