research.swtch.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 2a00:1450:4001:812::2013, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is research.swtch.com.
TLS certificate: Issued by GTS CA 1D4 on April 9th 2024. Valid for: 3 months.

This is the only time research.swtch.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
5	2a00:1450:400... 2a00:1450:4001:812::2013		15169 (GOOGLE) (GOOGLE)
5	1

5 2a00:1450:4001:812::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

research.swtch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	swtch.com research.swtch.com	140 KB
5	1

	Domain	Requested by
5	research.swtch.com	research.swtch.com
5	1

This site contains links to these domains. Also see Links.

Domain
swtch.com
www.openwall.com
git.tukaani.org
sourceware.org
systemoverlord.com
github.com
linux.die.net
maskray.me
twitter.com

Subject Issuer	Validity	Valid
research.swtch.com GTS CA 1D4	`2024-04-09` - `2024-07-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://research.swtch.com/xz-script
Frame ID: 4400BF73A3BE6F81D57325C5CD4BD2C5
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

research!rsc: The xz attack shell script

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

140 kB
Transfer

139 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://swtch.com/~rsc/
Title: Russ Cox

Search URL Search Domain Scan URL

URL: https://www.openwall.com/lists/oss-security/2024/03/29/4
Title: published the existence of the xz attack

Search URL Search Domain Scan URL

URL: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
Title: adding a few new test files

Search URL Search Domain Scan URL

URL: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=74b138d2a6529f2c07729d7c77b1725a8e8b16f1
Title: That commit

Search URL Search Domain Scan URL

URL: https://sourceware.org/glibc/wiki/GNU_IFUNC
Title: GNU indirect function

Search URL Search Domain Scan URL

URL: https://systemoverlord.com/2017/03/19/got-and-plt-for-pwning.html
Title: global offset table (GOT) and procedure linkage table (PLT) read-only

Search URL Search Domain Scan URL

URL: https://github.com/amlweems/xzbot
Title: runs attacker code when the right SSH certificate is presented

Search URL Search Domain Scan URL

URL: https://linux.die.net/man/1/tr
Title: tr(1)

Search URL Search Domain Scan URL

URL: https://maskray.me/blog/2021-01-18-gnu-indirect-function
Title: GNU indirect function

Search URL Search Domain Scan URL

URL: https://git.tukaani.org/?p=xz.git;a=commit;h=419f55f9dfc2df8792902b8953d50690121afeea
Title: on 2024-01-11

Search URL Search Domain Scan URL

URL: https://twitter.com/nugxperience/status/1773906926503591970
Title: @nugxperience on Twitter recognized it

Search URL Search Domain Scan URL

URL: https://git.tukaani.org/?p=xz.git;a=blob;f=src/liblzma/check/crc_x86_clmul.h;h=ae66ca9f8c710fd84cd8b0e6e52e7bbfb7df8c0f;hb=2d7d862e3ffa8cec4fd3fdffcd84e984a17aa429#l388
Title: the real is_arch_extension_supported

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request xz-script Show response research.swtch.com/	48 KB 49 KB	316ms 211ms	Document text/html	2a00:1450:4001:812::2013 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://research.swtch.com/xz-script Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash `51dedad5110fd8f71d3e3ca6414f6763e495c60e5befeb70e891eec22b5abb61` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1 Response headers accept-ranges bytes cache-control public, max-age=300 content-type text/html; charset=utf-8 date Mon, 29 Apr 2024 11:21:06 GMT etag "010b401a866bf0161263600aa2e71bf1" expires Mon, 29 Apr 2024 11:21:06 GMT last-modified Thu, 04 Apr 2024 12:47:24 GMT server Google Frontend
GET H2	200	fonts.css research.swtch.com/fonts/minion3/	8 KB 8 KB	216ms 215ms	Stylesheet text/css	2a00:1450:4001:812::2013 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://research.swtch.com/fonts/minion3/fonts.css Requested by Host: research.swtch.com URL: https://research.swtch.com/xz-script Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash `21c73e48622553e090df7d0e2bc63f683ce9d18f0d23bfb5990c4ea0c6c7cabe` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://research.swtch.com/xz-script User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1 Response headers date Mon, 29 Apr 2024 11:21:07 GMT last-modified Sun, 22 Oct 2023 20:15:43 GMT server Google Frontend etag "3cfd8b7c0b72b87bc6bc20578ff14db4" content-type text/css cache-control public, max-age=300 accept-ranges bytes expires Mon, 29 Apr 2024 11:21:07 GMT
GET H2	200	source-code-pro.css research.swtch.com/fonts/source-code-pro/	6 KB 6 KB	205ms 205ms	Stylesheet text/css	2a00:1450:4001:812::2013 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://research.swtch.com/fonts/source-code-pro/source-code-pro.css Requested by Host: research.swtch.com URL: https://research.swtch.com/xz-script Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash `7b456bb18ae8d6f4f2029bde47a0608eb05759ebec0e126f7e05f51b1924231e` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://research.swtch.com/xz-script User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1 Response headers date Mon, 29 Apr 2024 11:21:07 GMT last-modified Sat, 14 Oct 2023 02:31:43 GMT server Google Frontend etag "5fef083b2a425a1485e42d8490b97457" content-type text/css cache-control public, max-age=300 accept-ranges bytes expires Mon, 29 Apr 2024 11:21:07 GMT
GET H2	200	SourceCodePro-Regular.ttf.woff2 research.swtch.com/fonts/source-code-pro/WOFF2/TTF/	72 KB 73 KB	219ms 219ms	Font font/woff2	2a00:1450:4001:812::2013 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://research.swtch.com/fonts/source-code-pro/WOFF2/TTF/SourceCodePro-Regular.ttf.woff2 Requested by Host: research.swtch.com URL: https://research.swtch.com/fonts/source-code-pro/source-code-pro.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash `714eee29b70d191f5bf4b3a06b68f2c50522b1303d31c7d44dcefdcc5f9defd0` Request headers Referer https://research.swtch.com/fonts/source-code-pro/source-code-pro.css Origin https://research.swtch.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1 Response headers date Mon, 29 Apr 2024 11:21:07 GMT last-modified Sat, 14 Oct 2023 02:32:03 GMT server Google Frontend etag "22915be256cd8dac3383cbec6342da9e" content-type font/woff2 cache-control public, max-age=300 accept-ranges bytes expires Mon, 29 Apr 2024 11:21:07 GMT
GET H2	200	favicon.ico research.swtch.com/	5 KB 5 KB	213ms 212ms	Other image/png	2a00:1450:4001:812::2013 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://research.swtch.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash `e371e79394bd21fc2719c5df44216e8fa275830f1b9cc60239e795ca27855317` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://research.swtch.com/xz-script User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1 Response headers date Mon, 29 Apr 2024 11:21:07 GMT last-modified Mon, 12 Jul 2021 14:21:57 GMT server Google Frontend etag "e1982db167e716a32760a4e1c0d77c4d" content-type image/png cache-control public, max-age=300 accept-ranges bytes expires Mon, 29 Apr 2024 11:21:07 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

research.swtch.com
2a00:1450:4001:812::2013
21c73e48622553e090df7d0e2bc63f683ce9d18f0d23bfb5990c4ea0c6c7cabe
51dedad5110fd8f71d3e3ca6414f6763e495c60e5befeb70e891eec22b5abb61
714eee29b70d191f5bf4b3a06b68f2c50522b1303d31c7d44dcefdcc5f9defd0
7b456bb18ae8d6f4f2029bde47a0608eb05759ebec0e126f7e05f51b1924231e
e371e79394bd21fc2719c5df44216e8fa275830f1b9cc60239e795ca27855317

research.swtch.com Open in urlscan Pro 2a00:1450:4001:812::2013 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

140 kBTransfer

139 kBSize

0 Cookies

12 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

Indicators

research.swtch.com Open in urlscan Pro
2a00:1450:4001:812::2013 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

140 kB
Transfer

139 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions