www.securonix.com Open in urlscan Pro
141.193.213.20  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41

• https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
• https://unpkg.com/web-vitals@4.2.2/dist/web-vitals.iife.js

Request Chain 47

• https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
• https://s.adroll.com/j/pre/index.js

Request Chain 54

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&tm=gtmv2&e_ipv6=AQK7hx6Be4R7PQAAAZEo-JEOo9Unk54-KqPVTgpvvoG3_GlIjLAhJ2kGnacz2G2W_2Nsn30

95 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/	130 KB 22 KB	465ms 328ms	Document text/html	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / WP Engine Resource Hash dc0f6bb6870515088e8a0f3a6ace1c9bfec6fcc720e23bf57334636ba70066d7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control max-age=600, must-revalidate cf-cache-status DYNAMIC cf-ray 8af11eda1b586a74-TXL content-encoding br content-type text/html; charset=UTF-8 date Tue, 06 Aug 2024 18:34:21 GMT link <https://www.securonix.com/wp-json/>; rel="https://api.w.org/" <https://www.securonix.com/wp-json/wp/v2/blog/26629>; rel="alternate"; type="application/json" <https://www.securonix.com/?p=26629>; rel=shortlink permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() referrer-policy strict-origin-when-cross-origin server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 3 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options SAMEORIGIN x-powered-by WP Engine
GET H2	200	jquery.powertip.min.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	2 KB 463 B	169ms 161ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-70d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3eec6a74-TXL
GET H2	200	maps_points.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	7 KB 2 KB	132ms 127ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 395559 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-1c2f" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3eef6a74-TXL
GET H2	200	default.css www.securonix.com/wp-content/plugins/tablepress/css/build/	6 KB 2 KB	166ms 162ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.3.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5565a2f6d9c7da0b5dd7fc0dc0b441d5d115d87aa1634dc231114cfeecb9d63c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 Jul 2024 20:14:10 GMT server cloudflare etag W/"66903d12-17c7" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3ef16a74-TXL
GET H2	200	tablepress-responsive.min.css www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/	9 KB 1 KB	166ms 163ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:41 GMT server cloudflare etag W/"66334865-22aa" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3ef26a74-TXL
GET H2	200	addtoany.min.css www.securonix.com/wp-content/plugins/add-to-any/	2 KB 600 B	166ms 162ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:49 GMT server cloudflare etag W/"6633486d-644" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3ef46a74-TXL
GET H2	200	css2 fonts.googleapis.com/	2 KB 932 B	1253ms 48ms	Stylesheet text/css	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 06 Aug 2024 18:34:22 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 06 Aug 2024 18:34:22 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 06 Aug 2024 18:34:22 GMT
GET H3	200	select2.min.css cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/	15 KB 2 KB	361ms 193ms	Stylesheet text/css	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/select2.min.css?ver=1.2.50 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 339297 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1676 last-modified Tue, 26 May 2020 03:00:41 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5ecc8659-3dcf" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wXQ%2FndnOaQAxWRUZhp%2BggzcNpbvpwBaPIm9jf6qMM6OTDeYjCx5C2P6fqeH8RLiLT5Eb4iuSH%2BW27CEebsxNunrfteCHTjmIoiFVrzYOSFEB9tHDHTZFEhU7NJ5IP%2Fa%2BX6ywAug4"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8af11edd5bf58ef5-FRA expires Sun, 27 Jul 2025 18:34:21 GMT
GET H2	200	single-common.css www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/	19 KB 3 KB	132ms 129ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/single-common.css?ver=1.2.50 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash f8107f58762c431ca94eecb64ddf1921a8c92b7a6296a3c76fab7681965dd22b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 816756 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 Jul 2024 18:35:30 GMT server cloudflare etag W/"66a14972-4de2" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3ef86a74-TXL
GET H2	200	avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66ab3c03b34ff.css www.securonix.com/wp-content/uploads/dynamic_avia/	129 KB 22 KB	132ms 130ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66ab3c03b34ff.css Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5be2e55fd9d5b73a65817ca0e87c09e25a0cfe103e0b7b929bc93749f291e21f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 464246 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 01 Aug 2024 07:40:51 GMT server cloudflare etag W/"66ab3c03-205df" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3efa6a74-TXL
GET H3	200	page.js Show response static.addtoany.com/menu/	3 KB 2 KB	321ms 221ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/page.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f06bf06915359224831501cef5d0c410b2dccf80d1b6082b776f6147e18ee524 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 11410 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"3b1eac2bad1254b5d88c9f99d5f79d65" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F9AlXrf8dcbfXv8j2AIpecde0j3aE9zkSlhEDVRBLdemK%2B7voc59xTljffrtUd1CU8sdIeOq6HM%2FHdJsEGPPAbVEc5Lsqo%2BqAEn0dcMJWozAp8eGMIK8TllId%2FTDcnpfXRNKmmTbLW%2FZ2CHLKRLHUAUk"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=86400, stale-while-revalidate=30, public cf-ray 8af11edfa99e2c3a-FRA
GET H2	200	jquery.min.js Show response www.securonix.com/wp-includes/js/jquery/	86 KB 31 KB	164ms 161ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Aug 2023 17:14:23 GMT server cloudflare etag W/"64ecd5ef-15601" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3efc6a74-TXL
GET H2	200	jquery-migrate.min.js Show response www.securonix.com/wp-includes/js/jquery/	13 KB 5 KB	113ms 111ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 09 Jun 2023 05:49:24 GMT server cloudflare etag W/"6482bd64-3509" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edc3efd6a74-TXL
GET H3	200	addtoany.min.js Show response www.securonix.com/wp-content/plugins/add-to-any/	129 B 474 B	78ms 75ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122329 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:49 GMT server cloudflare etag W/"6633486d-81" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee108d6451c-TXL
GET H2	200	Securonix-logo.webp www.securonix.com/wp-content/uploads/2024/04/	14 KB 14 KB	62ms 60ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo.webp Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 1122327 alt-svc h3=":443"; ma=86400 content-length 14448 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:30 GMT server cloudflare etag "6633485a-3870" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11edc3f016a74-TXL
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	7 KB 3 KB	181ms 56ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=915442&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&vn=2.1&x=true Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra2 / Resource Hash 95782a56110e342eaf5afe97c40710f2d1ae8b68138cd66990dea0aca95f4689 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT content-encoding gzip via 1.1 google server gfra2 etag W/"1722946950_EA" vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin https://www.securonix.com cache-control public, max-age=0, no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H3	200	jquery.powertip.min.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	11 KB 4 KB	78ms 64ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 395558 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-2ae5" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edd9935451c-TXL
GET H3	200	maps_points.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	628 B 735 B	56ms 53ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 0230904fa157dff50d8ecc1a80a203635fa812479f4432a69c3779986ab560e6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122327 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-274" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11edd9937451c-TXL
GET H3	200	new-tab.js Show response www.securonix.com/wp-content/plugins/page-links-to/dist/	34 KB 13 KB	74ms 73ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.7 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1084078 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-8687" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ede0a2f451c-TXL
GET H3	200	smush-lazy-load.min.js Show response www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/	8 KB 4 KB	53ms 53ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.16.5 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5bdcc9e3e427ad3a787ec7efe46d8c305e880eb44402c0000ff52f17ef6b0cdb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122327 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 11 Jul 2024 20:13:14 GMT server cloudflare etag W/"66903cda-2018" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ede0a33451c-TXL
GET H3	200	dropdown.js Show response www.securonix.com/wp-content/plugins/gtranslate/js/	13 KB 5 KB	95ms 94ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/gtranslate/js/dropdown.js?ver=6.5.5 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-326d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee19a14451c-TXL
GET H3	200	avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---66ab3c047d8c0.js Show response www.securonix.com/wp-content/uploads/dynamic_avia/	12 KB 3 KB	58ms 57ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---66ab3c047d8c0.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5ebb2ce2e9e5c77cc2c4081b2d88c1f10d471b0f9b440e672465d276f507273a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 464245 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 01 Aug 2024 07:40:52 GMT server cloudflare etag W/"66ab3c04-31a1" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ede6ada451c-TXL
GET BLOB	200 OK	115b0b38-4daf-4a7c-9e80-2f4bf43576ae https://www.securonix.com/	1 KB 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.securonix.com/115b0b38-4daf-4a7c-9e80-2f4bf43576ae Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Length 1185 Content-Type text/javascript
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 146 B	135ms 130ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=915442&d=securonix.com&u=D005CD4660F7D68EB432E6A5FE499F83B&h=b4a83998fa802bf2aaf4611ad6f2df63&t=false Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:21 GMT via 1.1 google x-content-type-options nosniff server gnv01c content-type image/gif access-control-allow-origin * cache-control public, max-age=43200 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35
GET H2	200	gtm.js Show response www.googletagmanager.com/	323 KB 107 KB	179ms 79ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8770cde0f855924e8089b731fb4a1e96100796dc6260677388bfa2842f008692 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 109626 x-xss-protection 0 last-modified Tue, 06 Aug 2024 18:02:24 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 06 Aug 2024 18:34:22 GMT
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	QGYsz_wNahGAdqQ43Rh_fKDp.woff2 fonts.gstatic.com/s/worksans/v19/	49 KB 50 KB	198ms 60ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 12:07:37 GMT x-content-type-options nosniff age 23206 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 50668 x-xss-protection 0 last-modified Thu, 14 Sep 2023 01:13:52 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Aug 2025 12:07:37 GMT
GET H3	200	Dev-Gradient-Bottom-Top-Purple-Lines.png www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/png/	120 KB 120 KB	62ms 61ms	Image image/png	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/png/Dev-Gradient-Bottom-Top-Purple-Lines.png Requested by Host: www.securonix.com URL: https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66ab3c03b34ff.css Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 55a87f3988c2d2dc254d7fcf23779d87635baace698dda2ff0c1472a37a04599 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66ab3c03b34ff.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 816756 cf-polished origSize=632173, status=webp_bigger alt-svc h3=":443"; ma=86400 content-length 122642 referrer-policy strict-origin-when-cross-origin cf-bgj imgq:100,h2pri last-modified Thu, 02 May 2024 21:18:03 GMT server cloudflare etag "6634030b-9a56d" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ee45830451c-TXL
GET H3	200	securonix-icons.woff2 www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/	13 KB 13 KB	79ms 75ms	Font font/woff2	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/securonix-icons.woff2?ver=1.2.50 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d137bc7b7127aaf5d686f13af5fefc562b4bf4d92cb4b0365171530fdfa9465c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 384450 alt-svc h3=":443"; ma=86400 content-length 12984 referrer-policy strict-origin-when-cross-origin last-modified Thu, 06 Jun 2024 19:51:04 GMT server cloudflare etag "66621328-32b8" vary Accept-Encoding x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ee519cd451c-TXL
GET H3	200	fa-fontello.woff2 www.securonix.com/wp-content/themes/punch/assets/fonts/	5 KB 5 KB	56ms 52ms	Font font/woff2	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/punch/assets/fonts/fa-fontello.woff2?ver=1.2.50 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 384450 alt-svc h3=":443"; ma=86400 content-length 4636 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:39 GMT server cloudflare etag "66334863-121c" vary Accept-Encoding x-frame-options SAMEORIGIN content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ee519d0451c-TXL
GET H3	200	Securonix-logo-alt.webp www.securonix.com/wp-content/uploads/2024/04/	14 KB 14 KB	65ms 63ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo-alt.webp Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 395557 alt-svc h3=":443"; ma=86400 content-length 14378 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:30 GMT server cloudflare etag "6633485a-382a" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ee509c9451c-TXL
GET H3	200	dropdown.js Show response www.securonix.com/wp-content/plugins/gtranslate/js/	13 KB 0	7ms 7ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/gtranslate/js/dropdown.js?ver=6.5.5 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 1122328 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:44 GMT server cloudflare etag W/"66334868-326d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee19a14451c-TXL
GET H3	200	body.css www.securonix.com/wp-content/themes/punch/assets/css/	6 KB 2 KB	67ms 62ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/punch/assets/css/body.css?v=1.0.94 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 395557 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:39 GMT server cloudflare etag W/"66334863-160c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee529fa451c-TXL
GET H3	200	body.css www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/	32 KB 7 KB	69ms 65ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.50 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e4d4aa00eca8bea1cbb6f9dc600b84e677389f9704c2d0533d4abd3d74f13dca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 816757 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 24 Jul 2024 18:35:30 GMT server cloudflare etag W/"66a14972-80fe" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee59aee451c-TXL
GET H2	200	base.js Show response embed.formhq.net/v1/	6 KB 3 KB	281ms 66ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/base.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3981 cf-polished origSize=6385 x-xss-protection 1; mode=block cf-bgj minify last-modified Tue, 01 Nov 2022 14:37:50 GMT server cloudflare etag W/"63612f3e-18f1" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8OPh9qgkHjruBOYstC6XsYl6HwNilKWzalMx89ucLM3AzA8y%2FVz0FPf0N6Tan4tCicfwIXK1b%2FpHQOtb1fLNMBzDU7K%2B2F6sA%2FGhmFQsk1r7J8XaKIwk%2Fw8m%2BTLd5jMXsyLftgAOrV7xSUAjR58W"}],"group":"cf-nel","max_age":604800} cache-control max-age=1800 cf-ray 8af11ee8890a2c5b-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	283 KB 97 KB	59ms 58ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ba01fd70317aa91e7929f787633313f8b022c1f7d64a0c1614767259fb61c783 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 99429 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 06 Aug 2024 18:34:23 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 18 KB	241ms 63ms	Script application/javascript	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 4dba9e54570483a0624219ec53864f468c9cbdf4f9c1f23821e539de7cb0c9fc Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 12 Jul 2024 19:23:12 GMT server nginx/1.14.0 (Ubuntu) etag "669182a0-10e5e" vary Accept-Encoding content-type application/javascript cache-control private, proxy-revalidate, max-age=10800 accept-ranges bytes content-length 18671 expires Tue, 06 Aug 2024 21:34:23 GMT
GET H2	200	attributor.min.js Show response cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/	7 KB 4 KB	258ms 80ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 33793 x-jsd-version master x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 2823 x-served-by cache-fra-etou8220072-FRA, cache-lga21964-LGA x-jsd-version-type branch server cloudflare etag W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lZtJ0vBWORkPhjImZ9X9lZ4qrZnts4ElRnIcYhYvBkA9ESRmEgTs%2F4Hx9Hjl%2FBktmaL2WWiaJ%2Bh%2FOViB6kx9gxKrRaoPbX5N2WrwAjygWPqXfQEvsNwS5e5RQo0iF4NkZYvq%2FXB2MB5ntRFdLGw%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 accept-ranges bytes timing-allow-origin * cf-ray 8af11ee86abc5b26-FRA
GET H2	200	destination Show response www.googletagmanager.com/gtag/	264 KB 91 KB	59ms 58ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7b4fbd6d30dd7d33811e8902e29632ad10e970792dd5d901ce2fa6f28001ff0d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 93088 x-xss-protection 0 last-modified Tue, 06 Aug 2024 18:02:24 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 06 Aug 2024 18:34:23 GMT
GET H2	200	bat.js Show response bat.bing.com/	49 KB 14 KB	291ms 87ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 06 Aug 2024 18:34:22 GMT last-modified Sat, 13 Jul 2024 20:42:16 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: CD7F2B859ABE4BDCBF6685C306047F85 Ref B: FRA31EDGE0511 Ref C: 2024-08-06T18:34:23Z etag "044982565d5da1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 14183
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	244ms 42ms	Script application/javascript	2a02:26f0:3500:10::210:a9a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jul 2024 05:33:09 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=21089 accept-ranges bytes content-length 14597
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	88 KB 28 KB	234ms 69ms	Script text/javascript	2600:9000:2644:b000:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:b000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 02b5db103f24a7395fa2623b371ea764e2948337147de780911dc2fcdec49458 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id fsiDuzy5vys3wCM7hYlFnR.TBXHQSKgT Content-Encoding gzip Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Date Tue, 06 Aug 2024 18:14:54 GMT Age 1170 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Thu, 04 Jul 2024 15:21:58 GMT Server AmazonS3 Etag W/"c3ca7e6129306d41ac549ab4c252c99b" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id ayyLGg2qI2PfFiE_4DVbBRYbmeYERHj6wWoOpjG_KYQqIbXxhvkgXA==
GET H2	200	web-vitals.iife.js Show response unpkg.com/web-vitals@4.2.2/dist/ Redirect Chain https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://unpkg.com/web-vitals@4.2.2/dist/web-vitals.iife.js	7 KB 3 KB	67ms 63ms	Script application/javascript	2606:4700::6811:f6cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/web-vitals@4.2.2/dist/web-vitals.iife.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Server 2606:4700::6811:f6cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e6b3272816c9b6efeb0b3ccc16326c123d9860f38d7c7c4fc215334559996e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br via 1.1 fly.io cf-cache-status HIT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 1728869 last-modified Sat, 26 Oct 1985 08:15:00 GMT fly-request-id 01J30YR64S738N00GM2VN9722J-fra server cloudflare etag "1c28-4f+2/GWZhXlozjo2GiBA+7VB9Ow" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 8af11ee93cce3671-FRA Redirect headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br via 1.1 fly.io cf-cache-status HIT fly-request-id 01J4MFCY5SH276KSV3XTA5MKBY-fra x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 136 server cloudflare vary Accept, Accept-Encoding content-type text/plain; charset=utf-8 access-control-allow-origin * location /web-vitals@4.2.2/dist/web-vitals.iife.js cache-control public, s-maxage=600, max-age=60 cf-ray 8af11ee86b813671-FRA
GET H2	200	r32rm8p2zmht.js Show response js.driftt.com/include/1722969300000/	221 KB 62 KB	369ms 176ms	Script application/javascript	18.245.86.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1722969300000/r32rm8p2zmht.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-77.fra60.r.cloudfront.net Software istio-envoy / Resource Hash 889da033525190aa887d2361d6cb460c50e9b128e017c33f4499063aeaa73632 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT x-amz-version-id y3tne.Y80za7KusdtSa.ECjRnvsUlRYa content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 cbd5498107be7e5bcccda272c5fdbef4.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront x-envoy-upstream-service-time 40 last-modified Wed, 24 Jul 2024 21:19:18 GMT server istio-envoy etag W/"a69573aefab19654390c860151e62853" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id BA2Wy9qKxWVY8W_DfIYinC8ddkeR-BEzi3r8GNTu50Edj4pTxdp4Yg==
GET H3	200	DEVPOPPER_FCA.webp www.securonix.com/wp-content/uploads/2024/04/	17 KB 18 KB	145ms 144ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/DEVPOPPER_FCA.webp Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 60a55a38f12eced2b8c143fcba4eecfe97768a8aa562106242f7c7bcde540919 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT alt-svc h3=":443"; ma=86400 content-length 17668 referrer-policy strict-origin-when-cross-origin last-modified Thu, 02 May 2024 08:01:29 GMT server cloudflare etag "66334859-4504" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ee79edc451c-TXL
GET H3	200	sm.25.html static.addtoany.com/menu/ Frame C585	0 0	146ms 57ms	Document text/html	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/sm.25.html Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-origin * age 8310 alt-svc h3=":443"; ma=86400 cache-control max-age=315360000, immutable cf-cache-status HIT cf-ray 8af11ee91ba68ec5-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 06 Aug 2024 18:34:23 GMT last-modified Tue, 06 Aug 2024 16:15:53 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G0aMSVRGExVMG1NmxSebIzaDxqXreGO6JUYwna7udqWmKNNpukp8bIVxGB0e%2FxhJMIDpgRSzqY%2BfmwHfSX5i7bJ05tDC2%2By5%2BU2fYjtOpDt%2BAK7hc0dLbaqMMtwBQFTqlxaI9i5c"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff
GET H3	200	core.D0Uc7kY6.js Show response static.addtoany.com/menu/modules/	70 KB 26 KB	152ms 103ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"6fea96ea56ee4fff557b8776f9c8c3a6" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VSTGcCBRdOCfZ4a1ELbo0dp7sCrRmJW7aK7jzR99E2otoHd3%2FVgfnv5PEwBk%2BpSa8GG7r9uaxXfvzxMGv85KJr7uUioNsPwN%2FGlmFqyArawdPhsLhEKCch2YbXyOCU5TCagtHdA"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, immutable cf-ray 8af11ee8bffc19ab-FRA
GET H3	200	wp-emoji-release.min.js Show response www.securonix.com/wp-includes/js/	18 KB 5 KB	86ms 85ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.5.5 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT content-encoding br age 816756 alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 13 Feb 2024 14:36:07 GMT server cloudflare etag W/"65cb7e57-4926" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() cf-ray 8af11ee8891f451c-TXL
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/ Redirect Chain https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js https://s.adroll.com/j/pre/index.js	0 756 B	42ms 42ms	Script application/javascript	2600:9000:2644:b000:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/index.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol HTTP/1.1 Server 2600:9000:2644:b000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy Date Tue, 06 Aug 2024 06:38:04 GMT Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Age 42980 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Last-Modified Wed, 15 Jan 2020 23:54:18 GMT Server AmazonS3 Etag "d41d8cd98f00b204e9800998ecf8427e" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id fAU7pZBVNYG6OPNoLos_iutmjnzXq8K4UinBsKG9oqsY63hbNLW1tA== Redirect headers Date Tue, 06 Aug 2024 11:30:20 GMT Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Age 25442 X-Amz-Cf-Pop FRA60-P6 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/pre/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id r7e0srsrpRoskR2ob2ECtPYOwN7O0CGioLObHMWfX3wMMYoIeDuiNw==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/	9 KB 4 KB	89ms 41ms	Script text/javascript	2600:9000:2644:b000:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:b000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id OtNyFJS.1ZhPJUfNm_ZXBySSv_VBAek_ Content-Encoding gzip Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Date Tue, 06 Aug 2024 17:57:39 GMT Age 2205 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Mon, 29 Jul 2024 12:21:35 GMT Server AmazonS3 Etag W/"706be4fd28aeb971d2ff83a528c2073a" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id xE7QA3qzC1OwlYLWYqJ5XtI4x-hmlpMVJXLgwdO0gqpodrvEp2WcxQ==
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 440 B	932ms 246ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept * Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 06 Aug 2024 18:34:24 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 17AD2331D6384D60B27B26089ACF38A0 Ref B: DUS30EDGE0410 Ref C: 2024-08-06T18:34:24Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.securonix.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYfCAr2h9KFGudwow7lRg==
POST H2	204	collect region1.analytics.google.com/g/	0 0	630ms 46ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je47v0v891181397za200&_p=1722969263.695&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250753&cid=883817809.1722969264&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&sid=1722969263&sct=1&seg=0&dt=Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2745 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 256 B	627ms 48ms	Ping text/plain	2a00:1450:400c:c04::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=883817809.1722969264&gtm=45je47v0v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=95250753 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	570ms 75ms	Image image/gif	142.250.186.163 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=883817809.1722969264&gtm=45je47v0v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=95250753&tag_exp=95250753&z=338866711 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.163 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1 KB	1098ms 576ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers Accept * Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"1","priority":"0"}],"filters":[{"c":["177720376"]},{"c":["164948506"]},{"c":["127114126"]},{"c":["177720376"]},{"c":["175293946"]}],"debug_key":"142169"} content-encoding gzip date Tue, 06 Aug 2024 18:34:24 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 1F94F84983D844B9A17A33A12867B02C Ref B: DUS30EDGE0910 Ref C: 2024-08-06T18:34:24Z access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 x-li-proto http/2 x-restli-protocol-version 1.0.0 access-control-allow-headers * x-li-uuid AAYfCAr2M5DUxvarJsN7qw== x-fs-uuid 00061f080af63390d4c6f6ab26c37bab
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-like... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-lik...	0 267 B	370ms 196ms	Image application/javascript	2620:1ec:50::12 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&tm=gtmv2&e_ipv6=AQK7hx6Be4R7PQAAAZEo-JEOo9Unk54-KqPVTgpvvoG3_GlIjLAhJ2kGnacz2G2W_2Nsn30 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Server 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: DDEF8D9CD7C446CDB883096D504BCDB7 Ref B: FRA231050414019 Ref C: 2024-08-06T18:34:24Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYfCAr7/3r0n31dqaq2Mw== Redirect headers date Tue, 06 Aug 2024 18:34:24 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 2B89C7FFC76D40F5866BF497098990E5 Ref B: DUS30EDGE0410 Ref C: 2024-08-06T18:34:24Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1722969263738&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&tm=gtmv2&e_ipv6=AQK7hx6Be4R7PQAAAZEo-JEOo9Unk54-KqPVTgpvvoG3_GlIjLAhJ2kGnacz2G2W_2Nsn30 x-li-proto http/2 content-length 0 x-li-uuid AAYfCAr2hkq+r1HP4h8BNg==
GET H2	200	bWFya2V0bw.js Show response embed.formhq.net/v1/platforms/	422 B 571 B	190ms 173ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/platforms/bWFya2V0bw.js Requested by Host: embed.formhq.net URL: https://embed.formhq.net/v1/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1992 cf-polished origSize=423 x-xss-protection 1; mode=block cf-bgj minify last-modified Tue, 02 Aug 2022 14:00:38 GMT server cloudflare etag W/"62e92e06-1a7" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y6oME93pvin7cZ%2FmdtdB5HodA6tN4vvYhe1JNt%2BvzqQft6FXNTVhE1q31LBkKLW8trSm0IPhatP9HQd6xGHTRjwSgpQY7SmtewAUY8mGUCGigucFuMiZJdZ5zHoaXwweymTkQpojN9OnxHQEkDHl"}],"group":"cf-nel","max_age":604800} cache-control max-age=1800 cf-ray 8af11eeaec052c5b-FRA
GET H2	200	VJKZ2AZ6BRDQFPNHOW6CAP Show response d.adroll.com/consent/check/	563 B 656 B	574ms 58ms	Script application/javascript	2a05:d018:cc3:fe05:631e:1560:b06d:b3c3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?pv=15673058651.360928&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&_s=14a3e48268cc64eb155e788890511204&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe05:631e:1560:b06d:b3c3 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash d73fa3f415535ce6d56cfa5c6d7e1517b7340abcaf04e935962a70667aa62a5a Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT server nginx/1.22.1 content-length 563 content-type application/javascript
GET H2	200	/ Show response c.6sc.co/	7 B 195 B	96ms 45ms	XHR text/html	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.securonix.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 311 B	401ms 41ms	XHR text/html	2a02:26f0:480:22::1726:62ee AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:22::1726:62ee Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 2ad83efd3b3987100da97f634d1cf0f23ba332b8ecb510a2af3883d224272216 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT vary Origin content-type text/html access-control-allow-origin https://www.securonix.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::4 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722969264128_389993774_100207135_30_1280_39_188_219";dur=1 content-length 19 expires Tue, 06 Aug 2024 18:34:24 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	187ms 149ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&v=1.1.22 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:24 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	186ms 149ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&v=1.1.22 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:24 GMT
GET H2	200	27010718.js Show response bat.bing.com/p/action/	335 B 411 B	99ms 65ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/27010718.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e6eae0251ff9d9602e618bd779c3c7234b243fb71da5afa4e502443e9c007bd4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br date Tue, 06 Aug 2024 18:34:23 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 8FD17046A7D548ED9F06608226D75F0D Ref B: FRA31EDGE0511 Ref C: 2024-08-06T18:34:23Z vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript; charset=utf-8 cache-control private,max-age=1800
GET H3	200	de.js Show response static.addtoany.com/menu/locale/	750 B 1016 B	59ms 58ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/locale/de.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3908 cf-polished origSize=902 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"86610d84a116a5704d658324728b063f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UNnZgXGjznLBmCIH66Zbr1czDJVJh2lhyhqalk86eJcTA7cnPcmG8z%2B4c33lhjrTgmV2JUZz5v1V36zX28b0h%2FRWT%2FSWdb2IJQ0Tn1A2NpVGD2XhsvvvXcJ9k8AlelqPOukFCYk37tqi9py%2Fnux8gxtr"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=86400, stale-while-revalidate=30, public cf-ray 8af11eec6c582c3a-FRA
GET H3	200	linkedin.js Show response static.addtoany.com/menu/svg/icons/	435 B 832 B	102ms 101ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/linkedin.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"00b1b78053ab07c79bfea2e5a1db9d70" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UwNSa%2BlVpQDuD42TOjTLFFjL%2BJ%2F%2F%2FXqniZmLK12B%2Bf87cN8lG87y%2BOsSzi2kVLeC6eDSsD2LADg%2FUmSeWRlVbIf%2BWr9wkeEocggITKtyjAjnn6zZtO3xT8dch4pNVZXMDawMIMcN"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 8af11eec7e9719ab-FRA
GET H3	200	twitter.js Show response static.addtoany.com/menu/svg/icons/	645 B 919 B	102ms 101ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/twitter.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3003867b66a32c12fdafeefc27cf06d906e5a99ba275550ab757f4bb04834636 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"af2b829f9b79fabec7c0148a8b7e444b" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9%2Bld315Nc1KSc66NasoN7iJLslNFG6c%2B94Cwto3641wBVriaFRywH3%2BmU39tHktuGTIlKroXIsiuZpCn9nUXvdPTjXL4K%2BCe9LjENLSdrpHi0yF7UN7FCKbQkIQJIlNr9NIf6Zd"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 8af11eec7e9c19ab-FRA
GET H3	200	facebook.js Show response static.addtoany.com/menu/svg/icons/	429 B 838 B	84ms 83ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/facebook.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b475960843a5619b907af1f0a89e3136bd5e6a4a700ec78cb417f302647cf49 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"68925fa8e347041c6006837e73c518bc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4cRoXkuXmqInPPmMnqBrvgsClj0mprPV1SplJS72K7iSf%2B8IwoGQFgPJczLQlqdZTLXKVMQb82Ill6M%2BngtmFVd%2FXiY%2F329JeptfRKFFttVe3PoBNCiOmo2i1LlvNaYOYEu9PQLtkvwmGQv9lKPBD7VI"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 8af11eec7ea119ab-FRA
GET H3	200	a2a.js Show response static.addtoany.com/menu/svg/icons/	182 B 696 B	100ms 100ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/a2a.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"0aca4ea1e5f8f250126a8e0c597dd969" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2FXfEms240Yzd%2F%2F8%2B3sUOIDfEFcFFPfYWtGgh7GSUUJSyZfujH8pMfz0ipw8%2BOnbyNKzlbyo9PvQjNk6IkXOyVYOUozrEN2tqCaPAZGTY%2BKl6pQME72A6Jol3oXrPx3uGm%2BlDWVG3LE9HbUiPQWxElVb"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 8af11eec7ea219ab-FRA
GET H3	200	email.js Show response static.addtoany.com/menu/svg/icons/	415 B 834 B	68ms 67ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/email.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Origin https://www.securonix.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:24 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 2367 content-encoding br alt-svc h3=":443"; ma=86400 referrer-policy strict-origin-when-cross-origin cf-bgj minify server cloudflare etag W/"eb2119ad4221a9d01abc336e06962867" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2Bhh34Mz2Eqf4iRmCVKM1ewMl%2BtHLdAn2%2Fq6ESv2%2BvHcEgwpYmm6VbXeZOLvF%2FhhJzjrhsTsxGYVmBC4gqCi6n2Dv7WHeso4jUOWK22rnuk0bEFM6ltwOnYsK%2B%2F7KdXV1SJSPQ3JNN8eYO%2Fh5WwlE%2Bgo"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7776000, stale-while-revalidate=30, public cf-ray 8af11eec7ea519ab-FRA
GET H2	200	details Show response epsilon.6sense.com/v3/company/	740 B 714 B	254ms 170ms	XHR application/json	52.57.52.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.52.94 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-52-94.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fcfa6196dab8b589e789abbe996ce23b418577a8890284f785d6e4c1554a1002 Request headers Referer https://www.securonix.com/ Authorization Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 X-6s-CustomID WebTag1.0 05b12115ad17914938bf7667643ca0d3 Response headers x-trace-id 2170082627513683809 date Tue, 06 Aug 2024 18:34:24 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.securonix.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 392
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	244ms 42ms	Preflight	52.57.52.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.52.94 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-52-94.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.securonix.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Tue, 06 Aug 2024 18:34:24 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 996040022384437765
GET H2	204	0 bat.bing.com/action/	0 287 B	68ms 67ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=ac54b4dd-7780-4e4f-8315-9def10748e53&sid=810c5200542211ef83c405f8d4c32c43&vid=810c8140542211ef8fd2cf3ab0daa3f8&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&r=&lt=2478&evt=pageLoad&sv=1&cdb=AQoV&rn=263356 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 06 Aug 2024 18:34:23 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 98723CFCF86E49AD8949F1F919E448A5 Ref B: FRA31EDGE0511 Ref C: 2024-08-06T18:34:24Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	144ms 144ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:24 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:24 GMT
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	413 KB 84 KB	47ms 47ms	Script text/javascript	2600:9000:2644:b000:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:b000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 4b8671f08b1e11ff97209c38ae055192065f256c7ce760c715fe05c5482d2e81 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id VrseeXkYhawqUTA9Fww4aopzp4PLNITS Content-Encoding gzip Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Date Tue, 06 Aug 2024 18:31:56 GMT Age 150 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Tue, 25 Jun 2024 18:52:35 GMT Server AmazonS3 Etag W/"e5a8f1a23546815681b8bee9100b5eac" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id nNZZ5D5SSIa_U759l6fFKjrW9ukz6MrI2yaxqeC_z-Lkg8JXmlWr1Q==
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	43ms 42ms	Image image/png	2600:9000:2644:b000:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:b000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Date Tue, 06 Aug 2024 05:25:55 GMT Via 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront) Age 47310 X-Amz-Cf-Pop FRA60-P6 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 1615 Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Server AmazonS3 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type image/png Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id RJ867xbB2-cDjDvcup_WzQ3q29esZrwqpC8Y1OmayreKmaPp4W8fMw==
GET H2	200	core js.driftt.com/ Frame 424D	0 0	447ms 346ms	Document text/html	18.245.86.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=c4c56199-6d86-4280-a79f-ab877709abc2&sessionStarted=1722969264.866&campaignRefreshToken=e3fb66aa-5bed-4b1d-b2a0-a9f1adb50323&hideController=false&pageLoadStartTime=1722969261493&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1722969300000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-87.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 06 Aug 2024 18:34:25 GMT etag W/"9274c0ff52d0ea301eff17185711c576" last-modified Wed, 24 Jul 2024 21:19:01 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 75102a66d781b0fa0df5617ce2738546.cloudfront.net (CloudFront) x-amz-cf-id nA0-FmTCKSf850K8b92JvR49fikS7g20hNCD9HMHINQr1v4ogbxIpg== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id e.x5p6Pj3I94qvY0w0S0kqCQS7PUrPBy x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 21
GET H2	200	chat js.driftt.com/core/ Frame C9FA	0 0	446ms 347ms	Document text/html	18.245.86.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1722969261493 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1722969300000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-87.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 06 Aug 2024 18:34:25 GMT etag W/"9274c0ff52d0ea301eff17185711c576" last-modified Wed, 24 Jul 2024 21:19:01 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 75102a66d781b0fa0df5617ce2738546.cloudfront.net (CloudFront) x-amz-cf-id gTMXz_8cM_SpQmLZ9eWKSLntHLu0quc2KwTcVnD-T7SP5q9cKm1pDg== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id e.x5p6Pj3I94qvY0w0S0kqCQS7PUrPBy x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 25
GET H3	200	zi-tag.js Show response js.zi-scripts.com/	9 KB 3 KB	695ms 253ms	Script application/javascript	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/zi-tag.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:25 GMT x-amz-version-id PTl7rnF_EEhUwyN5J882FhdYw1E0brGf via 1.1 116bbd3369f3a47b2d68a49a57fa7b40.cloudfront.net (CloudFront) cf-cache-status DYNAMIC content-encoding gzip x-amz-cf-pop WAW51-P3 age 56954 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Thu, 18 Jul 2024 08:13:46 GMT server cloudflare etag W/"b2877da906a3216c4f3fc4030b205e54" vary Accept-Encoding content-type application/javascript cf-ray 8af11ef4bc10bfe4-WAW x-amz-cf-id 5hCIQLib8fwQkMxe-lLVUk2PePbXzrWQ3llelWeCPqdSLdXXwzRH1A==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	147ms 147ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A23%20GMT%22%2C%22timeSpent%22%3A%221479%22%2C%22totalTimeSpent%22%3A%221479%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:25 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:25 GMT
GET H3	200	Securonix-EON-Data-Sheet-Featured-Image.jpg www.securonix.com/wp-content/uploads/2024/04/	72 KB 72 KB	100ms 100ms	Image image/jpeg	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-EON-Data-Sheet-Featured-Image.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 515af980f6f9699ff77fa791ebab1eb62c21a31e37ed0acb10fc5da61e131824 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:25 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 816754 cf-polished origSize=73758 alt-svc h3=":443"; ma=86400 content-length 73750 referrer-policy strict-origin-when-cross-origin cf-bgj imgq:100,h2pri last-modified Thu, 02 May 2024 16:59:00 GMT server cloudflare etag "6633c654-1201e" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11ef47971451c-TXL
GET H3	200	getSubscriptions Show response js.zi-scripts.com/unified/v1/master/	199 B 581 B	564ms 564ms	Fetch application/json	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 1709e65e174a5cceb6bfb2a7f651db5b075254bc8403feb232f53b3e7e47a34e Request headers Content-Type application/json Referer https://www.securonix.com/ Authorization Bearer 3e8e82dad11669757953 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 visited_url https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Response headers date Tue, 06 Aug 2024 18:34:27 GMT via 1.1 265b2251d8f4bff865cf758f596b8e88.cloudfront.net (CloudFront) content-encoding gzip cf-cache-status DYNAMIC x-amz-cf-pop DXB53-P1 x-powered-by Express x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 apigw-requestid cGXsDgQ1vHcEP6Q= server cloudflare etag W/"c7-XTHewsVngeqfDU3s1XDIpvHylbg" vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.securonix.com cf-ray 8af11efedadcbf29-WAW x-amz-cf-id rxnznxE0bD9NIDK4IfPxg2Qs25I3VbegjEpKM56oL3MICPCsWSFBTA==
OPTIONS H3	204	getSubscriptions js.zi-scripts.com/unified/v1/master/ Frame	0 0	1360ms 1105ms	Preflight	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,content-type,visited_url Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-headers Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken access-control-allow-methods POST, GET, OPTIONS, PATCH, DELETE, PUT access-control-allow-origin https://www.securonix.com alt-svc h3=":443"; ma=86400 apigw-requestid cGXr8i1CPHcEPlg= cf-cache-status DYNAMIC cf-ray 8af11ef7e8f2bf29-WAW date Tue, 06 Aug 2024 18:34:26 GMT server cloudflare vary Origin via 1.1 f67233c9d1a2e5156dc610ecabf3a8b8.cloudfront.net (CloudFront) x-amz-cf-id P8Ze1DCH_kVaSYL72_CUiGJIC9lJmJAf4jrkjgDnWTlJ8NhMj9G_PA== x-amz-cf-pop DXB53-P1 x-cache Miss from cloudfront x-powered-by Express
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	156ms 151ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A25%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%222485%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:26 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:26 GMT
GET H3	200	cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png www.securonix.com/wp-content/uploads/2021/12/	676 B 1 KB	60ms 59ms	Other image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:26 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 395560 cf-polished origFmt=png, origSize=836 content-disposition inline; filename="cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.webp" alt-svc h3=":443"; ma=86400 content-length 676 referrer-policy strict-origin-when-cross-origin cf-bgj imgq:100,h2pri last-modified Thu, 02 May 2024 08:01:35 GMT server cloudflare etag "6633485f-344" vary Accept x-frame-options SAMEORIGIN content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes cf-ray 8af11efbd8e1451c-TXL
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	138ms 137ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A26%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223485%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:27 GMT x-content-type-options nosniff last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:27 GMT
GET H3	200	formcomplete.js Show response ws-assets.zoominfo.com/	90 KB 27 KB	395ms 176ms	Script application/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws-assets.zoominfo.com/formcomplete.js Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 18:34:27 GMT content-encoding gzip cf-cache-status DYNAMIC age 3386 x-guploader-uploadid AHxI1nMh_9ix3zkrXUKbGR-5sSPidZFT6B_hKsJ4dfpaJN13uYw2q891j_M4m5GVkLz3befdwas x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400 last-modified Thu, 16 May 2024 10:14:37 GMT server cloudflare etag W/"006455bd44ed289ddcc403d0ecd96ab0" x-goog-hash crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA== x-goog-generation 1715854477710382 content-type application/javascript cache-control public, max-age=3600 x-goog-stored-content-length 91778 cf-ray 8af11f03bf2abf38-WAW expires Tue, 06 Aug 2024 18:38:01 GMT
GET H3	200	/ Show response ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/	3 KB 2 KB	374ms 275ms	Fetch text/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 28a4d25f10d20675c32aa445df4a7668171b69f8990634efe6b3ebda803375dc Security Headers Name Value X-Content-Type-Options nosniff Request headers visited-url https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Referer https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ _vtok ODAuMjU1LjcuMTAx _zitok b8cf7d058c37d433de211722969267 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/javascript Response headers date Tue, 06 Aug 2024 18:34:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin https://www.securonix.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url alt-svc h3=":443"; ma=86400 cf-ray 8af11f05ee1b3bc9-WAW
OPTIONS H3	200	/ ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/ Frame	0 0	472ms 255ms	Preflight text/html	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers _vtok,_zitok,content-type,visited-url Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url access-control-allow-origin https://www.securonix.com allow GET,HEAD alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8af11f03bdaebf56-WAW content-encoding gzip content-type text/html; charset=utf-8 date Tue, 06 Aug 2024 18:34:27 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
POST H3	200	forms Show response ws.zoominfo.com/formcomplete-v2/	320 B 616 B	249ms 248ms	Fetch application/json	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Requested by Host: ws-assets.zoominfo.com URL: https://ws-assets.zoominfo.com/formcomplete.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Authorization bearer f0ddbd6ba8265551bbe95c25bdf2a9 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type application/json Response headers date Tue, 06 Aug 2024 18:34:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google x-powered-by Express alt-svc h3=":443"; ma=86400 server cloudflare etag W/"140-/3+OW/4aU4/AnqAmyrwCzrd9buM" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://www.securonix.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok cf-ray 8af11f07f88a3bc9-WAW
OPTIONS H3	200	forms ws.zoominfo.com/formcomplete-v2/ Frame	0 0	248ms 248ms	Preflight text/html	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok access-control-allow-origin https://www.securonix.com allow POST alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8af11f0669f7bf56-WAW content-encoding gzip content-type text/html; charset=utf-8 date Tue, 06 Aug 2024 18:34:28 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	141ms 141ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224486%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:28 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:28 GMT
GET BLOB	200 OK	f38a6190-79a0-4409-aebf-073ed6bd2af5 Show response https://www.securonix.com/	3 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.securonix.com/f38a6190-79a0-4409-aebf-073ed6bd2af5 Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 28a4d25f10d20675c32aa445df4a7668171b69f8990634efe6b3ebda803375dc Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Length 3033 Content-Type text/javascript
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	129ms 128ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=chat_playbook_fired&a=915442&_cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 06 Aug 2024 18:34:28 GMT content-encoding gzip via 1.1 google server gnv01c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	130ms 130ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=chat_open&a=915442&_cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 06 Aug 2024 18:34:28 GMT content-encoding gzip via 1.1 google server gnv01c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	139ms 139ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=35caa94c-a966-4520-8aee-c33b60088523&session=22ea7659-a428-4ae4-8e43-8301c3f0aa87&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Aug%202024%2018%3A34%3A28%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225486%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Securonix%20Threat%20Research%20Team%20has%20been%20monitoring%20an%20ongoing%20social%20engineering%20attack%20campaign%20from%20North%20Korean%20threat%20actors%20who%20are%20targeting%20developers%20using%20fake%20interviews%20to%20deliver%20a%20Python-based%20RAT.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&pageViewId=5ce1b71c-0649-41b3-8614-785a01a68afc&ipv6=2a01%3A4a0%3A1338%3A92%3A%3A4&v=1.1.22 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:29 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 06 Aug 2024 18:34:29 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 0	60ms 58ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je47v0v891181397za200&_p=1722969263.695&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tcfd=10001&tag_exp=95250753&cid=883817809.1722969264&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fanalysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors%2F&sid=1722969263&sct=1&seg=0&dt=Analysis%20of%20DEV%23POPPER%3A%20New%20Attack%20Campaign%20Targeting%20Software%20Developers%20Likely%20Associated%20With%20North%20Korean%20Threat%20Actors%20-%20Securonix&_s=2&tfd=8648 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 06 Aug 2024 18:34:29 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT