www.group-ib.com Open in urlscan Pro
3.72.181.255  Public Scan

22 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL
2. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 101

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1693909329304%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fblog%252Fcve-2023-38831-winrar-zero-day%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJvvG1e-YaKBgAAAYpk3Sg1Us2FluqWJk_I0lcwj0v5Y6bGAZ8jCn-YGVSAdD8-DJd0vXg

Request Chain 110

• https://mc.yandex.com/sync_cookie_image_check HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10117.Pb7FcNl4G_NKGNGvjNDk6lpCvZ0UxR2DaMnxpcLPVs9B1CP9Veeylr4nlTDBdwvD.IwKvUyq3J5jY1WKnu5JCOOiyUvE%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide?token=10117.pk1PmnIRXk0wweOTQdLgI1uH-_V5whTfi_Vr2uszriUEFImcG61MeJnkOfI3-RDwGXRDiKvjTcoMw-Wh5sW1lFHBp1_6aCqoiLus37owob0%2C.Ro6fFcuh3RBGFrOt3i5B7HocFpQ%2C

Request Chain 123

• https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afp%3A1027%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A0%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A471303283%3Arqn%3A1%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C67%2C40%2C402%2C0%2C%2C726%2C29%2C%2C%2C%2C1269%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
• https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afp%3A1027%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A0%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A471303283%3Arqn%3A1%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C67%2C40%2C402%2C0%2C%2C726%2C29%2C%2C%2C%2C1269%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Request Chain 128

• https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
• https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10117.d0TZd-5G2jJV-AbVbXMFPrWHkCbPOQtpyjtXZ-y9ZMcrdDUYKOoPMkGPU2IXpEPA.XuDrJQ5RTtgYzE6YWNJ1Go0bHjc%2C HTTP 302
• https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10117.7pmZlX1ACKlnK-pOq1FWpynijTdp5s9B8adxrAgWF2jSRCV-BIq1EDgafoaLFG1QyiecLxmlBqDiMeHf7I1yFcUPEZiOxV3iZWvam5GWoAQ%2C.jdHFqrnXQHyGBT1VSSicyTs1ebI%2C

131 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
21 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	/ Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	7 KB 7 KB	196ms 40ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software / Resource Hash 34de17ac1bf040d56f0be4c35cb916ede68c6a119347007caf8560722f6de959 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate content-type text/html date Tue, 05 Sep 2023 10:22:05 GMT
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	348 KB 137 KB	170ms 77ms	Script text/javascript	188.40.32.249 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.32.249 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.249.32.40.188.clients.your-server.de Software nginx / Resource Hash 232961fb224a55c5c4c9347ac2f3a4e06d1d8243196f13957d6f93cf9e176a78 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:06 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET DATA	200 OK	truncated /	489 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2fe1aff701cc67d4079a6c8cfd66b3c814efca2f528bc4f49a13a898497ff4bb Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a1f27f00dbe5083b56f9da5457dc11b02371e05a3aa82506c06382cd4c7bce60 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	205 B 680 B	52ms 52ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 83a5dd73492da46a921493cfd1eb6d96308bd23405de2ddde6b50540ea86ed25 Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 x-cfids - Response headers date Tue, 05 Sep 2023 10:22:06 GMT content-encoding gzip server nginx etag W/"jw8ajWufOIIl9Xipgbb/j1XVobso2xvKKsRwmLEAIZt7FgZtG1i5q5puhRVxTTfENCYfDqZIBztHjd5XsY7cyEUJ4AxKOgZ09jPU2pBl3ox9+DIdroe77AeokM2aInwq/x8+K6OoQ0TDFj8p6i/DbLor" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 1
POST H2	200	fl www.group-ib.com/api/	665 B 982 B	94ms 93ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=32773c20-4b3c-11ee-949e-124106a1e004&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=jw8ajWufOIIl9Xipgbb%2Fj1XVobso2xvKKsRwmLEAIZt7FgZtG1i5q5puhRVxTTfENCYfDqZIBztHjd5XsY7cyEUJ4AxKOgZ09jPU2pBl3ox9%2BDIdroe77AeokM2aInwq%2Fx8%2BK6OoQ0TDFj8p6i%2FDbLor Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 05 Sep 2023 10:22:07 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
POST H2	200	fl www.group-ib.com/api/	665 B 692 B	49ms 49ms	Ping application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=32773c20-4b3c-11ee-949e-124106a1e004&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=EdIS8N4r%2FboQ2noa5GHGFW%2BeFdLODjWS4e0%2BM68v8UxeTtkfc7pvDLhLVKUkTOHFm3drobUFrZw%2BbhuccKCBZoG8W9rhzyXgAAgXEeRCcl6n4jU7JwvK1IVoma%2Fl%2FKvM953eLYJv0MbkF3g9zK9Pxu1V7daZ93nVgS6V Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 05 Sep 2023 10:22:07 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	Primary Request / Show response www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/	117 KB 28 KB	67ms 66ms	Document text/html	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 8bd4566b83d1a325c9bdc2c4e23ab715b6c37cf552f1e8bfd1ce3ab023d5c58d Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin https://www.group-ib.com cache-control private, max-age=3600 content-encoding gzip content-length 28584 content-security-policy frame-ancestors 'self'; content-type text/html; charset=UTF-8 date Tue, 05 Sep 2023 10:22:08 GMT etag "6ec2-60497edda8804" last-modified Tue, 05 Sep 2023 07:53:57 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000; includeSubDomains vary X-Forwarded-Proto,Accept-Encoding,Cookie x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H/1.1	200 OK	bt-autoinject.js Show response fhp-de-js.group-ib.com/d/	348 KB 137 KB	84ms 82ms	Script text/javascript	188.40.32.249 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://fhp-de-js.group-ib.com/d/bt-autoinject.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.40.32.249 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.249.32.40.188.clients.your-server.de Software nginx / Resource Hash 232961fb224a55c5c4c9347ac2f3a4e06d1d8243196f13957d6f93cf9e176a78 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:08 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript; charset=UTF-8 Access-Control-Allow-Methods GET, POST, OPTIONS x-envoy-upstream-service-time 1 Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	lazyload.min.js Show response www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/	6 KB 2 KB	68ms 66ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1a54a1907a6443e3c81608130bfed4546eb0ce5d0c8897e1d7a3b43d89ecc367 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 2356 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 29 Jun 2023 07:01:06 GMT server nginx etag "1883-5ff3f43abc651-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	swiper-bundle.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	140 KB 39 KB	190ms 63ms	Script application/x-javascript	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/swiper-bundle.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 39504 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:41:14 GMT server nginx etag "22ede-5e7e9344df9f2-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id wZ4qP5lDW3rN_W-7x65-H158RFCLFlTn9V3Yje-QGomNEensgRiuSg== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	classic-themes.min.css website.cdn.group-ib.com/wp-includes/css/	217 B 1008 B	226ms 99ms	Stylesheet text/css	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/classic-themes.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 189 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "d9-5ed309cf15c82-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id QezF8_0atXv2zfsxxG9UgfAGqDX2MPs8DxV7dXYSvW00DlXfxs1EmQ== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	dashicons.min.css website.cdn.group-ib.com/wp-includes/css/	58 KB 36 KB	252ms 126ms	Stylesheet text/css	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/css/dashicons.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 35730 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Jun 2022 07:03:36 GMT server nginx etag "e688-5e112897ec200-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id XWoFrIZGykryUd6E9yUixPN3lv4vOmWzpDWdef-9ibpyXAm8_8iwow== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	frontend.min.css www.group-ib.com/wp-content/plugins/post-views-counter/css/	215 B 310 B	67ms 65ms	Stylesheet text/css	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/css/frontend.min.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash ed70c2cf61d0f24d03299ffc5896c7abd86bb858501987dc10e3afec086c01df Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 160 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "d7-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	jquery.min.js Show response website.cdn.group-ib.com/wp-includes/js/jquery/	88 KB 31 KB	228ms 102ms	Script application/x-javascript	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-includes/js/jquery/jquery.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 30995 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 11 Nov 2022 11:58:50 GMT server nginx etag "15e54-5ed309cf21802-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id jfRz2-wgpfEOWjIW88wwgh2dP1ZoMDiMS0lGc2kba-grAbr-kavhEA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	single-blog-post.css website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/	271 KB 39 KB	269ms 144ms	Stylesheet text/css	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5f3eb686a53660713a24f146256d6184081e7a42a15833d98367b19162e611f6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 39011 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 05 Sep 2023 10:21:58 GMT server nginx etag "43aea-60499ff2fd4a0-gzip" x-frame-options sameorigin vary Accept-Encoding content-type text/css access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id IIvbFPpmZ0-7uDJ-tQAOoP7C8fclIJiRNQ__NikOdpFFXFkC1OmNBQ== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	v2.js Show response js-eu1.hsforms.net/forms/	526 KB 165 KB	172ms 53ms	Script application/javascript	172.65.255.172 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsforms.net/forms/v2.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69ff013760515696c54749156ae5dba9f130fa01e2e355fec69a26e6d87f1892 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-encoding br age 345 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3611/bundles/project-v2.js&cfRay=801db76c5e7d2ba8-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"c4734e241af5f9cffb4ae77e895d98aa" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3611/bundles/project-v2.js date Tue, 05 Sep 2023 10:22:08 GMT x-amz-version-id t9RM7Hi5NxkmmXBn8QlzNFQ1kBe.nFZ5 via 1.1 1f0db25765b79d244ad1fa2184395c12.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 x-hubspot-correlation-id 2780206b-23a2-40c3-8b1e-5b03f059f62d x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 2780206b-23a2-40c3-8b1e-5b03f059f62d last-modified Thu, 24 Aug 2023 09:52:45 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hXvLIWTXVaxw%2FX2LFol%2BhePNGalev6Ei5uhiEBayqQr0MIWWer7WENVvjcWTLmIKF5sLtWlr0oac8Psl8ZeovrcwbMMfWRxG2K2v0nlrs4Bph9ALPSPZcG3KbgF5wTqeOdA5Pw%3D%3D"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh cf-ray 801dbfd52ff82be6-FRA x-amz-cf-id -fpsPrJLcl1JX-wc2Ri2y-PYxl6ADZnvClT-btYW-5PrvVSCrCkiTA==
GET H2	200	1-9.webp website.cdn.group-ib.com/wp-content/uploads/	26 KB 26 KB	96ms 95ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/1-9.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 12694cf25c8b39aa1c1ffec08e918329ff5ede72cac2d072676c8966d0ecb232 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 26152 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:42 GMT server nginx etag "6628-602f45775ef38" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ROWQKnIXfo8v_gbUtzoudDuZl9R8KBIr9w3wdPpJ02lOfeNxHr5Y9Q== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	3-9.webp website.cdn.group-ib.com/wp-content/uploads/	28 KB 28 KB	58ms 56ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/3-9.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 91142fb37a1afd429d81b87ca85e1f90ddfe4adbb2371355c9f16a2d35dbfe73 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 28366 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:48 GMT server nginx etag "6ece-602f457ce122e" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id lGPX7YWCiNGz-4oQqBjQKPFpzn1M7Gf_XbdU9NGNbXG6q-6AZMDRZw== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	4-8.webp website.cdn.group-ib.com/wp-content/uploads/	49 KB 50 KB	64ms 62ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/4-8.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9bb9e90fb96a3d0ab60eccf88c4b0832073adda15ecc9701aeab7b63d2e4ac57 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 50338 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:54 GMT server nginx etag "c4a2-602f4582450c1" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id y3mJiCbRrmtf8ZVbk6FwxAwe4Wmr2JjnuBD_Y6Yu0y-Fl18CgzVRug== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	5-7.webp website.cdn.group-ib.com/wp-content/uploads/	54 KB 55 KB	70ms 69ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/5-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8f2a83616053ea89700e5f226589cd1c84ab988e40cd1201ea3122f9c88fe9a8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 55798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:18:59 GMT server nginx etag "d9f6-602f4587aae94" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id A0xuxwmhcmgjkDHM_HIfEkadG-m2AhDR2xFz8ofBnc2ehVJ-Q7ZMgg== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	6-7.webp website.cdn.group-ib.com/wp-content/uploads/	31 KB 32 KB	99ms 98ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/6-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c8c136448d94d42b73df0606ee587f793b66a14d81b7cfae1a348acd7235e3eb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 31676 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:19:05 GMT server nginx etag "7bbc-602f458d16a28" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 455I04nrNFfYqPqxSVGEjihGj21RpXO2tRxrwGqjJy-TW7y-Lf78CA== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	7-7.webp website.cdn.group-ib.com/wp-content/uploads/	31 KB 32 KB	104ms 103ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/7-7.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7329cdfadeb1fb651c8f76b7c8819a69b7e51ff93c6fb327db12664cbe891168 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 11:19:11 GMT server nginx etag "7cae-602f4592a0a1f" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ZPogidi0Q7DzYQBy7FXc_RKleFrms6sWB5hpEP13XUDevVNIMgfJGw== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	main.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	211 KB 46 KB	110ms 109ms	Script application/x-javascript	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9e74da602eceae93875543dd9a235f2fbbbca8c254c125bcb733fa6a0486c9bd Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 45806 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Aug 2023 09:55:26 GMT server nginx etag "34b3c-60215e5662e3c-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id -cvXMOH1o67mg-Ozfaz8NvjT_5VA4ff0ELoWVj7XYRkuqfRgewKUiA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	fancybox.umd.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/	103 KB 30 KB	70ms 70ms	Script application/x-javascript	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/libs/fancybox/fancybox.umd.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 942e02acf640c0308f65e057a8afaed63dfaf995034cda9cfc75532a1009ec72 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 29634 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 05 Sep 2022 07:24:28 GMT server nginx etag "19ca6-5e7e8f85cb376-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id WYgDZe91kxD-lqk-xUL6G8CXn-PAySqDpnqoKuD0b4n5sMx_iMYr0g== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	frontend.min.js Show response www.group-ib.com/wp-content/plugins/post-views-counter/js/	1 KB 700 B	54ms 54ms	Script application/x-javascript	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/wp-content/plugins/post-views-counter/js/frontend.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 12475fdd5d48640d7ad60670a2342f02cf560b8cd977cf8e7e624e6a22576f82 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 628 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 26 Apr 2023 07:26:40 GMT server nginx etag "484-5fa38293ec798-gzip" vary X-Forwarded-Proto,Accept-Encoding x-frame-options sameorigin content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	25755956.js Show response js-eu1.hs-scripts.com/	2 KB 1 KB	192ms 72ms	Script application/javascript	172.65.208.22 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-scripts.com/25755956.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb4d921e6c45c02541bbdb813e91b9a0ad1b726fdf994700b02c94b1b04f3336 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 104692da-e858-4793-97ff-a7e57ee7b6e7 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 104692da-e858-4793-97ff-a7e57ee7b6e7 last-modified Tue, 05 Sep 2023 10:15:26 GMT server cloudflare x-trace 2B7EFFCE5F6635300DD9EA3F90C915FC429F045DD3000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control public, max-age=30 access-control-allow-credentials true x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-2v4qb cf-ray 801dbfd76b153651-FRA
GET DATA	200 OK	truncated /	488 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 44b8527cddf37c09093c09cdbe01f745531cb40f5baae36827da3ccb343ae61f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 102dff5781d2ebc0d27e8ab53ed961e0539c75122303856ff6300cb688f8f1da Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/png
GET H2	200	idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Show response www.group-ib.com/api/fl/	217 B 617 B	49ms 48ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl/idgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash f020aa9a8cd6fdc7987ad1b636ed2fdaf6d1066c2e91c775bfec59ca04cb5a8b Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 i8EPkYRHYawHQ/LE1EHJcORYWsC9pJqBXqr9PSA6h7nblOQKJc97G9pd+OcZOxTkxPoq2usbGFiBn3unjxcOZi5ZY9aCSq5T36DqnKuBZJ+8FRwUiwt9HQpE2c0840/Q437xSPkrRYSA4yuvuxkVu9O67I4IzuEjxcWnaTuIvoRnNHktRJ/t1QCo2Tm54NBi61LWFznRKBAOsfd6j93nRkXGMFZISRDR/TwTYeYuhGzHzukPuH/9IQtbgdAqMA== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 Z1fS0706a8a0a10a4760b2194f9caa2a692e8fc7 x-cfids EdIS8N4r/boQ2noa5GHGFW+eFdLODjWS4e0+M68v8UxeTtkfc7pvDLhLVKUkTOHFm3drobUFrZw+bhuccKCBZoG8W9rhzyXgAAgXEeRCcl6n4jU7JwvK1IVoma/l/KvM953eLYJv0MbkF3g9zK9Pxu1V7daZ93nVgS6V Response headers date Tue, 05 Sep 2023 10:22:08 GMT content-encoding gzip server nginx etag W/"qBJoaMRzM0RUyWfYQ/NMHNDw0mpbMigapZ7RxIfbchcNLjg+pIWH7DOtm6NbcwzpEomcamMcyOZJVWEQz4tiTZDhxWeYRKKjg3X2DSDuIKu3wIZnmuiVflTTepv7gcoG2w4dkIhY82C2VeBUEXGsy+wEQGCG7avloXZR" vary Accept-Encoding content-type application/json; charset=utf-8 cache-control no-cache x-envoy-upstream-service-time 0
GET H2	200	G-font-Medium.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	60 KB 35 KB	164ms 79ms	Font application/x-font-otf	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Medium.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1efe16c9efbadde5e242d88a315eca3906a55669fcd4882a904fbc723306a4e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 35382 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "eed4-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id YaUzd_FCNiVqllEWrhzgm9lYXjYkcDFNweehrbupGPgb2pIqqm9R_Q== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	G-font-Regular.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	47 KB 31 KB	146ms 62ms	Font application/x-font-otf	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Regular.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 6cee0fb06339ba13e1f15d044e0e4904bbeeb7fbe4351e3f102b6d80b2465061 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 30798 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "bbf8-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 7nEIO1qAUICELV6i2zLsHaMkPPahYi45Z-qyl8WdUNHd8D3nFNUxfQ== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/	9 KB 3 KB	196ms 73ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/044e7558-8073-478a-ad3c-5807dd76840f/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7ffdd66871c3798adbad9fb9bbd2c4130b6530dab82ac5ede741c5ee7e66dddc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Tue, 05 Sep 2023 10:22:08 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 790927f0-a5fe-433b-acfb-c5b67b8b43fc Transfer-Encoding chunked x-envoy-upstream-service-time 8 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 790927f0-a5fe-433b-acfb-c5b67b8b43fc Server cloudflare X-Trace 2B282D3B77CD503DCB14A1A3DD7D1B3C53A44FAC20000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 801dbfd7cefa92ab-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz
GET H2	200	cross.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	342 B 1 KB	49ms 48ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/cross.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dfb059f8aa219769088fd6c85d85aae789f1e72bfe3d314748f1f3ccfffffb1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 207 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "156-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 65eKvSmkp498bN5tmEpr2AwfDmzvrhPkKE0Lo03lnj5FbyhmLeu5HA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/	112 KB 30 KB	187ms 85ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aaf69d677a196bad5e0bf357706b41ac0681c66a111b3c3a6c7b9ffd506023e9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Tue, 05 Sep 2023 10:22:08 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 6f72a691-64cc-4616-ad7e-0e5bb791a9e0 Transfer-Encoding chunked x-envoy-upstream-service-time 20 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6f72a691-64cc-4616-ad7e-0e5bb791a9e0 Server cloudflare X-Trace 2B97DB8480339B3833E562F579025A1AC36C3AF626000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 801dbfd7c9c59a35-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 01caf20e667c8e300960582162f912d9405e9895c32cff1a9ee95511fd509a2c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f464ef7c0b366ff00e2f023cb6b48112306212648e451ddf16be40c2b99d639 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81cc2a3a0c0b6e8335f5f3143390b8b6f036dc573e73d3f4b5742482f0bdca73 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dropdown_before.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	154 B 974 B	51ms 51ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/dropdown_before.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 574ab1a3d7b47add5d43a927f62c87698264f63572acd70b42081dd4a1dc5ced Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 150 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "9a-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id rXcpMcPkzqMJG5jKfmK6gbfK9JIkk7k2n27R_pFQc5nmuk1TkMK-JQ== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	link-arrow.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	409 B 1 KB	83ms 82ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/link-arrow.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e91c5731358570d3e4cd684118251d243fc799059648b152403dcd775ceba632 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 267 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "199-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id BneyhkSkkPwdkHpBhFBcCzYj3UqkhxMp6TB6ycrvVWG3OpRvsFgf_Q== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	Close.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	227 B 264 B	79ms 78ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/Close.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 31d1c5bd0cd38e6e6b8eb944944df273044e826c7d3daacbe602caead3068c7a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 180 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 12:14:21 GMT server nginx etag "e3-5ee9aed8bc981-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	file_copy.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	668 B 462 B	77ms 76ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/file_copy.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash f367bbc4429fc9fb0a93045245aef519a000ab275549645cddecb3f953e0a05f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 352 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Nov 2022 13:01:55 GMT server nginx etag "29c-5ee8779d1a6cb-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	success.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	386 B 340 B	78ms 77ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/success.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash fa4859289ded4c674dcee233811758743116b1d7ce4e9f0c0e7e259391504c43 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 254 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 11:07:05 GMT server nginx etag "182-5ee99fd05f106-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	list-dot.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	313 B 309 B	78ms 78ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/list-dot.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 6b0775723ccade5ca3170fcc6a321c5b4768a5dc2b7c83b8b8b595407a2f0018 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 205 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Sep 2022 12:02:57 GMT server nginx etag "139-5e82935d2238c-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	Dropdown-right.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/	503 B 1 KB	80ms 80ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/Dropdown-right.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4d4a484a100e469b6e3dcf880a37755086e246cc291bab46e3edd4529e3d5d6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 307 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 16 Dec 2022 09:56:36 GMT server nginx etag "1f7-5efeefc3ee1d1-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id kLccb-mvAwR9T0eZ5EPx6TQUjkaiVul1CpPr4H70XZxK6kOAnLnJNw== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	G-font-Bold.otf website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/	49 KB 32 KB	147ms 120ms	Font application/x-font-otf	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/G-font/G-font-Bold.otf Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8d15a221986226efe4f742f390f46f9d5ae8b2008a6edd40e10ff121ef9cca9b Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 31918 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "c320-5e27d5c025780-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-font-otf access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 5XCImPfJSZXcADvaBsrJmjB-QU-te0O0z2dRTyWwudDTR-ARf8MsrA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 735f81dd07d1be528a1109302dabc97c7c8b467d60d7184d3a09dc4817703388 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	70 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4d3e9d61c84a9a3d9e67408de91640d9960ade0384f91137b41b2db7242cee46 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eb34f496dadbb9a36d46f7cb1f331a7b8d128cbbf92bc8bf166fcd4b8bd4cc50 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c794a1b7e43ae801fa6d36ccda0cf1d344cd1dd8ab9d14d89b52c32236193265 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b3ceb8713eaee6c95dffc5e4b1c6187675d8ba16f58f73fc30b5c5ae762f0ad7 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 403ac797af2f41dca43b737054d3751629920850b59f433b5b5076ea20e32a07 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 32942cb255fb7f8c412c42973599e2e32cf4899df5a9dfe0b6173640fa9d6f70 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 248468001ca64ad036ae965b6ce2de991bea9e8d4d59342fd3389a2e05fea523 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 93b716bdb2ddaeaf8424a1834eb09925889a1911ce6bac298b4f4e9fedbb4f4b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 688c32f4de8bd2a7dd5917bae5ddce56a28223db4953c3c701977b8b2e358eb9 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b486dfa94fde5b7e78a90b34417c9f976057f55b862dcdb3c7e41dfd7c5e93e3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a57f1ad414e426849b2d9f404fa861248d9b65d927ca32c337f11b022acce8aa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cf38411843332cbc47ca7d9974d8edc2d12850a698bba900795c2eaa6e12f9f3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34e0bb5c5ed1184e6452cf7562faf332af1a26e95e50e035ff0a9f7065e6df9e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Material-Icons.woff2 website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/	125 KB 126 KB	54ms 54ms	Font application/font-woff2	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/fonts/Material-Icons/Material-Icons.woff2 Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 12 Sep 2022 13:11:21 GMT server nginx etag "1f560-5e87aa1cf30ee-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/font-woff2 access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id ZaJe6agGAS99fI6WGlq-4yBeWi2tfKINnBztmSeRHw225yESnVXRhA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/	8 KB 3 KB	91ms 90ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 49f7a7a0d83ba2da2005495b7406e4446dbbf1650d176ab522640a9fdbfb4690 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Tue, 05 Sep 2023 10:22:08 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 8e5bb137-c789-44b6-bb27-61dea1923e96 Transfer-Encoding chunked x-envoy-upstream-service-time 9 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 8e5bb137-c789-44b6-bb27-61dea1923e96 Server cloudflare X-Trace 2B3A5DD76B106047AAA0B31502C268570D0FFBEC4F000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 801dbfd85a919a35-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd
GET H2	200	gtm.js Show response www.googletagmanager.com/	263 KB 85 KB	226ms 67ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 5727d07373ad292f0ed8bc1279d6c9535598f7b76821cbe6ba99abb659093849 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 87022 x-xss-protection 0 last-modified Tue, 05 Sep 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 05 Sep 2023 10:22:08 GMT
GET H2	200	insight.min.js Show response website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/	8 KB 4 KB	52ms 51ms	Script application/x-javascript	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/insight.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 3085 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 15 Jul 2022 14:12:57 GMT server nginx etag "1e5a-5e3d89d6a8c40-gzip" x-frame-options sameorigin vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id tGumvtQFWdYR9-nTKTirtsYKWdlAaX7rHSWejOCVFzqG4nKIEIwgXA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H/1.1	200 OK	json Show response forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/	7 KB 3 KB	66ms 65ms	XHR application/json	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hsforms.com/embed/v3/form/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0/json?hs_static_app=forms-embed&hs_static_app_version=1.3611&X-HubSpot-Static-App-Info=forms-embed-1.3611 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2add4338d832fb9e0d8f6ab48a560ea8615bbe50337de5acd7c78a4591900b3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers X-Origin-Hublet eu1 Date Tue, 05 Sep 2023 10:22:08 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id d110b1ae-6636-494e-9c3a-2662c2acf181 Transfer-Encoding chunked x-envoy-upstream-service-time 6 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d110b1ae-6636-494e-9c3a-2662c2acf181 Server cloudflare X-Trace 2BED80B3E667C3B428E0ABF58F466322CC81604ADA000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://www.group-ib.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 801dbfd87fc692ab-FRA x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-vwr8b
GET H2	200	fb.js Show response js-eu1.hsadspixel.net/	6 KB 3 KB	175ms 53ms	Script application/javascript	172.65.219.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hsadspixel.net/fb.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.219.229 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13a212c6b892024aae8c2db3d8cf9a5ec7d7f0f86948669384001e375a55edb5 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT x-amz-version-id ejB.A_S_mq2WBFqiJyHsLYTQXyGD1Wjj via 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop FRA56-P2 age 1 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.406/bundles/pixels-release.js&cfRay=801dbfcecdb44d9c-FRA x-cache Hit from cloudfront x-hubspot-correlation-id e0920e40-f068-4378-b2f4-c5cc993e792e cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e0920e40-f068-4378-b2f4-c5cc993e792e last-modified Mon, 28 Aug 2023 04:02:35 UTC server cloudflare etag W/"0d4f9e1a24521caddccf596277344ec4" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-8ct2c cf-ray 801dbfd99e2c4d26-FRA x-amz-cf-id G13iokPMxdFyJgaWXWB7H1R4iqaX16NN-58pbciJq_WvcRBRFN9rIQ== x-hs-target-asset adsscriptloaderstatic/static-1.406/bundles/pixels-release.js
GET H2	200	25755956.js Show response js-eu1.hs-analytics.net/analytics/1693909200000/	66 KB 21 KB	210ms 88ms	Script text/javascript	172.65.238.60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-analytics.net/analytics/1693909200000/25755956.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92a2a1ad72d4811d1c79b6fb44e50c193f2d514b2fe36e946577d80c6254ce4f Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT content-encoding br cf-cache-status MISS x-amz-request-id 8C2C337R885DJCYH x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id f1ec38ea-d9f8-4da7-8033-06b2ce9a0aa7 x-envoy-upstream-service-time 18 x-amz-id-2 Fz79HTekcokBWlyACKbmZf8kYDRBnKXOOhbVxo98SRfbTf6V3LxU83+GyXMLU8dkPbk2LApjAsI= x-evy-trace-listener listener_https x-request-id f1ec38ea-d9f8-4da7-8033-06b2ce9a0aa7 x-evy-trace-route-configuration listener_https/all last-modified Wed, 16 Aug 2023 15:02:57 GMT server cloudflare etag W/"eaed25f45513b2c42381986283dfda58" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-mmx2s cache-control max-age=300,public access-control-allow-credentials false cf-ray 801dbfd99fb039c4-FRA expires Tue, 05 Sep 2023 10:27:08 GMT
GET H2	200	banner.js Show response js-eu1.hs-banner.com/v2/25755956/	66 KB 20 KB	196ms 77ms	Script text/javascript	172.65.202.201 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hs-banner.com/v2/25755956/banner.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3c50f1c516cf27ff52158aac863d91ba5830941b9d3aea9e65543e03b314c4e3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT x-amz-version-id MkwRuEgSV1gVokMUKLT0Gwcd5mQpUsYy content-encoding br cf-cache-status REVALIDATED x-amz-request-id D8E2NM3W45FNYWFR x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id dd9438da-9e41-4666-a9da-826db392f844 x-envoy-upstream-service-time 58 x-amz-id-2 Qq8wqyfkPZSYz/y5Y08JZH2aNs1NUxkv3H0yz+mSXmnFlmrPIJMYGxZkGmfK3tW4k78VsDEQ5tE= x-evy-trace-listener listener_https x-request-id dd9438da-9e41-4666-a9da-826db392f844 x-evy-trace-route-configuration listener_https/all last-modified Mon, 31 Jul 2023 22:17:58 GMT server cloudflare etag W/"0242d29ee7f336c2ab610f4370070def" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod fra04/analytics-js-proxy-td/envoy-proxy-85d65fb994-k9w6j vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 801dbfd99a584d74-FRA expires Tue, 05 Sep 2023 10:27:08 GMT
GET H2	200	collectedforms.js Show response js-eu1.hscollectedforms.net/	69 KB 25 KB	251ms 87ms	Script application/javascript	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-eu1.hscollectedforms.net/collectedforms.js Requested by Host: js-eu1.hs-scripts.com URL: https://js-eu1.hs-scripts.com/25755956.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 026c249acda71b64fe2510542d88ae26073694f89b595b1fd0e9f3ad501bf6b4 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.group-ib.com/ Origin https://www.group-ib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:08 GMT x-amz-version-id EcjZkyUfgxNGQ.xnv1Vqq9Oda2f1T.dE via 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED x-amz-cf-pop FRA56-P2 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 24eb763b-69c9-472d-a89a-59a23781a8ac content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.394/bundles/project.js&cfRay=801dbfd9da8f2bda-FRA x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 6 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 24eb763b-69c9-472d-a89a-59a23781a8ac last-modified Wed, 09 Aug 2023 09:05:38 UTC server cloudflare etag W/"6fb5b8aa66d730f2a49b41a9c712ffa7" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all x-hs-cache-status HIT cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-8ct2c cf-ray 801dbfd9da8f2bda-FRA x-amz-cf-id CwQ94YVzKlX7Wf4IOv57fLDmcGLzmv10RuDJ7gfyeXZw7JprFI6g8A== x-hs-target-asset collected-forms-embed-js/static-1.394/bundles/project.js
GET H2	200	main-logo.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	3 KB 2 KB	98ms 96ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/main-logo.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 589c9a6a159cf2ecc8555bc4457827f21002eaec9a24e3bc54401ed0b4d30ac8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 1527 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 30 Jan 2023 11:16:06 GMT server nginx etag "d82-5f379576be685-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	ti.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	113ms 110ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/ti.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f0e3a799744c0c67782742af2c13b85f769b58abd04800a04853d26f60cf7314 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 5919 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "171f-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id s2vCxKJqPeCZzTfx8AkZZYf48Ky1EhGD2Wi3u2_LZhkGaNTC72qY2w== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	asm.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	73ms 70ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/asm.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 997d49d316b533985208f14602a1ff15a76bf6a567afbb6b6980629ca8d78bab Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 5941 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1735-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id PanKcPmfhney4k-eewHxFjrmIVuKYBM7np0MGey3l9MCH-pngXBfaA== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	fp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	8 KB 8 KB	59ms 56ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/fp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 15534f98c260c3c3caaedf53335d912010b2de1731477a9fd4dbea89fb4995d9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 7844 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1ea4-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id xGD2mjopcb4zOKjcAZ05FItu_YQIbNykKhDuhVPrLA35rTkQhr2hzQ== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	drp.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	5 KB 6 KB	118ms 115ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/drp.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a300a894e169169882504968fae71958a87e0a4322e2aee1b6b0bbd63fd9621f Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 5398 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "1516-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id MRKLdVU0NRQ7l9RohWU8I8XsoxGvco_UMOM6FR7sUA8LXQwZhFse5Q== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	mxdr.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	102ms 99ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/mxdr.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2be8ce2b065360537771ed230d5d72cbd84758ec127ffa035e6d260ed14af5b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 6506 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "196a-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id o8WoE4m3pzwgHMeg8lzz1kbZ47SzcMwVjRQ9ohwJxsrXPurYWgQ0pw== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	bep.png website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/	6 KB 7 KB	101ms 98ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/main-nav/bep.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7574ba97d4ee7e81bd60873a52a31ff13359f246d0ac492ef2dabf96233a99e6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 6362 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 28 Jun 2022 07:55:26 GMT server nginx etag "18da-5e27d5c025780" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id mPcMCQXoiTzrPDdtFvC6JSccjdax6PsZA_tyJ7RSx9ViaVRIf3Yxrg== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	share-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	1 KB 619 B	99ms 97ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/share-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 3689e488f5478e26f0347353ad608ccd66e4d62992021c51d9db93f89d43c880 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 500 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "468-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	wb_sunny-black.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	724 B 470 B	99ms 96ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/wb_sunny-black.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash cc5dcea4d483d798630d7fe0846a1b784618aa3d4f86bdfa655083d81750322a Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 385 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Nov 2022 11:16:45 GMT server nginx etag "2d4-5ee0d4eb0feca-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	moon.svg www.group-ib.com/wp-content/themes/gib-theme/assets/images/	627 B 447 B	98ms 96ms	Image image/svg+xml	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.group-ib.com/wp-content/themes/gib-theme/assets/images/moon.svg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash dedf6c9294a8b9e4b13b1575641071e45c8e61235bd154d19103fd2893ccd708 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT strict-transport-security max-age=31536000; includeSubDomains content-length 361 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Thu, 24 Nov 2022 12:37:03 GMT server nginx etag "273-5ee36a9860213-gzip" vary Accept-Encoding x-frame-options sameorigin content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	zero-day-blog.webp website.cdn.group-ib.com/wp-content/uploads/	537 KB 538 KB	118ms 116ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/zero-day-blog.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bdf12ec840a34387693613f68d9c92c83777c5318d5d1ff7d0392930297ede69 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 549864 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 15 Aug 2023 07:54:45 GMT server nginx etag "863e8-602f17e0c7095" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id BRfz-1obJiFMNWJ4tng76cJYOnkMbao1fqctecaFNB5kzOr-7ZdNeA== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	polovinkin-1.png website.cdn.group-ib.com/wp-content/uploads/	49 KB 50 KB	158ms 156ms	Image image/png	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/polovinkin-1.png Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e2bc964baa3f3b79d9ef59a46164809bde86d6550a4de912535d056e514ae152 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 50537 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 14 Apr 2023 09:15:22 GMT server nginx etag "c569-5f94847e19d03" x-frame-options sameorigin content-type image/png access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id giLR9c0P5cVT8ACFl-qCcy-71-l964jXK3oIra2Q-CYLpySJufpkRQ== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	loyalty-small.webp website.cdn.group-ib.com/wp-content/uploads/	105 KB 106 KB	116ms 114ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/loyalty-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 2ce8f3f95a9f5296e5527036b6613cdc26b59329c358737044e1b45236e25c47 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 107134 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Fri, 01 Sep 2023 14:24:55 GMT server nginx etag "1a27e-6044cecb631a8" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id CxQHCm0hwG_Ui_PdTmOOR4h0ggsKIFByu8mIYXGC7pYmQyEAXfClKA== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	classiscam-2023-small.webp website.cdn.group-ib.com/wp-content/uploads/	140 KB 141 KB	61ms 60ms	Image image/webp	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/classiscam-2023-small.webp Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bc579c527ea4b2b1b236a2fcda61f0aa1523244e2af783e984d2055a7517cff8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 143148 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Mon, 28 Aug 2023 07:36:44 GMT server nginx etag "22f2c-603f6c19250d4" x-frame-options sameorigin content-type image/webp access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id 2vet1I2VJxOW26btY280UpVybfOpQ-exlBufahwFUmR8GcYB1Iz-Rw== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	hunting-rituals_red.jpg website.cdn.group-ib.com/wp-content/uploads/	127 KB 128 KB	99ms 98ms	Image image/jpeg	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/uploads/hunting-rituals_red.jpg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a8db2c5feaeae215fc02c7a068b7c1f624adf29f5344f1ed90e5eaac466f6517 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; date Tue, 05 Sep 2023 10:22:08 GMT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 129927 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Wed, 16 Aug 2023 12:43:11 GMT server nginx etag "1fb87-60309a367a354" x-frame-options sameorigin content-type image/jpeg access-control-allow-origin https://www.group-ib.com cache-control no-cache, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id RxyPyBlRemjvGOKbXPpT_0jzedq6RqXBVAXgEcGAJZRAQJf-WYtM9Q== expires Tue, 05 Sep 2023 10:22:07 GMT
GET H2	200	tag.js Show response mc.yandex.ru/metrika/	216 KB 74 KB	481ms 166ms	Script application/javascript	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.ru/metrika/tag.js Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/js/main.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 89b9bd95542140f302b4316f6f4484d053b412f8cb8abf9a5d4a70c30cca1916 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Mon, 04 Sep 2023 11:42:11 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f59863-12763" content-type application/javascript access-control-allow-origin * cache-control max-age=3600 timing-allow-origin * content-length 75619 expires Tue, 05 Sep 2023 11:22:09 GMT
POST		admin-ajax.php www.group-ib.com/wp-admin/	0 0
GET H/1.1	200 OK	counters.gif forms.hsforms.com/embed/v3/	35 B 1017 B	440ms 160ms	Image image/gif	2606:4700::6812:a07d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:09 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 568ee7ff-5615-42a2-aa3d-28a986bcea6f x-envoy-upstream-service-time 14 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 568ee7ff-5615-42a2-aa3d-28a986bcea6f Server cloudflare X-Trace 2B11B051EF6BED5FB7F82ACABFC841FC667CD8A530000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-7f89ffc67f-wcwld Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 801dbfdb3b135c68-FRA
GET H2	200	twitter-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	72ms 71ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ae9dad69229703dfa3b6d226c4c7d692e2f2809bf2475f22612824c2f7602efc Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 554 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "426-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Ll6S-_oyatBNkM7bCWAE_XwEMK_p3sKfludb9zA9wHk3hUjM_3_lQg== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	twitter-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 2 KB	91ms 90ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/twitter-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 294fdc878aa8c42b19edc18d385880ad886397846aca640c305f3eb53a965e13 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 742 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "8f2-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id tFs9gkYh8mUwapfbD4X0dGQj9mQ02S6Ier7cBdxilAzwrS3symAKGw== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	linkedin-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	919 B 1 KB	85ms 84ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f4991587d5312981e74087707ed399bd3820d83f773e7773c013ce00d6835f28 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 470 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "397-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id EZB7tdU60sQ4DyUvjWeTFTj79tQTrpGoTLHrIOEloCpxo8ozJ2BnZA== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	linkedin-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	2 KB 1 KB	96ms 95ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/linkedin-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c33709a20ca4cd516d65b07a79c1d75445892fcb6d8c6f3871a47ab38d85e075 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 639 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "7ca-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id uNjbD6vNFEaEkpE0x6Qx2YMAp_I0v0OTSBVBOGQFYpxz_B9Uvau8FQ== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	telegram-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 2 KB	86ms 85ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash cdc4d10b6b74ad79b55333b9882e854f054ee8b9953c6203dc46c68dc74eb0fb Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 787 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "5fc-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Tjv8oqjdkrNWgU4uhBGlDugUILvdmT46tc-Z01H-NXB0Bsxchq1GGw== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H2	200	telegram-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	3 KB 2 KB	95ms 94ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/telegram-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ac57c7130d61697977d2ed1796c27eefed8249083472716e474e5604b20636aa Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:08 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 949 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "bf1-5ee9716179e8a-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id cMjPF5ekblJZo8dd5MX4fSixbFI8gSsSjE0iikVxj-vOJSR8W-bRQw== expires Tue, 05 Sep 2023 10:52:08 GMT
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	147ms 65ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:09 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 801580e7-d758-44b6-80f0-a5bb92905453 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 801580e7-d758-44b6-80f0-a5bb92905453 Server cloudflare X-Trace 2B78D48A0D3C06592B43DCA8B97C342FF3F95C0815000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-ldcjz Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 801dbfdbdcb22bd7-FRA
GET H2	200	json Show response api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/	250 B 1 KB	165ms 63ms	XHR application/json	2a06:98c1:3200::90:3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-eu1.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=25755956 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc50d7c745b4b7ad268ab0c4a71b545dab230889a7f171a29e4a6534041f65bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 9d011b54-b602-40e8-9e37-d26ba97ee10a content-encoding br x-envoy-upstream-service-time 9 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 9d011b54-b602-40e8-9e37-d26ba97ee10a server cloudflare x-trace 2BF648CE8D85A41AFB505A30D3D7A2C1913DD5034A000000000000000000 vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false x-evy-trace-served-by-pod fra04/hubapi-td/envoy-proxy-74f74b4b68-gzk75 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3wWg%2FDEA9%2FIWM%2FrxpjJtBLMUbq2uS9eEE2eFANLKKvB%2FHMrPZkk8pLmd5e5dZHUAXkEp8Vrs6AkXdS4Ox1Rsd31gy6dDolube%2FvhaQ8Otk7SgOqq%2B5qog0on80a7HKvNGX%2BZGpmezneDUgOz6wJa0w%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 801dbfdcafc53732-FRA access-control-allow-headers *
GET H2	200	collect px.ads.linkedin.com/	0 447 B	273ms 185ms	Image application/javascript	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1693909329281&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: B5C5058F6F4447E9B40FCBEAD6A2D9AA Ref B: FRAEDGE2008 Ref C: 2023-09-05T10:22:09Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYEmf/dLQtAvMaliJzwZg==
GET H2	200	6si.min.js Show response j.6sc.co/	51 KB 15 KB	231ms 50ms	Script application/javascript	95.100.146.27 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.146.27 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-146-27.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 24 Aug 2023 22:29:49 GMT server nginx/1.14.0 (Ubuntu) etag "64e7d9dd-cc38" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14993 expires Tue, 05 Sep 2023 10:22:09 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/	3 KB 2 KB	173ms 83ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10897073384/?random=1693909329296&cv=11&fst=1693909329296&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&auid=488092515.1693909329&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash bffd1ecf3471b0716b9c8c6bda2d3af204af125befdc54849a628f4b2d81beb6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1423 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	NeverBounce.js Show response cdn.neverbounce.com/widget/dist/	96 KB 29 KB	162ms 45ms	Script application/javascript	13.225.78.65 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.neverbounce.com/widget/dist/NeverBounce.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.78.65 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-65.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Mon, 04 Sep 2023 21:13:10 GMT content-encoding gzip via 1.1 590590f04f79f692591f9db0e720a31c.cloudfront.net (CloudFront) last-modified Mon, 02 Mar 2020 18:37:33 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 age 47340 etag W/"c1e06621030dfcba15b88abbcaa546eb" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id E7ErLCG45gETcFKtn78OYMwrntKde4kMFO8XUeM63SGp4uqmqKnByw==
GET H2	200	63e267f61a03d71ea3df5fe7 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	301ms 194ms	Script text/javascript	2606:4700::6810:880f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/63e267f61a03d71ea3df5fe7 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash c853b73fea242aba034b5f869885a4c1bf9730e6411f0129e5008e4cabdfc5d2 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 801dbfdcfcba9a1b-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	193 KB 52 KB	125ms 41ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 05 Sep 2023 10:22:09 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 52127 x-xss-protection 0 pragma public x-fb-debug VN3ldWkNINZt1FpLws1CGw1nyhx+vNm6QTjgIEQBhWSSaZQYSIHb+2I6EjXbUKepEQfjp6GxI7V0QyAnDZ6PVg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	282 KB 92 KB	57ms 56ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QMES53K3Y2&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 437248e219ea36bcf1f65363078ed496cfc5cf762320c863eefaf929834e7f6e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 93855 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 05 Sep 2023 10:22:09 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2 https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4496601%26time%3D1693909329304%26url%3Dhttps%253A%252F%252Fwww.group-ib.com%252Fb... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_...	0 266 B	270ms 181ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJvvG1e-YaKBgAAAYpk3Sg1Us2FluqWJk_I0lcwj0v5Y6bGAZ8jCn-YGVSAdD8-DJd0vXg Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 50447A6A8D8847C4976704CD748DF055 Ref B: DUS30EDGE0916 Ref C: 2023-09-05T10:22:10Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYEmf/pHqBLBcUiXdTUuQ== Redirect headers date Tue, 05 Sep 2023 10:22:09 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: D8BF3E29ECFD42EA91547870C3E21223 Ref B: FRAEDGE2008 Ref C: 2023-09-05T10:22:09Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4496601&time=1693909329304&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQJvvG1e-YaKBgAAAYpk3Sg1Us2FluqWJk_I0lcwj0v5Y6bGAZ8jCn-YGVSAdD8-DJd0vXg x-li-proto http/2 content-length 0 x-li-uuid AAYEmf/k44CazHYWELpwZg==
GET H2	200	json Show response forms-eu1.hscollectedforms.net/collected-forms/v1/config/	116 B 458 B	89ms 56ms	XHR application/json	172.65.192.122 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=25755956&utk= Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f22362329b9705cf8629061fb5b1d1a38f1cc2bc9fd46728f73e5cd9eb77cf Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 6a6b5b3f-bffd-4192-b1d6-fd8ce7c0825f x-envoy-upstream-service-time 8 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 6a6b5b3f-bffd-4192-b1d6-fd8ce7c0825f server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.group-ib.com x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod fra04/app-td/envoy-proxy-5b45bc9bc5-w8lzh access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 801dbfdc8e042bda-FRA
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	366ms 65ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=4 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:09 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id cfe2efbe-8395-4d54-bb22-a1f8b0ff39e8 x-envoy-upstream-service-time 3 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cfe2efbe-8395-4d54-bb22-a1f8b0ff39e8 Server cloudflare X-Trace 2B205164D5ED9F0EA39CE5F9B55C095AB069E3ED37000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-nv9kd Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 801dbfdee95b2bd7-FRA
POST H2	204	collect region1.analytics.google.com/g/	0 255 B	135ms 46ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-QMES53K3Y2&gtm=45je38u0&_p=50536913&_gaz=1&cid=668226375.1693909329&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&sid=1693909329&sct=1&seg=0&dr=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&dt=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	333ms 48ms	Ping text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QMES53K3Y2&cid=668226375.1693909329&gtm=45je38u0&aip=1 Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.group-ib.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	152ms 64ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QMES53K3Y2&cid=668226375.1693909329&gtm=45je38u0&aip=1&z=1266039775 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	220 KB 76 KB	58ms 57ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Requested by Host: js-eu1.hsadspixel.net URL: https://js-eu1.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a071a5cb642bd446b9832db322d6c445acc6cf41b54938623271fd6764f4e281 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78231 x-xss-protection 0 last-modified Tue, 05 Sep 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 05 Sep 2023 10:22:09 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	220 KB 77 KB	57ms 56ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10882981508&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW7265 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d7b5e803b917b8b54037ecaa8ec86143d6b90a60453ae00a377bc32a7ef4af29 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 78300 x-xss-protection 0 last-modified Tue, 05 Sep 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 05 Sep 2023 10:22:09 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 989 B	95ms 95ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=32773c20-4b3c-11ee-949e-124106a1e004&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=qBJoaMRzM0RUyWfYQ%2FNMHNDw0mpbMigapZ7RxIfbchcNLjg%2BpIWH7DOtm6NbcwzpEomcamMcyOZJVWEQz4tiTZDhxWeYRKKjg3X2DSDuIKu3wIZnmuiVflTTepv7gcoG2w4dkIhY82C2VeBUEXGsy%2BwEQGCG7avloXZR Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 7918f521cce8716cebfa3f329438806901feb35680fca54a1207561e4d8b1838 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 i8EPkYRHYawHQ/LE1EHJcORYWsC9pJqBXqr9PSA6h7nblOQKJc97G9pd+OcZOxTkxPoq2usbGFiBn3unjxcOZi5ZY9aCSq5T36DqnKuBZJ+8FRwUiwt9HQpE2c0840/Q437xSPkrRYSA4yuvuxkVu9O67I4IzuEjxcWnaTuIvoRnNHktRJ/t1QCo2Tm54NBi61LWFznRKBAOsfd6j93nRkXGMFZISRDR/TwTYeYuhGzHzukPuH/9IQtbgdAqMA== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 LMVb2fd425ac53d0bebc0c06fff23dec48aa350e Content-Type text/plain;charset=UTF-8 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	sync_cookie_image_decide mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10117.Pb7FcNl4G_NKGNGvjNDk6lpCvZ0UxR2DaMnxpcLPVs9B1CP9Veeylr4nlTDBdwvD.IwKvUyq3J5jY1WKnu5JCOOiyUvE%2C https://mc.yandex.com/sync_cookie_image_decide?token=10117.pk1PmnIRXk0wweOTQdLgI1uH-_V5whTfi_Vr2uszriUEFImcG61MeJnkOfI3-RDwGXRDiKvjTcoMw-Wh5sW1lFHBp1_6aCqoiLus37owob0%2C.Ro6fFcuh3RBGFrOt3i5B7HocFpQ%2C	43 B 67 B	84ms 84ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide?token=10117.pk1PmnIRXk0wweOTQdLgI1uH-_V5whTfi_Vr2uszriUEFImcG61MeJnkOfI3-RDwGXRDiKvjTcoMw-Wh5sW1lFHBp1_6aCqoiLus37owob0%2C.Ro6fFcuh3RBGFrOt3i5B7HocFpQ%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide?token=10117.pk1PmnIRXk0wweOTQdLgI1uH-_V5whTfi_Vr2uszriUEFImcG61MeJnkOfI3-RDwGXRDiKvjTcoMw-Wh5sW1lFHBp1_6aCqoiLus37owob0%2C.Ro6fFcuh3RBGFrOt3i5B7HocFpQ%2C date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
GET H2	200	advert.gif mc.yandex.com/metrika/	43 B 114 B	85ms 84ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/metrika/advert.gif Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000 last-modified Mon, 04 Sep 2023 11:42:11 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA etag "64f59863-2b" content-type image/gif access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 43 expires Tue, 05 Sep 2023 11:22:09 GMT
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	396ms 131ms	Script application/javascript	18.214.123.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_961634 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.214.123.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-214-123-46.compute-1.amazonaws.com Software nginx / Resource Hash 25c384950cbb18c38ba7e06ff94b4051b7b2b7203df533a81fed346f3b6d1754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	370ms 128ms	Script application/javascript	18.214.123.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_363131 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.214.123.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-214-123-46.compute-1.amazonaws.com Software nginx / Resource Hash 763109289d0ea3ebbd933f37a0b330fa1636507c65799d412e4a99f8a485d680 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	63 B 282 B	373ms 146ms	Script application/javascript	18.214.123.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_990261 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.214.123.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-214-123-46.compute-1.amazonaws.com Software nginx / Resource Hash d80c5ea7c6886fba9c04485e61c6024b1ea6d6c6ef632f3d7c5d3ff1af19f503 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	notify Show response api.neverbounce.com/v4/poe/	62 B 282 B	320ms 127ms	Script application/javascript	18.214.123.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.neverbounce.com/v4/poe/notify?key=public_feedec8c69cd171b06421bb96273f04d&event=form.load&callback=__neverbounce_794948 Requested by Host: cdn.neverbounce.com URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.214.123.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-214-123-46.compute-1.amazonaws.com Software nginx / Resource Hash e6eddf4b7b033ea0dd5c0a840c8012c489b012d3a6fd652efb457b235ca3b62e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains server nginx vary Accept-Encoding content-type application/javascript cache-control no-cache, private x-ua-compatible IE=Edge
GET H2	200	/ www.google.com/pagead/1p-user-list/10897073384/	42 B 455 B	201ms 52ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10897073384/?random=1693909329296&cv=11&fst=1693908000000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2133289255&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10897073384/	42 B 154 B	51ms 51ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10897073384/?random=1693909329296&cv=11&fst=1693908000000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&fmt=3&is_vtc=1&random=2133289255&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	649324202964935 Show response connect.facebook.net/signals/config/	150 KB 38 KB	260ms 259ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/649324202964935?v=2.9.125&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 336ce80ea4878c79e81d9f257da6fd112f16f4dcabdbbba8e1a02274456fcaf4 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 05 Sep 2023 10:22:09 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug K+s/3bpiK5lt4Lb/gtoUixuQkXilSbgUmhSG8ZAJ7g1LF+W0n3qPD6+tngC6/T92W4ZG0m6ihHftDTEv1IX4WA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	56ms 47ms	XHR text/html	95.100.146.27 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.146.27 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-146-27.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.group-ib.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 309 B	202ms 40ms	XHR text/html	2a02:26f0:480:23::1726:62a7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:62a7 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 2ad83efd3b3987100da97f634d1cf0f23ba332b8ecb510a2af3883d224272216 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT vary Origin content-type text/html access-control-allow-origin https://www.group-ib.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::4 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693909329685_388391911_211523081_26_791_38_96_219";dur=1 content-length 19 expires Tue, 05 Sep 2023 10:22:09 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	309ms 299ms	Image image/gif	95.100.146.27 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=01ba33ae-f833-4c90-89f2-95a4414e5c85&session=1386a354-0bfd-49d0-8dc8-8a3c432d0651&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2005%20Sep%202023%2010%3A22%3A09%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2005%20Sep%202023%2010%3A22%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22e84d9c08a990af8592952e7ac9a983ad%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2005%20Sep%202023%2010%3A22%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2005%20Sep%202023%2010%3A22%3A09%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=0dce8002-f945-48d7-8776-e8e4bb8de5e0&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.146.27 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-146-27.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:09 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/	3 KB 2 KB	100ms 99ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10882981508/?random=1693909329644&cv=11&fst=1693909329644&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&hn=www.googleadservices.com&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=488092515.1693909329&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-10882981508 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c1c049d7ed795a5dbc7b34d0591784c418e7db046be402c24196ab8beda4f1be Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1438 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	1 Show response mc.yandex.com/watch/26812653/ Redirect Chain https://mc.yandex.com/watch/26812653?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A... https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%...	435 B 796 B	80ms 80ms	XHR application/json	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afp%3A1027%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A0%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A471303283%3Arqn%3A1%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C67%2C40%2C402%2C0%2C%2C726%2C29%2C%2C%2C%2C1269%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 70ed03580ef2c95332ec701d9eb3891601e0c18651f4c98a32987e213e320bdb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff last-modified Tue, 05-Sep-2023 10:22:09 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 435 x-xss-protection 1; mode=block expires Tue, 05-Sep-2023 10:22:09 GMT Redirect headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT strict-transport-security max-age=31536000 last-modified Tue, 05-Sep-2023 10:22:09 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA location /watch/26812653/1?wmode=7&page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&site-info=%7B%22shareVersion%22%3A2%2C%22strategy%22%3A%22d%2Fn%2Fq%2Fr%2Fs%2Ft%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afp%3A1027%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A0%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A471303283%3Arqn%3A1%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C67%2C40%2C402%2C0%2C%2C726%2C29%2C%2C%2C%2C1269%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330%3At%3ATraders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1 access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true x-xss-protection 1; mode=block expires Tue, 05-Sep-2023 10:22:09 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10882981508/	42 B 108 B	51ms 51ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10882981508/?random=1693909329644&cv=11&fst=1693908000000&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=404438712&rmt_tld=0&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10882981508/	42 B 108 B	55ms 54ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10882981508/?random=1693909329644&cv=11&fst=1693908000000&bg=ffffff&guid=ON&async=1&gtm=45be38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&ref=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&frm=0&tiba=Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=404438712&rmt_tld=1&ipr=y Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:09 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	286ms 286ms	Image image/gif	95.100.146.27 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=01ba33ae-f833-4c90-89f2-95a4414e5c85&session=1386a354-0bfd-49d0-8dc8-8a3c432d0651&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=0dce8002-f945-48d7-8776-e8e4bb8de5e0&v=1.1.6 Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.146.27 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-146-27.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	119ms 39ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=649324202964935&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&if=false&ts=1693909329876&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693909329874.1742634907&cs_est=true&it=1693909329589&coo=false&rqm=GET Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Tue, 05 Sep 2023 10:22:09 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	sync_cookie_image_decide_secondary mc.yandex.com/ Redirect Chain https://mc.yandex.com/sync_cookie_image_check_secondary https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10117.d0TZd-5G2jJV-AbVbXMFPrWHkCbPOQtpyjtXZ-y9ZMcrdDUYKOoPMkGPU2IXpEPA.XuDrJQ5RTtgYzE6YWNJ1Go0bHjc%2C https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10117.7pmZlX1ACKlnK-pOq1FWpynijTdp5s9B8adxrAgWF2jSRCV-BIq1EDgafoaLFG1QyiecLxmlBqDiMeHf7I1yFcUPEZiOxV3iZWvam5GWoAQ%2C.jdHFqrnXQHyGBT1VS...	43 B 79 B	81ms 81ms	Image image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Show image Full URL https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10117.7pmZlX1ACKlnK-pOq1FWpynijTdp5s9B8adxrAgWF2jSRCV-BIq1EDgafoaLFG1QyiecLxmlBqDiMeHf7I1yFcUPEZiOxV3iZWvam5GWoAQ%2C.jdHFqrnXQHyGBT1VSSicyTs1ebI%2C Requested by Host: www.group-ib.com URL: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ Protocol H2 Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000 content-length 43 x-xss-protection 1; mode=block content-type image/gif Redirect headers location https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10117.7pmZlX1ACKlnK-pOq1FWpynijTdp5s9B8adxrAgWF2jSRCV-BIq1EDgafoaLFG1QyiecLxmlBqDiMeHf7I1yFcUPEZiOxV3iZWvam5GWoAQ%2C.jdHFqrnXQHyGBT1VSSicyTs1ebI%2C date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000 x-xss-protection 1; mode=block
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 122 B	82ms 82ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1693909329_6f7750ce9106068a4a90872864f2004f2d7e7123e6fadc0f4f8feafca91a46ab&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A1%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A54391357%3Arqn%3A2%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(2)lt(37000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000 last-modified Tue, 05-Sep-2023 10:22:10 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Tue, 05-Sep-2023 10:22:10 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	89ms 89ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1693909329_6f7750ce9106068a4a90872864f2004f2d7e7123e6fadc0f4f8feafca91a46ab&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A1%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A683450615%3Arqn%3A3%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(3)lt(37000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000 last-modified Tue, 05-Sep-2023 10:22:10 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Tue, 05-Sep-2023 10:22:10 GMT
POST H2	200	1 Show response mc.yandex.com/watch/26812653/	43 B 74 B	84ms 83ms	XHR image/gif	2a02:6b8::1:119 GLOBAL_DC
General Check archive.org Show headers Download Go to Full URL https://mc.yandex.com/watch/26812653/1?page-url=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&charset=utf-8&hittoken=1693909329_6f7750ce9106068a4a90872864f2004f2d7e7123e6fadc0f4f8feafca91a46ab&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7h8dgiykw9gn99c48ikk4wv%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1101%3Acn%3A1%3Adp%3A1%3Als%3A146169500586%3Ahid%3A953898117%3Az%3A120%3Ai%3A20230905122209%3Aet%3A1693909330%3Ac%3A1%3Arn%3A906334679%3Arqn%3A4%3Au%3A169390933069970599%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1693909327566%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1693909330&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(4)lt(37000)aw(1)ti(2) Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Xss-Protection 1; mode=block Request headers Referer https://www.group-ib.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000 last-modified Tue, 05-Sep-2023 10:22:10 GMT accept-ch Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA content-type image/gif access-control-allow-origin https://www.group-ib.com cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true content-length 43 x-xss-protection 1; mode=block expires Tue, 05-Sep-2023 10:22:10 GMT
GET H3	200	709834390277869 Show response connect.facebook.net/signals/config/	148 KB 38 KB	113ms 113ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/709834390277869?v=2.9.125&r=stable&domain=www.group-ib.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 179b21209116a88d744e53998740ad6d4d69f8ad0389f910b1603dd69d2e1233 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 05 Sep 2023 10:22:10 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug ONWdHY6CLsvBceQgvbptREJshAN8wPI2dSKnw1HtEVt5MSzSOc3TU9h0xjGG1FetJCuzuDeZVzT/QWDr7JojUA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	408ms 74ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330343&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0f03cf8f-cfcf-4594-a4af-91233efa4660 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0f03cf8f-cfcf-4594-a4af-91233efa4660 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qLrk8xvPHJNm46cGzGsg7eJP8%2FG6s7yduO0ZU6zdWU%2BuA30kYQ9fj45aLuM%2FoGXytRibvXYyrzJsGzi%2BA%2BG4ak2OVfCRtzW0e88CB315IFH9RmJJpuAx1OI94z9snKrjabiaNQqtmA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-q78v7 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee4d1da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	392ms 81ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=b3aba748-584e-4230-ae9c-75156e354c9b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330345&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 37038edc-6b7b-4ea6-ae53-59de4d514b84 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 37038edc-6b7b-4ea6-ae53-59de4d514b84 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7r24UpwfixuFhYWyVGsjLvWV5FxWrSer4zIkEG5ztsZcISQBZ9TJQpX%2BuHGaBOL5dOVg6JDegnmtPR2klVih%2BF63jjxoKRNRPTKnQQZSwZBLnKn1eUFS8eIfBykwETPiuHqfz3TwDg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-q78v7 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee4f1da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 634 B	407ms 96ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=044e7558-8073-478a-ad3c-5807dd76840f&fci=b3aba748-584e-4230-ae9c-75156e354c9b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330345&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id a47a0648-4197-4a6c-84b6-52db68129bcb p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 5 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a47a0648-4197-4a6c-84b6-52db68129bcb last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D6M84UxRCLzVCKcW6OirkjTg3kjlXbx60hvpdpyJeNa2mdNHwQNnNw5QkoPyE%2FXfGlbQH0qCXfRGgNFiaDCPYWW%2FPLBs8rHzhzEvcGt3pEN12xEHMB9m5B%2FQ1sjwLis7kY51KC648Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-669bv x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee501da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 630 B	391ms 80ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=ec38d27e-90f7-4974-85d4-6f71a1fe66f6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330346&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4c40fa83-48b2-4a28-85ee-67926dd7b997 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4c40fa83-48b2-4a28-85ee-67926dd7b997 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C6%2Bnb2aRrBtWlYf5fIq35JMMDTu2hNa8EHRcSiRxgwf9A8u4KL7hCSwIyD3%2FUEvoS8dWc8O9N21bXBS9WcNmPRFS%2BprOYj2BvLKNhw97Nw4z6YpUC3OCrBCtEwHLdyimgaN4EB0cuQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-2ds5g x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee541da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 1 KB	382ms 71ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=4dbceae1-75ae-423a-9c12-dee8f1ca3345&fci=ec38d27e-90f7-4974-85d4-6f71a1fe66f6&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330347&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id fcbc9878-f4d0-4d02-a140-74990b339b53 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 3 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id fcbc9878-f4d0-4d02-a140-74990b339b53 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=esCFBbzUw2Ahzk5Ao7U7hyFXxpVo%2FiYFeaO4os3ZJQK7ueao4rBYyTbcOqlv4YApIyM2r0wFQLDl8FPFx1YyVZtbjUnodNTepQZ5t58bN4oVY38NoL0M%2BQrID9idHJB7AdfEWHsrRQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-vl9zn x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee561da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 636 B	388ms 83ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=43dd9aaf-3fe9-4849-a2e9-47af898020a1&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330348&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0130a2fa-1b26-4ead-8dd4-911770ee501a p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 8 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0130a2fa-1b26-4ead-8dd4-911770ee501a last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZjSGtCUk6LcD%2FaOMu%2BFdoE3FonKmyDOU4aIoxmx8dH08QaaJYq8dZmBZd4aP6FOli3ICW%2BbgO4%2BHkgFq2URRGJ8iwa5fv5BEyQSHE%2FBl5%2FY2zDSSdKWjasv25Uq8PVCEh5TWvJQZqA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-pldpr x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe4ee581da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 439 B	72ms 70ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=55a22738-d5a5-43f9-9c1c-fa4c1a6eb349&fci=43dd9aaf-3fe9-4849-a2e9-47af898020a1&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330349&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4b455eab-829c-4395-bb2c-5b7a2ec4cda8 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4b455eab-829c-4395-bb2c-5b7a2ec4cda8 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cFzRwrRL279YHs7IUEN%2BVTRtO4ltvCK78k%2B8OpQXicJTivTcptEy2gY%2B4uq39z3uRm3KHQLbqk9Vk%2Be1vpoYjbJ23QvEqYI4joUx%2Fspjc0JWP48AOGBDQq85VCm%2Bq8V0WufMbVjT3A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-pldpr x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe55f141da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 453 B	70ms 67ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=4ac1c39f-c1f9-405c-8474-dd2ba8201ad2&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330352&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 70601e44-4540-4667-bfd7-48160f2c2a00 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 70601e44-4540-4667-bfd7-48160f2c2a00 last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SiLiNm1A7LUeVGk5Ze6lvbmu6z8mMz6DNY91VS0dtKJZUUU%2BwjFVSCjvYVwaRmuqOIc3JXaWToiirq9PozZYqTURgfjSIL5ywA5AnluplsJbMiK4SY%2Fs9ihkwIJ18MIePL88uRROHw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-669bv x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe56f1c1da0-FRA x-robots-tag none
GET H2	200	__ptq.gif track-eu1.hubspot.com/	45 B 819 B	69ms 67ms	Image image/gif	172.65.240.166
General Check archive.org Show headers Download Go to Show image Full URL https://track-eu1.hubspot.com/__ptq.gif?k=17&fi=eb903dab-0ef3-43b5-bdeb-71372e6ad0f0&fci=4ac1c39f-c1f9-405c-8474-dd2ba8201ad2&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1966805734&v=1.1&a=25755956&rcu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pu=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&t=Traders%27+dollars+in+danger%3A+CVE-2023-38831+zero-day+vulnerability+in+WinRAR+exploited+by+cybercriminals+to+target+traders+%7C+Group-IB+Blog&cts=1693909330353&vi=6e6cffb988d5fc253b72e4f77213b550&nc=true&u=84897990.6e6cffb988d5fc253b72e4f77213b550.1693909330340.1693909330340.1693909330340.1&b=84897990.1.1693909330340&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.65.240.166 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 027de30c-f8e2-47c1-8282-50b71d746f7a p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 2 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 027de30c-f8e2-47c1-8282-50b71d746f7a last-modified Tue, 05 Sep 2023 10:22:10 GMT server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FmzeHaFh%2F583QecVEw%2FQwd9wrc1v2%2B0aDXIbFSs6%2BGm2s6WAw6vvn%2B4a1sCkkR8ggfGdhMqPyMJ3h4PGcWny1%2B%2FureB7%2B1K7Jrkz2m5t6SG%2BzlW8gd1UBDZ%2BK6aLb5skvkHV8hvtQg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod fra04/analytics-tracking-td/envoy-proxy-9dffd6dd-2ds5g x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false accept-ranges bytes cf-ray 801dbfe56f1e1da0-FRA x-robots-tag none
GET H2	200	facebook-64.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	627 B 1 KB	53ms 52ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-64.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f006e8bbfa4f0537780571436b5bed50ff10ff28759924c53b67732ec5af28ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:10 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 376 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "273-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id vNWRpxDYONX6XNNBXvsRS4d0VkD5HTlHJzoDrgY7sBCL-oNtPOZ6XQ== expires Tue, 05 Sep 2023 10:52:10 GMT
GET H2	200	facebook-lbg.svg website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/	1 KB 1 KB	51ms 51ms	Image image/svg+xml	2600:9000:2490:9600:9:7af6:1700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/images/socials/facebook-lbg.svg Requested by Host: website.cdn.group-ib.com URL: https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:9600:9:7af6:1700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1e0e607b314623cf3e5ba71869ca47d1549556369988daa5e8a1bf56559c2973 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://website.cdn.group-ib.com/wp-content/themes/gib-theme/assets/css/single-blog-post.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers content-security-policy frame-ancestors 'self'; content-encoding gzip x-content-type-options nosniff date Tue, 05 Sep 2023 10:22:10 GMT via 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P6 x-cache Miss from cloudfront content-length 522 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin last-modified Tue, 29 Nov 2022 07:39:21 GMT server nginx etag "4f0-5ee9716178eea-gzip" x-frame-options sameorigin vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://www.group-ib.com cache-control max-age=1800, private, max-age=3600 permissions-policy accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),sync-xhr=(),usb=(),xr-spatial-tracking=() accept-ranges bytes x-amz-cf-id Sozo1Vq9QRi5U00MkqGEQkYa4BLFep-84BW874aqcMVTBNnEqrbKtQ== expires Tue, 05 Sep 2023 10:52:10 GMT
POST H2	200	fl Show response www.group-ib.com/api/	665 B 777 B	94ms 93ms	XHR application/json	3.72.181.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.group-ib.com/api/fl?u=32773c20-4b3c-11ee-949e-124106a1e004&cfidsgib-w-61354c22-16cc-40a8-a871-6901f1a76e24=OyCl8jSltt8ziapvX7Dl0cJ6V%2Ft6t0oV97aONzkmJSpB2nteD99RBZjA4B%2BrjSFhkMORaHCZWnp8%2FoEVGoqxK3l%2BYhpGoykzi5bG2H9r9NldVYYoKjshyR9qfkRlRMnM%2FX1C%2FMs%2FBqA%2BGDgLV9wuwcRwTV57fp9t9pAw Requested by Host: fhp-de-js.group-ib.com URL: https://fhp-de-js.group-ib.com/d/bt-autoinject.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.72.181.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-72-181-255.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 9f95d7befa962831de64ca58e6e2bbbed2a3efcca0ed3a1eccff869ba1b87802 Request headers X-GIB-GSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 JnzyoQqWNWk+4VmjeNNJMs38q5dFpGhjGmInFVfkygwgi6eDfPQXxA+3H1HkwScQgzmupV5MVSq5qeJ0Rf3jc/IV2CugKghrcDPHA7SGNV2gzCdw06PUbVj/H7HN0F+6XHI5A60MX4vuqKa5Th2+fKz85Z9hugxP/MrNGdj1ZOquicDm3XVLxqhHKvZK7InLcsFHdRvw2yzFhUL5j2Jv/QbPhDH9HtujrmDywiX2xBhOmXRr0r0HbK0tOxUxxA== Referer https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 X-GIB-FGSSCgib-w-61354c22-16cc-40a8-a871-6901f1a76e24 wPdAaa1b7171f47cff83cbf9ed8c1ecc6dc2dee9 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 05 Sep 2023 10:22:10 GMT content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.group-ib.com cache-control no-store access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers Accept,DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Origin,ETag,If-None-Match,X-Cfids,Authorization
GET H2	200	/ www.facebook.com/tr/	0 54 B	39ms 39ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=709834390277869&ev=PageView&dl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&rl=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&if=false&ts=1693909330471&sw=1600&sh=1200&ud[external_id]=6e6cffb988d5fc253b72e4f77213b550&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693909329874.1742634907&cs_est=true&it=1693909329589&coo=false&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Tue, 05 Sep 2023 10:22:10 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H/1.1	200 OK	counters.gif forms-eu1.hsforms.com/embed/v3/	35 B 1016 B	368ms 67ms	Image image/gif	172.65.232.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 10:22:10 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 085f5764-2d77-4c04-a3cb-a40af5f7c1bd x-envoy-upstream-service-time 7 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 085f5764-2d77-4c04-a3cb-a40af5f7c1bd Server cloudflare X-Trace 2BBBF0B0D3510DEA7FFA0EA9B0A964CDEBAC117771000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod fra04/star-hubspot-td/envoy-proxy-79bb87d888-6mshh Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 801dbfe58b332bd7-FRA
POST H3	200	/ Show response www.facebook.com/tr/ Frame CA9B	0 18 B	40ms 39ms	Document text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Tue, 05 Sep 2023 10:22:10 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	268ms 267ms	Image image/gif	95.100.146.27 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=e84d9c08a990af8592952e7ac9a983ad&svisitor=null&visitor=01ba33ae-f833-4c90-89f2-95a4414e5c85&session=1386a354-0bfd-49d0-8dc8-8a3c432d0651&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2005%20Sep%202023%2010%3A22%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2005%20Sep%202023%2010%3A22%3A09%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Spoof%20extensions%20help%20cybercriminals%20target%20users%20on%20trading%20forums%20as%20130%20devices%20still%20infected%20at%20time%20of%20writing%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Traders%27%20dollars%20in%20danger%3A%20CVE-2023-38831%20zero-day%20vulnerability%20in%20WinRAR%20exploited%20by%20cybercriminals%20to%20target%20traders%20%7C%20Group-IB%20Blog%22%7D&cb=&r=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.group-ib.com%2Fblog%2Fcve-2023-38831-winrar-zero-day%2F&pageViewId=0dce8002-f945-48d7-8776-e8e4bb8de5e0&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.146.27 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-146-27.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.group-ib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 10:22:10 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET		counters.gif forms-eu1.hsforms.com/embed/v3/	0 0
POST H3	200	/ Show response www.facebook.com/tr/ Frame 298C	0 15 B	39ms 39ms	Document text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.group-ib.com Referer https://www.group-ib.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.group-ib.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Tue, 05 Sep 2023 10:22:10 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.group-ib.com

URL

https://www.group-ib.com/wp-admin/admin-ajax.php

Domain

forms-eu1.hsforms.com

URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1