www.recordedfuture.com Open in urlscan Pro
104.18.35.90 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Submission: On September 18 via api (September 18th 2024, 2:14:16 am UTC) from TR — Scanned from US

Summary HTTP 106 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 34 IPs in 3 countries across 24 domains to perform 106 HTTP transactions. The main IP is 104.18.35.90, located in and belongs to CLOUDFLARENET, US. The main domain is www.recordedfuture.com. The Cisco Umbrella rank of the primary domain is 315744.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 7th 2024. Valid for: a year.

This is the only time www.recordedfuture.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	104.18.35.90 104.18.35.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.2.216 151.101.2.216	54113 (FASTLY) (FASTLY)
8	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2607:f8b0:400... 2607:f8b0:4006:81e::2008	15169 (GOOGLE) (GOOGLE)
11	23.196.3.196 23.196.3.196	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
1	2600:141b:1c0... 2600:141b:1c00:6::17df:d105	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80d::200a	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:24f... 2600:9000:24f0:2400:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:89d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:817::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c06::9d	15169 (GOOGLE) (GOOGLE)
1	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
4 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	18.157.122.248 18.157.122.248	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:8b11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9310	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2607:f8b0:400... 2607:f8b0:4006:821::2004	15169 (GOOGLE) (GOOGLE)
1	68.67.161.208 68.67.161.208	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48d1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.248.142.121 13.248.142.121	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6813:afbc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2c40::c7... 2606:2c40::c73c:6702	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
106	34

38 104.18.35.90 (None, )

ASN13335 (CLOUDFLARENET, US)

www.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.2.216 (San Francisco, United States)

ASN54113 (FASTLY, US)

cms.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:81e::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 23.196.3.196 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-196-3-196.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:6::17df:d105 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2008 (United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:24f0:2400:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::2002 (United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:817::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::9d (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.157.122.248 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:8b11 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9310 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.161.208 (Colonia, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48d1 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.142.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:afbc (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2c40::c73c:6702 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	recordedfuture.com www.recordedfuture.com — Cisco Umbrella Rank: 315744 cms.recordedfuture.com — Cisco Umbrella Rank: 561736 go.recordedfuture.com — Cisco Umbrella Rank: 502694	1 MB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 5691 c.6sc.co — Cisco Umbrella Rank: 7155 ipv6.6sc.co — Cisco Umbrella Rank: 5832 b.6sc.co — Cisco Umbrella Rank: 3516	24 KB
8	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2968	156 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 327 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6795	4 KB
5	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 3569 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3636 track.hubspot.com — Cisco Umbrella Rank: 2372 forms.hubspot.com — Cisco Umbrella Rank: 5885	29 KB
4	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 td.doubleclick.net — Cisco Umbrella Rank: 189 stats.g.doubleclick.net — Cisco Umbrella Rank: 130	3 KB
4	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 16968 recordedfuture.matomo.cloud — Cisco Umbrella Rank: 513287	130 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	306 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8883	726 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	3 KB
2	google.com analytics.google.com — Cisco Umbrella Rank: 140 www.google.com — Cisco Umbrella Rank: 3	64 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	73 KB
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 905	17 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 3818	927 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 479	706 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2209	25 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2182	19 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 5629	92 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 932	393 B
1	t.co t.co — Cisco Umbrella Rank: 834	628 B
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2478	1 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 407	31 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 782	14 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 875	15 KB
106	24

	Domain	Requested by
38	www.recordedfuture.com	www.recordedfuture.com
8	b.6sc.co
8	dev.visualwebsiteoptimizer.com	www.recordedfuture.com
6	cms.recordedfuture.com	www.recordedfuture.com
5	px.ads.linkedin.com	3 redirects snap.licdn.com
3	www.googletagmanager.com	www.recordedfuture.com www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	track.hubspot.com
2	www.facebook.com
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	td.doubleclick.net	www.googletagmanager.com
2	cdn.matomo.cloud	www.recordedfuture.com
2	connect.facebook.net	www.recordedfuture.com connect.facebook.net
2	ssl.google-analytics.com	www.recordedfuture.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
1	go.recordedfuture.com
1	forms.hubspot.com	js.hsleadflows.net
1	perf-na1.hsforms.com
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	www.google.com
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	analytics.twitter.com
1	t.co
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	ajax.googleapis.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
106	38

This site contains links to these domains. Also see Links.

Domain
app.recordedfuture.com
go.recordedfuture.com
therecord.media
www.youtube.com
www.facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
*.recordedfuture.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-07` - `2025-03-08`	a year	crt.sh
cms.recordedfuture.com R11	`2024-09-10` - `2024-12-09`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
6sc.co R11	`2024-07-03` - `2024-10-01`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
upload.video.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-28` - `2024-09-26`	3 months	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M03	`2023-10-27` - `2024-11-23`	a year	crt.sh
hs-scripts.com WE1	`2024-07-29` - `2024-10-27`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2024-05-21` - `2025-06-19`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hsleadflows.net WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
hs-banner.com WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
hs-analytics.net WE1	`2024-08-09` - `2024-11-07`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-04-23` - `2025-05-22`	a year	crt.sh
hsforms.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh
go.recordedfuture.com WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Frame ID: C28AB36BAB16A4DA93E259A0F7F32904
Requests: 102 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1003136084?random=1726625650906&cv=11&fst=1726625650906&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&hn=www.googleadservices.com&frm=0&tiba=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&npa=0&pscdl=noapi&auid=1741471357.1726625651&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: F34E3F176D901E6907A73B591C6DF484
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-MHTMF48BZH&gacid=160483188.1726625651&gtm=45je4990v873499763z8830966511za200zb830966511&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1328230588
Frame ID: 1409B786753B9179C3F345C0A6EE739B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

"Marko Polo" Cybercrime Group Unveiled: Infostealer Empire Expands Global Threats

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

106
Requests

98 %
HTTPS

67 %
IPv6

24
Domains

38
Subdomains

34
IPs

3
Countries

2376 kB
Transfer

7262 kB
Size

47
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://app.recordedfuture.com/live/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo?utm_campaign=rf-research-top-demo-floating-nav-bar-2024&utm_source=recordedfuture&utm_medium=website&utm_content=rf-research-top-demo-floating-nav-bar-2024&utm_term=rf-research-top-demo-floating-nav-bar-2024
Title: Get a demo

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/2023-state-of-threat-intelligence?utm_campaign=rf-research-left-floating-cta&utm_source=recordedfuture&utm_medium=website&utm_content=rf-research-left-floating-cta&utm_term=rf-research-left-floating-cta
Title: 2023 State of Threat IntelligenceSee how top cybersecurity experts use threat intelligence, where they source it, and their plans to enhance it. Download Now for Free

Search URL Search Domain Scan URL

URL: https://therecord.media/russia-china-hackers-exploit-winrar-bug?__hstc=57501621.72ee7f77cb4b22444e394d6a7b83b4f8.1726625651364.1726625651364.1726625651364.1&__hssc=57501621.1.1726625651364&__hsfp=880384190
Title: Rhadamanthys

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/hubfs/reports/cta-2024-0917.pdf
Title: click here

Search URL Search Domain Scan URL

URL: https://go.recordedfuture.com/demo
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.facebook.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://twitter.com/RecordedFuture

Search URL Search Domain Scan URL

URL: https://www.instagram.com/recordedfuture/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 81

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1726625651210%26li_adsId%3D8924972d-b9cc-4fa0-8eb9-25ff6cf78365%26url%3Dhttps%253A%252F%252Fwww.recordedfuture.com%252Fresearch%252Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLFeF4OWkEa1QAAAZIC6Jt2ElsHNhJJvAZ0tnsMLYU1ejHKQrOEFoZrFncqjDsKC2-Ml6CoxS8

106 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request marko-polo-navigates-uncharted-waters-with-infostealer-empire Show response
www.recordedfuture.com/research/ 90 KB
19 KB 257ms
169ms Document
text/html 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

01162dac953bb3e78b5d5f9634fc5dfade6efcfb45cf30aeb7125c38d352abf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

age: 0
cache-control: s-maxage=30, stale-while-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8c4dd2270c244269-EWR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 18 Sep 2024 02:14:09 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
traceresponse: 00-17f634e16838f4e808acc1def215fe36-084d3d8936b1ebf2-01
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-debug-info: eyJyZXRyaWVzIjowfQ==
x-nextjs-cache: STALE
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0 i-be21b5795622437d8136c8a0cedbd8d0
x-powered-by: Next.js
x-served-by: cache-lga21969-LGA

GET
H2 200 brand_logo_long_black_f2ead5b5c6.svg
cms.recordedfuture.com/uploads/ 4 KB
2 KB 267ms
129ms Image
image/svg+xml 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Sun, 15 Sep 2024 15:58:27 GMT
date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
age: 0
traceresponse: 00-17f575d902f1a7cbaa1339ec0a186276-067d92ed9ba6ba0c-01
x-cache: HIT
content-length: 1262
x-served-by: cache-ewr-kewr1740071-EWR
last-modified: Thu, 10 Mar 2022 10:37:46 GMT
etag: W/"6229d4fa-eab"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 large_marko_polo_navigates_uncharted_waters_banner_234934df9c.jpg
cms.recordedfuture.com/uploads/format_webp/ 47 KB
47 KB 517ms
380ms Image
image/webp 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/format_webp/large_marko_polo_navigates_uncharted_waters_banner_234934df9c.jpg?w=640

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a3f9811ae39889ebe6ee1f093c9d9b03da850ffe16faba91851ad03ab44c30ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
fastly-io-served-by: vpop-kiad7010227
traceresponse: 00-17f634e17e806e8b807867122b45955c-31f2dff77cc4aa48-01
age: 0
x-cache: MISS
fastly-io-info: ifsz=47954 idim=1000x375 ifmt=webp ofsz=47954 odim=1000x375 ofmt=webp
fastly-stats: io=1
content-length: 47954
fastly-io-warning: Failed to shrink image
x-served-by: cache-ewr-kewr1740071-EWR
etag: "9qTZ0noi06jVcs8GPHgzV5JzT5qRN0YE9bXet1oHXI8"
content-type: image/webp
cache-control: max-age=300, public, s-maxage=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 fonts.css
www.recordedfuture.com/fonts/ 1 KB
421 B 198ms
196ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/fonts/fonts.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f634e17275730c4bed80d5474a94f8-5b4c4905ddaebdb2-01
x-cache: MISS
content-length: 208
x-served-by: cache-lga21971-LGA
last-modified: Mon, 16 Sep 2024 08:51:28 GMT
server: cloudflare
etag: W/"416-191fa079a80"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2284dc24269-EWR
x-cache-hits: 0

GET
H2 200 55263b8383f3eae5.css
www.recordedfuture.com/_next/static/css/ 65 KB
14 KB 43ms
42ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d441d3291c595de79459b33a46d24844b8b6d9a8a9cdb17e86d3a462c35df9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
age: 1698354
traceresponse: 00-17f02b77fa84788cebf7a35227236491-d278102b739e8e77-01
cf-polished: origSize=67063
content-encoding: gzip
x-cache: HIT
x-served-by: cache-lga21991-LGA
cf-bgj: minify
last-modified: Thu, 29 Aug 2024 10:06:13 GMT
server: cloudflare
etag: W/"105f7-1919d9995d6"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd2284dc34269-EWR
x-cache-hits: 0

GET
H2 200 1a6394c91d198e5b.css
www.recordedfuture.com/_next/static/css/ 25 KB
6 KB 52ms
51ms Stylesheet
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/1a6394c91d198e5b.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
age: 2830945
traceresponse: 00-17ec2626a7f5bf2bc0e14e583165a38b-1ebcd25cf7882444-01
cf-polished: origSize=25271
content-encoding: gzip
x-cache: MISS
x-served-by: cache-lga21975-LGA
cf-bgj: minify
last-modified: Fri, 16 Aug 2024 07:49:39 GMT
server: cloudflare
etag: W/"62b7-1915a29dfb3"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd2284dc44269-EWR
x-cache-hits: 0

GET
H2 200 webpack-850ead8c1fea245b.js Show response
www.recordedfuture.com/_next/static/chunks/ 5 KB
2 KB 59ms
52ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/webpack-850ead8c1fea245b.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67873f7881c232f0fb083823b6e578789317251d231a168b5a6fba860bc1f892

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1165146
traceresponse: 00-17f2112fde386ea64a044abf76a6f8b6-144ff53d4fe777a9-01
x-cache: MISS
content-length: 2269
x-served-by: cache-lga21930-LGA
last-modified: Wed, 04 Sep 2024 14:33:53 GMT
server: cloudflare
etag: W/"1562-191bd74ca72"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286ded4269-EWR
x-cache-hits: 0

GET
H2 200 framework-467b11a89995b152.js Show response
www.recordedfuture.com/_next/static/chunks/ 138 KB
45 KB 61ms
55ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7223429
traceresponse: 00-17dc8b35f3d46853751e79b97caf4677-3c2a94b51c33fedd-01
x-cache: MISS
content-length: 45457
x-served-by: cache-lga21956-LGA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"2270d-190545adb94"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286def4269-EWR
x-cache-hits: 0

GET
H2 200 main-75bdb96a41ba80f4.js Show response
www.recordedfuture.com/_next/static/chunks/ 113 KB
32 KB 98ms
92ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7223429
traceresponse: 00-17dc8b35f9497a5494036a6a1aaf3e95-5d58a9934cc9fd0a-01
x-cache: MISS
content-length: 33036
x-served-by: cache-lga21947-LGA
last-modified: Wed, 26 Jun 2024 11:42:39 GMT
server: cloudflare
etag: W/"1c3b0-190545adba7"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df14269-EWR
x-cache-hits: 0

GET
H2 200 _app-7dce919248be9c19.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 129 KB
40 KB 88ms
82ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/_app-7dce919248be9c19.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5840050
traceresponse: 00-17e17562eb3b545c03cdeb4c9faede07-984c493e4f9bbab0-01
x-cache: MISS
content-length: 40876
x-served-by: cache-lga21946-LGA
last-modified: Fri, 12 Jul 2024 11:58:22 GMT
server: cloudflare
etag: W/"20521-190a6cf008c"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df24269-EWR
x-cache-hits: 0

GET
H2 200 769-f95d08d81b193fa5.js Show response
www.recordedfuture.com/_next/static/chunks/ 262 KB
77 KB 98ms
92ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/769-f95d08d81b193fa5.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5840536
traceresponse: 00-17e174f08b33422027a474c9bba3c9d2-c194e23a2fb4767f-01
x-cache: MISS
content-length: 78499
x-served-by: cache-lga21932-LGA
last-modified: Fri, 12 Jul 2024 11:51:14 GMT
server: cloudflare
etag: W/"419c1-190a6c87930"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df34269-EWR
x-cache-hits: 0

GET
H2 200 129-82bd73d6c6af04c1.js Show response
www.recordedfuture.com/_next/static/chunks/ 37 KB
12 KB 97ms
92ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/129-82bd73d6c6af04c1.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3693062
traceresponse: 00-17e9160f82808c96a299ba2270c4488b-2c17cc89262be421-01
x-cache: MISS
content-length: 11656
x-served-by: cache-lga21927-LGA
last-modified: Tue, 06 Aug 2024 07:51:56 GMT
server: cloudflare
etag: W/"958c-19126ac5d80"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df44269-EWR
x-cache-hits: 0

GET
H2 200 911-ff01f8a62625f045.js Show response
www.recordedfuture.com/_next/static/chunks/ 55 KB
19 KB 97ms
91ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7223429
traceresponse: 00-17dc8b3608310b5e28ab563c9f38dac3-84c94a36091436be-01
x-cache: MISS
content-length: 18806
x-served-by: cache-lga21933-LGA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"ddd2-190545adb81"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df54269-EWR
x-cache-hits: 0

GET
H2 200 81-2528521366cfa8f4.js Show response
www.recordedfuture.com/_next/static/chunks/ 11 KB
5 KB 134ms
129ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/81-2528521366cfa8f4.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd0aa2edbf70120a3664d67d62c7be974905b21305d74bf06b58d4570bb81dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7223428
traceresponse: 00-17dc8b361e590819c17bdf049660e735-3169730b211def57-01
x-cache: MISS
content-length: 4641
x-served-by: cache-lga21981-LGA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"2cc8-190545adb72"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df74269-EWR
x-cache-hits: 0

GET
H2 200 407-b4466bcdd3b591b7.js Show response
www.recordedfuture.com/_next/static/chunks/ 15 KB
5 KB 58ms
53ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/407-b4466bcdd3b591b7.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7223428
traceresponse: 00-17dc8b361eb7dce39e5a6b9a3c820dcc-6cbf666e426c9e4f-01
x-cache: MISS
content-length: 5304
x-served-by: cache-lga21945-LGA
last-modified: Wed, 26 Jun 2024 11:42:38 GMT
server: cloudflare
etag: W/"3cad-190545adb3f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2286df94269-EWR
x-cache-hits: 0

GET
H2 200 736-c1f7e6c5744174d7.js Show response
www.recordedfuture.com/_next/static/chunks/ 109 KB
26 KB 160ms
156ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/736-c1f7e6c5744174d7.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b7ab22cdfb33b1ca4a7b1042cd5c8b12cabc5df338d2c75c37a8b48a737a6ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5840050
traceresponse: 00-17e17562eb97f9fab4ecb07c517c1ab5-05d182b82b99f8a4-01
x-cache: MISS
content-length: 26126
x-served-by: cache-lga21954-LGA
last-modified: Fri, 12 Jul 2024 11:58:22 GMT
server: cloudflare
etag: W/"1b2e0-190a6ceffff"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2288e124269-EWR
x-cache-hits: 0

GET
H2 200 267-fa0dc1740bfabc59.js Show response
www.recordedfuture.com/_next/static/chunks/ 48 KB
12 KB 134ms
130ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/267-fa0dc1740bfabc59.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2d02d5f5b95c51c99da75486561f118d1945d1c5bdff3166cd68f89f42241ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 558608
traceresponse: 00-17f438d450ccdce5a1f6a1a2bde67fcd-53ab35ade9cac0f8-01
x-cache: MISS
content-length: 12424
x-served-by: cache-lga21955-LGA
last-modified: Wed, 11 Sep 2024 15:02:58 GMT
server: cloudflare
etag: W/"c11f-191e19befa3"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2288e134269-EWR
x-cache-hits: 0

GET
H2 200 379-1af7fccdeaa0fc7c.js Show response
www.recordedfuture.com/_next/static/chunks/ 188 KB
39 KB 161ms
157ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/379-1af7fccdeaa0fc7c.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88cb17803f855ba27baf3e10ef02d8b74166f0dc9398687e968224c5d6e72734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 147278
traceresponse: 00-17f5aeeed40047ab3a95bb55de9e95c0-84e062be376fb85b-01
x-cache: MISS
content-length: 39395
x-served-by: cache-lga21966-LGA
last-modified: Mon, 16 Sep 2024 09:01:05 GMT
server: cloudflare
etag: W/"2f156-191fa10691d"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2288e144269-EWR
x-cache-hits: 0

GET
H2 200 %5B%5B...slug%5D%5D-338aac8dfbeb5185.js Show response
www.recordedfuture.com/_next/static/chunks/pages/ 6 KB
2 KB 190ms
186ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-338aac8dfbeb5185.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6af2f3db57e956ffc58005b59e427115165532d049d091f4385d8594247098f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 558382
traceresponse: 00-17f439091c42c3c45905297daad2b137-f478c65f0cd870fc-01
x-cache: MISS
content-length: 2062
x-served-by: cache-lga21972-LGA
last-modified: Wed, 11 Sep 2024 15:02:58 GMT
server: cloudflare
etag: W/"1766-191e19bf035"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2288e154269-EWR
x-cache-hits: 0

GET
H2 200 _buildManifest.js Show response
www.recordedfuture.com/_next/static/kN6_LMFWg85Gf9jhziAkl/ 3 KB
1 KB 160ms
156ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/kN6_LMFWg85Gf9jhziAkl/_buildManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

027148651049c1d7b2bc928eea421669ca0d15d331ac679b7277f6ec0f98df8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 147613
traceresponse: 00-17f5aea0aaa8632a08860688ce66de2c-71fd38458166cabc-01
x-cache: MISS
content-length: 880
x-served-by: cache-lga21993-LGA
last-modified: Mon, 16 Sep 2024 09:01:05 GMT
server: cloudflare
etag: W/"b0a-191fa106c14"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd2288e174269-EWR
x-cache-hits: 0

GET
H2 200 _ssgManifest.js Show response
www.recordedfuture.com/_next/static/kN6_LMFWg85Gf9jhziAkl/ 229 B
280 B 160ms
157ms Script
application/javascript 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/kN6_LMFWg85Gf9jhziAkl/_ssgManifest.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91203e702b388668ba42c7929309e90d45cf23900e4c9c37e8da706dcd1550ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
cf-cache-status: HIT
age: 147277
traceresponse: 00-17f5aeeed5abad063e01a5e73af8122a-83adaeb37abda432-01
content-encoding: gzip
x-cache: MISS
x-served-by: cache-lga21934-LGA
last-modified: Mon, 16 Sep 2024 09:01:05 GMT
server: cloudflare
etag: W/"e5-191fa106c21"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd2288e194269-EWR
x-cache-hits: 0

GET
H2 200 insikt_group_logo_updated_3_300x48_b5390f4ff2.png
cms.recordedfuture.com/uploads/ 2 KB
2 KB 309ms
172ms Image
image/png 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
fastly-io-served-by: vpop-kiad7010211
traceresponse: 00-17f62fbf5a2bfad5b098b410cf5669ce-6252f765e9a1263f-01
age: 0
x-cache: MISS
fastly-io-info: ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png
fastly-stats: io=1
content-length: 2186
fastly-io-warning: Failed to shrink image
x-served-by: cache-ewr-kewr1740071-EWR
etag: "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Wed, 18 Sep 2024 00:45:06 GMT

GET
H2 200 x-social-media-black-icon.svg
www.recordedfuture.com/images/ 456 B
480 B 129ms
126ms Image
image/svg+xml 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/images/x-social-media-black-icon.svg

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
cf-cache-status: MISS
content-encoding: gzip
traceresponse: 00-17f634e173cf3c3d9f41f684140e571a-6003559302c9b7e1-01
x-cache: MISS
x-served-by: cache-lga21979-LGA
last-modified: Mon, 16 Sep 2024 08:51:28 GMT
server: cloudflare
etag: W/"1c8-191fa079a80"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd228be5b4269-EWR
x-cache-hits: 0

GET
H2 200 Inter-Regular.86422bf3.ttf
www.recordedfuture.com/_next/static/media/ 303 KB
144 KB 187ms
184ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9518986
traceresponse: 00-17d17f70b76fa0b6e29b4738973c6e9f-3921cb112e4130b7-01
x-cache: HIT
content-length: 147167
x-served-by: cache-lga21981-LGA
last-modified: Thu, 16 May 2024 07:29:50 GMT
server: cloudflare
etag: W/"4ba44-18f804eabf6"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228ee9b4269-EWR
x-cache-hits: 0

GET
H2 200 Inter-Bold.0b1aaf81.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 107ms
105ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9469678
traceresponse: 00-17d490425b8267a91bdac9589af05b35-37c1bc645269acd1-01
x-cache: MISS
content-length: 157388
x-served-by: cache-lga21940-LGA
last-modified: Fri, 31 May 2024 11:43:08 GMT
server: cloudflare
etag: W/"4d2c4-18fce75f736"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228ee9c4269-EWR
x-cache-hits: 0

GET
H2 200 icomoon.ttf
www.recordedfuture.com/icons/fonts/ 6 KB
3 KB 316ms
314ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f634e179f28d460391f4c7ecce2434-6db2ca466ab2bd1d-01
x-cache: MISS
content-length: 3235
x-served-by: cache-lga21969-LGA
last-modified: Mon, 16 Sep 2024 08:51:28 GMT
server: cloudflare
etag: W/"160c-191fa079a80"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228ee9d4269-EWR
x-cache-hits: 0

GET
H2 200 Inter-SemiBold.ebaf29e9.ttf
www.recordedfuture.com/_next/static/media/ 308 KB
153 KB 205ms
203ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6619573
traceresponse: 00-17daccb962309d1b65c9be3029b9e815-93466380fd2501c4-01
x-cache: HIT
content-length: 156755
x-served-by: cache-lga21961-LGA
last-modified: Thu, 20 Jun 2024 09:20:35 GMT
server: cloudflare
etag: W/"4d16c-19034f2a3e6"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228ee9e4269-EWR
x-cache-hits: 0

GET
H2 200 Inter-ExtraBold.d19caa02.ttf
www.recordedfuture.com/_next/static/media/ 309 KB
154 KB 160ms
159ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9518986
traceresponse: 00-17cf9a6d5ea17691590c06339b2535a2-c1689d987edeb618-01
x-cache: HIT
content-length: 157010
x-served-by: cache-lga21956-LGA
last-modified: Tue, 14 May 2024 10:56:04 GMT
server: cloudflare
etag: W/"4d52c-18f76bec2a9"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228ee9f4269-EWR
x-cache-hits: 0

GET
H2 200 Inter-Medium.6ee661b3.ttf
www.recordedfuture.com/_next/static/media/ 307 KB
152 KB 203ms
202ms Font
font/ttf 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/_next/static/css/55263b8383f3eae5.css
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: HIT
age: 9518986
traceresponse: 00-17cfaf0781318b72a16db1207787f5c3-b3130c73328b4f37-01
x-cache: HIT
content-length: 155503
x-served-by: cache-lga21921-LGA
last-modified: Wed, 15 May 2024 10:01:45 GMT
server: cloudflare
etag: W/"4cd58-18f7bb3649c"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd228eea14269-EWR
x-cache-hits: 0

GET
H2 200 resource-sidebars Show response
cms.recordedfuture.com/api/ 2 KB
3 KB 206ms
127ms XHR
application/json 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

352c70833fa552b3a6e00d52ebe78f576dce0df36e4c1e4e3d047b7eb67bdc1c

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Wed, 18 Sep 2024 02:14:10 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-permitted-cross-domain-policies: none
age: 0
traceresponse: 00-17f634e18b1fd3896efbd2111fb49a07-d45730cec3974430-01
x-powered-by: Strapi <strapi.io>
x-dns-prefetch-control: off
x-cache: MISS
via: 1.1 varnish
content-length: 2119
x-served-by: cache-ewr-kewr1740040-EWR
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 resources Show response
cms.recordedfuture.com/api/ 25 KB
25 KB 504ms
426ms XHR
application/json 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][0][$or][0][language][name][$in][0]=English&filters[$and][0][$or][1][language][id][$null]=true&filters[$and][1][$or][0][showFrom][$null]=true&filters[$and][1][$or][1][showFrom][$lte]=2024-09-18T02%3A14%3A10Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Strapi <strapi.io>

Resource Hash

759e36cb664b0ced90bc0d5f414df8545d40356551050e05790f90f74238ef67

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
date: Wed, 18 Sep 2024 02:14:10 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-permitted-cross-domain-policies: none
age: 0
traceresponse: 00-17f634e18ce18bf32c349009dbcb23af-8f73a67d868a8a78-01
x-powered-by: Strapi <strapi.io>
x-dns-prefetch-control: off
x-cache: MISS
via: 1.1 varnish
content-length: 25564
x-served-by: cache-ewr-kewr1740040-EWR
referrer-policy: no-referrer
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 blog.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 45 KB
8 KB 139ms
138ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/blog.json?slug=blog

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8856d6269cb3d6130964505bd0ff1c9e242ddcf440da74edc075ec376cb346ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f6347df8e646211864ba9a6779d615-5104b38b7c7357d0-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 7960
x-served-by: cache-lga21976-LGA
server: cloudflare
etag: "c7seqtsz19zvq"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b19954269-EWR
x-cache-hits: 0

GET
H2 200 careers.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 80 KB
14 KB 180ms
180ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/careers.json?slug=careers

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3638ac58690004bcc362c1b9dde0e0c4763dc1503a34a69780f33ff0c6536cb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634983479213b9c0e55354a9e7af3-1ed9cbfb83ee66d5-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 13953
x-served-by: cache-lga21945-LGA
server: cloudflare
etag: "v2bj9mzh4y1rd8"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a0e4269-EWR
x-cache-hits: 0

GET
H2 200 contact.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 54 KB
10 KB 177ms
177ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/contact.json?slug=contact

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

858cc68259d82c762aa20e8b2b8a015d61c7a026605bfb800ca896b62e528d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634e19120f218422b251cd0fd23fb-2d26ee9b679e7d09-01
via: 1.1 varnish
x-cache: MISS
x-nextjs-cache: STALE
content-length: 10198
x-served-by: cache-lga21969-LGA
server: cloudflare
etag: "os6ja5lqvv16uj"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a164269-EWR
x-cache-hits: 0

GET
H2 200 index.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 194 KB
29 KB 100ms
98ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/index.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff64328b5dacc7701647dc8159d3ea754397e1a117ac5629986f890f106077e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 182
traceresponse: 00-17f6316388cab36744e96942eaa8e15c-59756f4198f4ba77-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 29457
x-served-by: cache-lga21990-LGA
server: cloudflare
etag: "t8s7uraw98493a"
vary: Accept-Encoding
content-type: application/json
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a184269-EWR
x-cache-hits: 0

GET
H2 200 intelligence-cloud.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/platform/ 79 KB
14 KB 186ms
184ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/platform/intelligence-cloud.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8d1a08222c672eb0f696a4127a20f227db8f1a464448dd72f2534dd8ca2d268

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f633c302e51be1adc404481da0ad51-b13e8d0202ab25c6-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 13876
x-served-by: cache-lga21934-LGA
server: cloudflare
etag: "15tykgli52j1q40"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a1a4269-EWR
x-cache-hits: 0

GET
H2 200 outcomes.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 78 KB
13 KB 206ms
204ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/outcomes.json?slug=outcomes

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

361f4d7382416dd2d57e473d0d0c17cf8353de936e7bc2d740cdf0ed2306f321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634e191c64d93faab24223d3fe3eb-bd094f355942f295-01
via: 1.1 varnish
x-cache: MISS
x-nextjs-cache: STALE
content-length: 13428
x-served-by: cache-lga21985-LGA
server: cloudflare
etag: "v9zocc7bnw1pjy"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a1e4269-EWR
x-cache-hits: 0

GET
H2 404 client-success.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/services-support/ 104 KB
16 KB 446ms
444ms Fetch
text/html 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/services-support/client-success.json

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

95c8d0c5a31279e62a9f12a62b205711dde30faf2582757f58039ad5142c05e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634e19214853e817d80ec8d295bfc-eb87740399de4445-01
x-powered-by: Next.js
content-encoding: gzip
x-cache: MISS
x-served-by: cache-lga21978-LGA
server: cloudflare
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd22b6a1f4269-EWR
x-cache-hits: 0

GET
H2 404 research.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 104 KB
16 KB 443ms
442ms Fetch
text/html 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/research.json?slug=research

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Next.js

Resource Hash

642d3084f11c63d1192371cec7eaec8b1cad94923c2b4bfd8ff223e63695017f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634e1905daf69606dcdda4be4d5fc-33abb187b6c7daa5-01
x-powered-by: Next.js
content-encoding: gzip
x-cache: MISS
x-served-by: cache-lga21945-LGA
server: cloudflare
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd22b6a234269-EWR
x-cache-hits: 0

GET
H2 200 resources.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 59 KB
10 KB 174ms
173ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/resources.json?slug=resources

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8436eca0869a9ebe51c7cdf6e09ba3203239f68d3e1efd1e47c02f5ca3a72121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f634b7144b4f01e2fa779c778d0576-ce8cd49d6288b91a-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 10174
x-served-by: cache-lga21990-LGA
server: cloudflare
etag: "vnw1qtyifx1ap3"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a254269-EWR
x-cache-hits: 0

GET
H2 200 company.json Show response
www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/ 51 KB
10 KB 135ms
134ms Fetch
application/json 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/company.json?slug=company

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac1f512b1788cec6dc44d9420f52de7cd45f93a8dd6a7ef105a99f31a51e8c29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

purpose: prefetch
x-nextjs-data: 1
Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-nextjs-matched-path: /[[...slug]]
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
traceresponse: 00-17f63498342461cd5d9a85b98949de8e-458a1a186fff99f0-01
via: 1.1 varnish
x-cache: HIT
x-nextjs-cache: STALE
content-length: 9643
x-served-by: cache-lga21978-LGA
server: cloudflare
etag: "5xj69kizlw14jo"
vary: Accept-Encoding
content-type: application/json
cache-control: s-maxage=30, stale-while-revalidate
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b6a264269-EWR
x-cache-hits: 0

GET
H2 200 1a6394c91d198e5b.css Show response
www.recordedfuture.com/_next/static/css/ 25 KB
0 0ms
0ms Fetch
text/css 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/_next/static/css/1a6394c91d198e5b.css

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:09 GMT
via: 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
age: 2830945
traceresponse: 00-17ec2626a7f5bf2bc0e14e583165a38b-1ebcd25cf7882444-01
cf-polished: origSize=25271
content-encoding: gzip
x-cache: MISS
x-served-by: cache-lga21975-LGA
cf-bgj: minify
last-modified: Fri, 16 Aug 2024 07:49:39 GMT
server: cloudflare
etag: W/"62b7-1915a29dfb3"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-debug-info: eyJyZXRyaWVzIjowfQ==
cf-ray: 8c4dd2284dc44269-EWR
x-cache-hits: 0

GET
H2 200 favicon.ico
www.recordedfuture.com/ 17 KB
913 B 139ms
138ms Other
image/x-icon 104.18.35.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.recordedfuture.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.35.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31536000; includeSubDomains
x-platform-server: i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4
x-content-type-options: nosniff
cf-cache-status: MISS
traceresponse: 00-17f634e193b2d74d3daf2a9ba3043ee1-b5fdc25b714128ca-01
x-cache: MISS
content-length: 676
x-served-by: cache-lga21937-LGA
last-modified: Mon, 16 Sep 2024 08:51:28 GMT
server: cloudflare
etag: W/"423e-191fa079a80"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=0
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
cf-ray: 8c4dd22b9a634269-EWR
x-cache-hits: 0

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 28 KB
9 KB 111ms
33ms XHR
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&vn=2.1&x=true
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: c060a69ff8c4146db57484eb560a78880b6011d87a3663044631d56e5478c1ec

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
via: 1.1 google
server: gnv1
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://www.recordedfuture.com
cache-control: public, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 324 KB
107 KB 149ms
64ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aad905511c5ea6856220f79c4f46f62996ee6d9b2bd03cefc2b9eca04405a7ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109101
x-xss-protection: 0
last-modified: Wed, 18 Sep 2024 00:33:50 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 18 Sep 2024 02:14:10 GMT

GET
H2 200 state_of_threat_intelligence_cta_250f58d535.webp
cms.recordedfuture.com/uploads/ 10 KB
10 KB 283ms
283ms Image
image/webp 151.101.2.216
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.recordedfuture.com/uploads/state_of_threat_intelligence_cta_250f58d535.webp?w=640

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.216 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1083d5cb2cd087192da0c3af0c597782f089c76c4a49c578dc1426d90e8afd76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 varnish
strict-transport-security: max-age=31557600
x-platform-server: i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7
fastly-io-served-by: vpop-kiad7010247
traceresponse: 00-17f62d17d672848c3411798c71b71d87-96d82f75113e06be-01
age: 0
x-cache: HIT
fastly-io-info: ifsz=10050 idim=296x167 ifmt=webp ofsz=10050 odim=296x167 ofmt=webp
fastly-stats: io=1
content-length: 10050
fastly-io-warning: Failed to shrink image
x-served-by: cache-ewr-kewr1740071-EWR
etag: "A8YFayL8TtePesviaNtRFPIQnrl6T+YQsML/PINeYek"
vary: Accept-Encoding
content-type: image/webp
cache-control: max-age=300
x-debug-info: eyJyZXRyaWVzIjowfQ==
accept-ranges: bytes
expires: Tue, 17 Sep 2024 23:56:27 GMT

GET
H3 200 worker-0c3c8bb8f695e131bedc08c62e1066b2br.js Show response
dev.visualwebsiteoptimizer.com/edrv/ 265 KB
64 KB 106ms
42ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/edrv/worker-0c3c8bb8f695e131bedc08c62e1066b2br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: 1a57cec26655d086a0fdbcd57c6901c7f8704b66ca7b517f9912fe65796c6dd4

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
via: 1.1 google
last-modified: Tue, 17 Sep 2024 21:50:36 GMT
server: gnv1
etag: "66e9f9ac-10078"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65656

GET
H3 200 va_gq-6e7d9d80b536fbb34c9865d5698e3468br.js Show response
dev.visualwebsiteoptimizer.com/edrv/ 275 KB
71 KB 126ms
63ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/edrv/va_gq-6e7d9d80b536fbb34c9865d5698e3468br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: ad2ad0fbe16dc54a407d9375acd456e68e81fb4e007efe1d237f67bf7f4eda1d

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
via: 1.1 google
last-modified: Tue, 17 Sep 2024 21:50:38 GMT
server: gnv1
etag: "66e9f9ae-11cb0"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72880

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
146 B 31ms
30ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=DD3E82E60740FB1F891146F6C9910F14B&h=33efbb20c5b51445e3f0b8bcb4089109&t=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv02c
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

GET
H2 200 64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response
j.6sc.co/j/ 8 KB
3 KB 172ms
78ms Script
application/javascript 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-196-3-196.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-amz-version-id: MbzeuKlSNW9OmZUUgXztIvtYg.jH191L
content-encoding: gzip
date: Wed, 18 Sep 2024 02:14:10 GMT
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 2186
last-modified: Thu, 25 Jul 2024 13:22:42 GMT
server: AmazonS3
etag: "3fdac343b2a409e8e59493c09517ac69"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=1800
accept-ranges: bytes
x-amz-cf-id: 3J3HWiQCtxAt0naEa3_29LEZDL9ULHIGjZndWyWOkBQ92kw7fUge7Q==
expires: Wed, 18 Sep 2024 02:44:10 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
106 KB 74ms
72ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9daf092e8250f7cb6cd4922a4f62868894b55f8c612ccaf7cca5a84338388d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108107
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 18 Sep 2024 02:14:10 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 71ms
70ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bde338bd3b5934c83601300b78f1ec86b2fcae1d9b8996e84aa2df25cad26db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95854
x-xss-protection: 0
last-modified: Wed, 18 Sep 2024 00:33:50 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 18 Sep 2024 02:14:10 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 132ms
36ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2024 20:58:07 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200038-IAD

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 134ms
25ms Script
application/javascript 2600:141b:1c00:6::17df:d105
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:6::17df:d105 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=78874
accept-ranges: bytes
content-length: 14628

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 114ms
29ms Script
text/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 18 Sep 2024 00:39:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 5674
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Wed, 18 Sep 2024 02:39:36 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 120ms
30ms Script
text/javascript 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 14:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43304
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Sep 2025 14:12:26 GMT

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 103ms
25ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 18 Sep 2024 02:14:10 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58953
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=23, mss=1232, tbw=5678, tp=10, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: ZoNia6p+TVDkwqfvwvZzUUtRrTw4fShZLBAEdGdzTRSV4DRP0rytcuvsg4hoZRdkfypKE2u5AxxUhOaxxuTtcQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 container_nbhoRDM8.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 245 KB
70 KB 124ms
36ms Script
application/javascript 2600:9000:24f0:2400:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f0:2400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

172d1e3c55a0d4632b33416ce6d444126009f0f09c1bfd504c66096f8cce8adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 00:01:02 GMT
content-encoding: gzip
via: 1.1 1dd1e483fa41d512929f44790f141972.cloudfront.net (CloudFront)
x-amz-version-id: O9ecsHlMI_twpep7sVLDvVxt5fMx69Mt
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P3
age: 7989
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 10 Sep 2024 22:00:22 GMT
server: CloudFront
etag: W/"c03e77792422aeefb97d57ea1b609fab"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: y6FH2IFJNaHbgJdfG8GT-w7BqtR1G1n5SIvZwfUryqQlbLE-K4vhSg==

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 202 KB
59 KB 117ms
30ms Script
application/javascript 2600:9000:24f0:2400:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Requested by

Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f0:2400:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 00:00:49 GMT
x-amz-version-id: nUcBrzhVy9JMMaAtFkxpvW8b5Jy3nYQT
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 1dd1e483fa41d512929f44790f141972.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P3
age: 8002
x-cache: Hit from cloudfront
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 29 Apr 2024 00:09:25 GMT
server: CloudFront
etag: W/"5c359e1fa9398dc7248bc8740cc8eb49"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: tW6_ciop1aKWWfGRijrZDfMyHYaVa2vAhylSPi5WhtElNUMb6S7_AA==

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 2 KB
1 KB 160ms
80ms Script
application/javascript 2606:4700::6810:89d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/252628.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

03deb7f9afb221dd4f9c499ba993135331b0492478d6d16f72264fde9cac2ac1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8ddc4b96-8971-409d-86ff-663504b1f430
cf-polished: origSize=2008
age: 17
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8ddc4b96-8971-409d-86ff-663504b1f430
cf-bgj: minify
last-modified: Wed, 18 Sep 2024 02:13:53 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://securitytrails.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-58bbf9c46c-m6gwx
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 8c4dd22dce855e6d-EWR
expires: Wed, 18 Sep 2024 02:15:40 GMT

GET 97725bc7-4766-4281-99bf-991206ab9947
https://www.recordedfuture.com/ Frame 0
0

GET
H3 200 nc-50037f3141def0fef2353488642cf386br.js Show response
dev.visualwebsiteoptimizer.com/edrv/ 11 KB
4 KB 48ms
48ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/edrv/nc-50037f3141def0fef2353488642cf386br.js
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: 7c50296589d6433f84936923ffd29636e28511969db10f3a12f84ef86340b702

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
content-encoding: br
via: 1.1 google
last-modified: Tue, 17 Sep 2024 21:50:38 GMT
server: gnv1
etag: "66e9f9ae-e7e"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3710

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 39ms
39ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=DD3E82E60740FB1F891146F6C9910F14B&s=1726625650&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22en-us%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1726625650797%2C%22tO%22%3A10%2C%22tz%22%3A%22Pacific%2FHonolulu%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1726625650807&v=f1c0f5f4f

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:10 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv02c
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/ 5 KB
2 KB 141ms
47ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/?random=1726625650906&cv=11&fst=1726625650906&bg=ffffff&guid=ON&async=1&gtm=45be4990v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&hn=www.googleadservices.com&frm=0&tiba=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&npa=0&pscdl=noapi&auid=1741471357.1726625651&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2df38ca14e1da3009e84718fff2e4fb5686f569e6d2bf3d61f392ff5db369024

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2400
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1003136084
td.doubleclick.net/td/rul/ Frame F34E 0
0 161ms
65ms Document
text/html 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1003136084?random=1726625650906&cv=11&fst=1726625650906&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&hn=www.googleadservices.com&frm=0&tiba=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&npa=0&pscdl=noapi&auid=1741471357.1726625651&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 02:14:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 35ms
34ms Image
image/gif 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=648405378&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&utmhid=931243322&utmr=-&utmp=%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&utmht=1726625651000&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.127677364.1726625651.1726625651.1726625651.1%3B%2B__utmz%3D93161374.1726625651.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1373063903&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAAAAAAE~

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 28 KB
8 KB 46ms
45ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=880669&settings_type=1&vn=&eventArch=1&uuid=&ec=1390229|1390232&exc=35
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: d469a9457bead595aeb407aeabce5a6fe021037dfd053ec63232e5a6db9cced4

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: gzip
via: 1.1 google
server: gnv1
etag: W/"1726609853_EA"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 194163687656043 Show response
connect.facebook.net/signals/config/ 77 KB
15 KB 168ms
168ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/194163687656043?v=2.9.167&r=stable&domain=www.recordedfuture.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2cab74f1607601d8773a9cb4f1cd1758d19d73aaae4b32ffad62b672fb5a440c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 18 Sep 2024 02:14:11 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=26, rtx=0, c=74, mss=1232, tbw=68348, tp=64, tpl=0, uplat=145, ullat=1
pragma: public
x-fb-debug: nqFNLNa0y52PAreos/vWRn9iko1uUe5gZ3waALI5GSOJZCIyag6OKLXYfMrNSEGzuhi0WydDyY7Dscv0e4/fwg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
0 177ms
53ms Fetch
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je4990v873499763z8830966511za200zb830966511&_p=1726625650486&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=160483188.1726625651&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1726625651&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&dt=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1412
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
259 B 149ms
45ms Ping
text/plain 2607:f8b0:4004:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=160483188.1726625651&gtm=45je4990v873499763z8830966511za200zb830966511&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 1409 0
0 57ms
56ms Document
text/html 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-MHTMF48BZH&gacid=160483188.1726625651&gtm=45je4990v873499763z8830966511za200zb830966511&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1328230588

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Sep 2024 02:14:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 adsct
t.co/i/ 43 B
628 B 169ms
77ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=571f35f9-e28b-4f95-98c6-089d6e5fd867&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=edbb022f-3f95-402f-a7d7-cf95dd9a2bf7&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-response-time: 6
date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=0
cf-cache-status: DYNAMIC
server: cloudflare tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: bc4396fd55eeb6a9
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: d841e0d43f452f7c1e6e04f7326f56ad9aac210a1e2b48f73e1e03e4c1ca644e
cf-ray: 8c4dd2305bd932c6-PHL
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
393 B 185ms
64ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=571f35f9-e28b-4f95-98c6-089d6e5fd867&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=edbb022f-3f95-402f-a7d7-cf95dd9a2bf7&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-response-time: 8
date: Wed, 18 Sep 2024 02:14:10 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 03db9121ed5f4061
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 7dc2e43fd81b903d9a7bd684338fdeb60bdb1b505895f732fbffb41c14811239
content-length: 43

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
592 B 214ms
122ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Sep 2024 02:14:10 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: DF55235A27A54D3CB1DD1D6583550AFA Ref B: PHL30EDGE0117 Ref C: 2024-09-18T02:14:11Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.recordedfuture.com
x-li-source-fabric: prod-ltx1
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYiW1ya/X+2oCFbcMnbpw==

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
179 B 516ms
247ms Ping
text/plain 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2F%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&idsite=1&rec=1&r=485431&h=16&m=14&s=11&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&_id=&_idn=1&send_image=0&_refts=0&pv_id=jyCxb0&pf_net=89&pf_srv=168&pf_tfr=35&pf_dm1=37&pf_dm2=519&pf_onl=0&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-157-122-248.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.recordedfuture.com
date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Proto,User-Agent

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
297 B 460ms
215ms Script
application/javascript 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=Rbf5rc&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-157-122-248.eu-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

420399d77394cb1434bb36a8a18b30f84bac89f92d3e6c757091612d3c564827

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 25ms
25ms Script
application/javascript 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 16 Sep 2024 00:47:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "66e78018-111cd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, proxy-revalidate, max-age=10800
accept-ranges: bytes
content-length: 18822
expires: Wed, 18 Sep 2024 05:14:11 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 83 KB
25 KB 126ms
39ms Script
application/javascript 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

059b77025c02623999e7524b737287072bd2dbb42c1652f70a4020338b1e5f21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
age: 545
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1426/bundles/project.js&cfRay=8c3e9c220b8cc347-ATL
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"edf91c1320ba2916398ed791b63187bc"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1426/bundles/project.js
date: Wed, 18 Sep 2024 02:14:11 GMT
x-amz-version-id: 7DwgQA9YoOwDB6Raj9_RIwKNzf1Sd5R0
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 06c1d28e93bdae8f6401a12c10b2f570.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: acc5abe0-8f41-4c1d-a718-427c8e8e6852
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-request-id: acc5abe0-8f41-4c1d-a718-427c8e8e6852
last-modified: Wed, 28 Aug 2024 20:01:26 UTC
server: cloudflare
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vNvErerTXlHdNhiS4SVtpjgoL4C4L%2FHndpl0x%2ByMO2FQTHnEL%2FhmwM0F6pxdvC45RDPT5GQU4XzM97Igf1BW1zF4%2FABPCxKMAYBXG8cpbATXMhEx5gwYe%2FAkAkGGYPBqOxaBj2NmOTBR1hZ5"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-sf8hx
cf-ray: 8c4dd230a8a40cbc-EWR
x-amz-cf-id: mRTyRE3rVE1rQy2Cr6pQR2wBFjSEaJ5AdQGRXqT0Muhncq8IWZcfSw==

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 551 KB
92 KB 149ms
44ms Script
application/javascript 2606:4700::6812:8b11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsleadflows.net/leadflows.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:8b11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1233a49c4ecec12fed969bc83cd6ba59d8b2b88bef31988d9384f7e54c42e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
Origin: https://www.recordedfuture.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
age: 59745
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1627/bundle/main/lead-flows-release.js&cfRay=8c26ee3d9faa59a3-IAD
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"7d65c542c3a53442feef1a0f44071183"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1627/bundle/main/lead-flows-release.js
date: Wed, 18 Sep 2024 02:14:11 GMT
x-amz-version-id: WgPQEOT.QDI5zKnRYhaKsuHqDz44RIEz
x-content-type-options: nosniff
cf-cache-status: HIT
via: 1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 0fbc5f82-2fba-45b9-8f9d-bad2c1375059
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-request-id: 0fbc5f82-2fba-45b9-8f9d-bad2c1375059
last-modified: Thu, 12 Sep 2024 08:49:54 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-mrvnx
cf-ray: 8c4dd230d90d4366-EWR
x-amz-cf-id: SA_4cLxExcFQlCQU4-tHGBXFOzcuBCjX0tvNRAzM1hLW9BS0QY1naA==

GET
H2 200 252628.js Show response
js.hs-banner.com/ 62 KB
19 KB 144ms
68ms Script
text/javascript 2606:4700:4400::ac40:9310
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
x-amz-version-id: GAPviEB0_qVTRwAgcciO.APQcIZeYu3z
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: PTY3CT489BE8D5B0
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ae4f3d5f-5610-42f6-a588-fbdebbfc0c9c
x-envoy-upstream-service-time: 55
x-amz-id-2: v4amifKb+Bc0L/l9A7TzVrmTUltbwgLtkQ7cpSA7FhJLOHlq1AbvUR44nNBTc/OaeTcIiloPxjk=
x-evy-trace-listener: listener_https
x-request-id: ae4f3d5f-5610-42f6-a588-fbdebbfc0c9c
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 26 Jun 2024 15:57:47 GMT
server: cloudflare
etag: W/"c52f58bd4ec4f3ccbcb2164c8210fcc7"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-647fb
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8c4dd2309ee632d2-PHL
expires: Wed, 18 Sep 2024 02:14:39 GMT

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1726625400000/ 69 KB
25 KB 128ms
42ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1726625400000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59fc82d994a33a650be64d5d091a9c951c4e114046bea78c51f3d34771a60831

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: PJEXVT4RP9DWDGWZ
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: ac5b526a-5a4f-4995-88c0-eb5bcf134faf
age: 105
x-envoy-upstream-service-time: 34
x-amz-id-2: r4d4fs+2uJGqja7b1l4y0MQdtCC/Ou+5hgF+xsrpx1H+ZQyHOXaiKzGcfDrhaYPMqX66Y/NMLbw=
x-evy-trace-listener: listener_https
x-request-id: ac5b526a-5a4f-4995-88c0-eb5bcf134faf
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 09 Sep 2024 20:16:45 GMT
server: cloudflare
etag: W/"977b8413a12b20c958fcddacd7be9248"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-z9h26
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8c4dd230b82743c4-EWR
expires: Wed, 18 Sep 2024 02:16:27 GMT

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
981 B 420ms
348ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3869953%2C26800&time=1726625651210&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"1","priority":"0"}],"filters":[{"c":["296710323"]},{"c":["296011333"]},{"c":["293087753"]},{"c":["291867783"]},{"c":["291774463"]}],"debug_key":"10171305"}
content-encoding: gzip
date: Wed, 18 Sep 2024 02:14:10 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D31DB6252C3E477482686643A4EB8067 Ref B: PHL30EDGE0419 Ref C: 2024-09-18T02:14:11Z
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYiW1ybstXms+hQphAYtQ==
x-fs-uuid: 0006225b5c9bb2d5e6b3e850a61018b5

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3869953%252C26800%26time%3D1726625651210%26li_adsId%3D8924972d-b9cc-4fa0-8eb9-25f...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo...

0
487 B

159ms
63ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLFeF4OWkEa1QAAAZIC6Jt2ElsHNhJJvAZ0tnsMLYU1ejHKQrOEFoZrFncqjDsKC2-Ml6CoxS8
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 1512693D987E41EF89D90E9538AEEA8A Ref B: PHL30EDGE0222 Ref C: 2024-09-18T02:14:11Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYiW1yhXI6ctcbu+XbZrw==

Redirect headers

date: Wed, 18 Sep 2024 02:14:11 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4762951656E04ED3B9E55659B1EE2D2C Ref B: PHL30EDGE0117 Ref C: 2024-09-18T02:14:11Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1726625651210&li_adsId=8924972d-b9cc-4fa0-8eb9-25ff6cf78365&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQLFeF4OWkEa1QAAAZIC6Jt2ElsHNhJJvAZ0tnsMLYU1ejHKQrOEFoZrFncqjDsKC2-Ml6CoxS8
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYiW1yfK2qfKff23Ol9Kw==

GET
H3 200 /
www.google.com/pagead/1p-user-list/1003136084/ 42 B
64 B 127ms
40ms Image
image/gif 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1003136084/?random=1726625650906&cv=11&fst=1726624800000&bg=ffffff&guid=ON&async=1&gtm=45be4990v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&hn=www.googleadservices.com&frm=0&tiba=%22Marko%20Polo%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats&npa=0&pscdl=noapi&auid=1741471357.1726625651&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfHK9nTXUAkuDaQlJ2txbjOvowbB0waA&random=3622929104&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
706 B 154ms
72ms XHR
application/json 68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.208 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
an-x-request-uuid: c9109dd7-0778-48fe-9bda-8d10e333aae1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 208.252.80.125; 208.252.80.125; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
198 B 34ms
20ms XHR
text/html 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-196-3-196.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 22 B
319 B 168ms
52ms XHR
text/html 2600:141b:1c00:2e::17d1:48d1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48d1 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 87a7f873f45e72f6baf1e3853e62bce0f7132aeb48019b222fa1895de71d498d

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.recordedfuture.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2600:803:a88:3125::125
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1726625651329_399550021_1618639116_14_535_10_34_219";dur=1
content-length: 22
expires: Wed, 18 Sep 2024 02:14:11 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 149ms
54ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&rl=&if=false&ts=1726625651254&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726625651250.147136573355406267&cs_est=true&ler=empty&cdl=API_unavailable&it=1726625651024&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=10, mss=1392, tbw=2772, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 18 Sep 2024 02:14:11 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 387ms
309ms Image
image/png 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&rl=&if=false&ts=1726625651254&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726625651250.147136573355406267&cs_est=true&ler=empty&cdl=API_unavailable&it=1726625651024&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Wed, 18 Sep 2024 02:14:11 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7415800703697211140", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=10, mss=1392, tbw=3089, tp=-1, tpl=-1, uplat=225, ullat=0
pragma: no-cache
x-fb-debug: VTXdcuzY3tYvVd5iqn0xLT86TcVjeQq8EYaf4uLFpNT7p3YGbYneCFg6vavgWc2AGQW1qDG43PeqWVIVFJIGZQ==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7415800703697211140"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 95 B
1 KB 72ms
58ms Fetch
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a2b0040a-33d2-4559-83b6-9a163b111f00
content-encoding: br
x-envoy-upstream-service-time: 11
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a2b0040a-33d2-4559-83b6-9a163b111f00
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sSdCrRg7S1YwAQ7ORGXxAhbs5eAUxMTKkqQ7iJWrYJTcnXZO69dDATeywlizfg6iTYEZ1BP2bMj7e4YH6N4c5mIYqCXmDN6WbyaU7ii4LjxLj5IiOMczkJKc6bU7t%2Fy30YPnFgYbGFCa6BSGgsEVlFQywlGQ5AYQaO8%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8c4dd23119170cbc-EWR
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-vmskt

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 152ms
66ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=880384190&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&t=%22Marko+Polo%22+Cybercrime+Group+Unveiled%3A+Infostealer+Empire+Expands+Global+Threats&cts=1726625651368&vi=72ee7f77cb4b22444e394d6a7b83b4f8&nc=true&ce=false&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7ffadd52-71cf-496d-af6f-d0285ef858f4
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7ffadd52-71cf-496d-af6f-d0285ef858f4
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uBQaK5MEo62XmfXR6Z9XQES95iGtGlzXtM%2FSltXXZhseA1ha09u4HjkgYlPDIWhB%2B0tWMx694ALw7Qu5CHG06JOUtgYO0kDSw183sp%2Fxb8%2FH04C%2F3OQer%2FgK%2F9NG8%2BJOxk1myObqLBxni5GjDBxT"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-jw98k
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8c4dd231be93191e-EWR
x-robots-tag: none

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 764 B
726 B 141ms
71ms XHR
application/json 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: 04eba456b89f1e241ebcaade66c3c3b1fcb9fffce61e00c7ec3a46f0da5608bc

Request headers

Referer: https://www.recordedfuture.com/
Authorization: Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
X-6s-CustomID: WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba

Response headers

x-trace-id: 6635212132338736386
date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: us-east-1a
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 403

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 123ms
34ms Preflight 13.248.142.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.142.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.recordedfuture.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Wed, 18 Sep 2024 02:14:11 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: us-east-1a
x-trace-id: 4074151358361701703

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 73ms
59ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:11 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 73ms
59ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:11 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 43ms
31ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=ipv6&q=%7B%22address%22%3A%222600%3A803%3Aa88%3A3125%3A%3A125%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2600%3A803%3Aa88%3A3125%3A%3A125&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:11 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:11 GMT

POST
H3 200 t
dev.visualwebsiteoptimizer.com/events/ 0
36 B 31ms
30ms Ping
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=f1c0f5f4f&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empir
Requested by: Host: www.recordedfuture.com
URL: https://www.recordedfuture.com/research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv02c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: gzip
via: 1.1 google
server: gnv02c
access-control-allow-methods: GET, POST
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-headers: X-Device-User-Agent, Vwo-X-Forwarded-For
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
927 B 134ms
54ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: df386012-5432-46fe-b06e-f64fe231dce2
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: df386012-5432-46fe-b06e-f64fe231dce2
last-modified: Wed, 18 Sep 2024 02:14:11 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-hrcvg
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8c4dd2324baf4239-EWR

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 102ms
90ms XHR
application/json 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=72ee7f77cb4b22444e394d6a7b83b4f8&__hstc=57501621.72ee7f77cb4b22444e394d6a7b83b4f8.1726625651364.1726625651364.1726625651364.1&__hssc=57501621.1.1726625651364&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

287925105a8420d67f8d9f92a78503cd6245b3b503007046b70c3b37fb4483ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f8e4d166-a26f-456c-819a-b7d6dadfe237
x-envoy-upstream-service-time: 41
content-length: 1083
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f8e4d166-a26f-456c-819a-b7d6dadfe237
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.recordedfuture.com
x-evy-trace-virtual-host: all
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-7g6ml
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGN7DO00Yg9u44lCa1O0Dk%2BJQw9eu1b3p4AKAYWfK93f8sTJga%2BvODwjsHuOfVcJq8BXyp7ANIrHu1h%2F8sBh%2FrUFgOROZsFoPobT3Pp4bvc52UcddYkGnbMIVjlvg4lal9RlS2eFfWW5zWFITudB"}],"group":"cf-nel","max_age":604800}
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8c4dd23209fd0cbc-EWR

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
437 B 54ms
53ms Image
image/gif 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=880384190&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&t=%22Marko+Polo%22+Cybercrime+Group+Unveiled%3A+Infostealer+Empire+Expands+Global+Threats&cts=1726625651612&vi=72ee7f77cb4b22444e394d6a7b83b4f8&nc=true&u=57501621.72ee7f77cb4b22444e394d6a7b83b4f8.1726625651364.1726625651364.1726625651364.1&b=57501621.1.1726625651364&pt=0&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 18 Sep 2024 02:14:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a221a243-9c6c-46d5-9002-81b9620ba1fb
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a221a243-9c6c-46d5-9002-81b9620ba1fb
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T7iucBOxFD2aOot%2B8X8Zx0Vyx4ZyxUp3mlt%2F76ONwNQ0YZhzSaXWm30z7%2FDZtKwBVjpPjjar1PhtvIyptA6kvBTynH4OJ6CIHeaFKIquYe4qmA9RmDGE11hs3%2BHKwhGdgt%2BmU54aNEo2ColPgoEy"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-x6xlw
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8c4dd232afb7191e-EWR
x-robots-tag: none

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 167ms
165ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A11%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2600%3A803%3Aa88%3A3125%3A%3A125&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:12 GMT

GET
H3 200 iphone-cd1.jpg
go.recordedfuture.com/hubfs/ 83 KB
85 KB 160ms
79ms Image
image/webp 2606:2c40::c73c:6702
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.recordedfuture.com/hubfs/iphone-cd1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:6702 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-amz-meta-cache-tag: F-99167145604,P-252628,FLS-ALL
age: 1503877
x-amz-request-id: SFBVCZNH2RS9Q9MQ
x-amz-server-side-encryption: AES256
edge-cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="iphone-cd1.webp"
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
cf-bgj: imgq:85,h2pri
etag: "f5c3d1b581a50e5c3637310137a43f0e"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1674144065940
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Wed, 18 Sep 2024 02:14:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 5af3299ca59d24ce8e5b33412f754ade.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx
x-amz-cf-pop: ATL59-P7
x-hs-alternate-content-type: text/plain
cf-polished: qual=85, origFmt=jpeg, origSize=229013
x-cache: Miss from cloudfront
cache-tag: F-99167145604,P-252628,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
alt-svc: h3=":443"; ma=86400
content-length: 85082
x-amz-id-2: QQ+apipecGz7l/11COjAhacLMqcI9aZ9Sru/TBRWfJInDanrvLO4BatTPf11QU4M5HIxZ5LV4VA=
last-modified: Thu, 19 Jan 2023 16:01:07 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P0BK8%2BJfnXXkCUlSHX9P7HYLKCqNP3nuK4ldjUsrEDpF%2BQtE94dBuQPbR%2FdU%2BEhEqjCzYcd09IKFFrfpuoySBBbij27o7L0K3VDHslCkkT7PRF9hWbevXnfrJNQByZl0EvYL72dSzs6ebgQIedxeFah05Q%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8c4dd2396e8632b2-PHL
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: qlxUbP1zpHLvk2cDI-TRN9_pKxf70SiJus4T3op5W-YBzrgfK31fwA==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 40ms
39ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:13 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:13 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 31ms
31ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2600%3A803%3Aa88%3A3125%3A%3A125&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:13 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:13 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 30ms
30ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A13%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2600%3A803%3Aa88%3A3125%3A%3A125&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:14 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:14 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 30ms
30ms Image
image/gif 23.196.3.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=da48eb95-b167-4fee-88ea-31fa4f4a6682&session=fc31cec3-3de8-4f3d-8997-bc98547e2460&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2018%20Sep%202024%2002%3A14%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20the%20cybercriminal%20group%20%5C%22Marko%20Polo%5C%22%20is%20leveraging%20sophisticated%20scams%20and%20malware%20to%20target%20individuals%20and%20organizations%20worldwide.%20%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Marko%20Polo%5C%22%20Cybercrime%20Group%20Unveiled%3A%20Infostealer%20Empire%20Expands%20Global%20Threats%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fresearch%2Fmarko-polo-navigates-uncharted-waters-with-infostealer-empire&pageViewId=c6f88da3-90f0-40fd-8be8-d93f48716e8a&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&ipv6=2600%3A803%3Aa88%3A3125%3A%3A125&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.196.3.196 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-196-3-196.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.recordedfuture.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Sep 2024 02:14:15 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 18 Sep 2024 02:14:15 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.recordedfuture.com
URL: blob:https://www.recordedfuture.com/97725bc7-4766-4281-99bf-991206ab9947

Verdicts & Comments Add Verdict or Comment

134 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

47 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.recordedfuture.com/	1969-12-31 23:59:59	Name: _cfuvid Value: GaUp5w7Tv6pJGVEpAbqFXMW.OYRC9kbMpMVjPQPMN6k-1726625649904-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 08:24:08	Name: _vwo_uuid_v2 Value: DD3E82E60740FB1F891146F6C9910F14B\|33efbb20c5b51445e3f0b8bcb4089109
.recordedfuture.com/	1970-01-21 01:46:41	Name: _gcl_au Value: 1.1.1741471357.1726625651
.recordedfuture.com/	1970-01-21 08:23:02	Name: _vwo_uuid Value: DD3E82E60740FB1F891146F6C9910F14B
.recordedfuture.com/	1970-01-21 00:20:17	Name: _vwo_ds Value: 3%241726625650%3A87.79597914%3A%3A
.recordedfuture.com/	1970-01-20 23:37:07	Name: _vwo_sn Value: 0%3A1%3A%3A%3A1
.recordedfuture.com/	1970-01-21 02:01:05	Name: _vis_opt_s Value: 1%7C
.recordedfuture.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.recordedfuture.com/	1970-01-21 09:13:05	Name: __utma Value: 93161374.127677364.1726625651.1726625651.1726625651.1
.recordedfuture.com/	1969-12-31 23:59:59	Name: __utmc Value: 93161374
.recordedfuture.com/	1970-01-21 03:59:53	Name: __utmz Value: 93161374.1726625651.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.recordedfuture.com/	1970-01-20 23:37:06	Name: __utmt_sfga Value: 1
.recordedfuture.com/	1970-01-20 23:37:07	Name: __utmb Value: 93161374.1.10.1726625651
.recordedfuture.com/	1970-01-21 09:13:05	Name: _ga Value: GA1.1.160483188.1726625651
.doubleclick.net/	1970-01-21 09:13:05	Name: IDE Value: AHWqTUnmvA1w5iCyveljbWaRfv0wKC3GaiVFWpjE02pTH2b7AN1rnpbj7wijaM4X
.recordedfuture.com/	1970-01-21 01:46:41	Name: _fbp Value: fb.1.1726625651250.147136573355406267
.t.co/	1970-01-21 09:13:05	Name: muc_ads Value: 01d95def-c298-4666-a762-7875aa1a75c0
.t.co/	1970-01-20 23:37:07	Name: __cf_bm Value: 8OaXBJkf6LFVw0lr__IGBBKJWnJAv5dMYTjXj8Hl0Ok-1726625651-1.0.1.1-y8uKBZP2oC3yLi481bGIwz.VlfAsm96MSNjQbElVgS56oFSbpxhh2ET.ZJZCY4Z56m58YBZEObTVaUA62UKMOA
.twitter.com/	1970-01-21 09:13:05	Name: personalization_id Value: "v1_Q6+BNuFqgNpiyiA3jBwP0A=="
.linkedin.com/	1970-01-20 23:38:32	Name: lidc Value: "b=VGST06:s=V:r=V:a=V:p=V:g=3091:u=1:x=1:i=1726625651:t=1726712051:v=2:sig=AQGebymGtVBUBRpF1Dr_jqi_R8Ie4aJS"
.recordedfuture.com/	1970-01-21 03:56:17	Name: __hstc Value: 57501621.72ee7f77cb4b22444e394d6a7b83b4f8.1726625651364.1726625651364.1726625651364.1
.recordedfuture.com/	1970-01-21 03:56:17	Name: hubspotutk Value: 72ee7f77cb4b22444e394d6a7b83b4f8
.recordedfuture.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.recordedfuture.com/	1970-01-20 23:37:07	Name: __hssc Value: 57501621.1.1726625651364
.adnxs.com/	1970-01-21 09:13:05	Name: receive-cookie-deprecation Value: 1
www.recordedfuture.com/	1970-01-20 23:47:10	Name: _an_uid Value: 0
www.recordedfuture.com/	1970-01-21 09:13:05	Name: _gd_visitor Value: da48eb95-b167-4fee-88ea-31fa4f4a6682
www.recordedfuture.com/	1970-01-20 23:37:20	Name: _gd_session Value: fc31cec3-3de8-4f3d-8997-bc98547e2460
.linkedin.com/	1970-01-21 01:46:41	Name: li_sugr Value: a49ccbd5-b748-45c0-984a-cc9031f02b79
.linkedin.com/	1970-01-21 08:22:41	Name: bcookie Value: "v=2&14451421-3ec7-408a-8453-eb45ce58957a"
.linkedin.com/	1970-01-21 00:20:17	Name: UserMatchHistory Value: AQLOf-7u7B5n9gAAAZIC6Jr20pcDFhQXMyihRAXlRYhxzXZnaJj3pNLzyrze849Pzc09ewsc_iiJHg
.linkedin.com/	1970-01-21 00:20:17	Name: AnalyticsSyncHistory Value: AQLTCva7wB20SQAAAZIC6Jr2lBMIY-ILmIv14nsSB6xqYUJgHrQelVz8bj7gIJvj0jPQRn2l3OTuRaI0qNNUKA
.hubspot.com/	1970-01-20 23:37:07	Name: __cf_bm Value: JKAkpzt._aPSsTbcP4iZBNuqM47Og9kpPEMwrujsNR8-1726625651-1.0.1.1-g_N1T36Syt500PTJ96Z5dKWetz2yaKGntc8.h1ojZ9wBj8mxsnkzUtkdx_yXMM4KV82HyjGf0XQ1K7MfnL_UUQ
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: StA5j.NiBlwd9epj4aUQo6khnLxyZOOIOydtmS4brDY-1726625651513-0.0.1.1-604800000
.www.linkedin.com/	1970-01-21 08:22:41	Name: bscookie Value: "v=1&20240918021411130a0e79-d9da-4307-8b2e-df93eeb498b7AQERHgjzO-chb-LGYtHXjyO2jHKzdMF1"
.hsforms.com/	1970-01-20 23:37:07	Name: __cf_bm Value: guz8RUcyi3WHUM87ssTfLF_VIK2tOs38AXZSONv_nxQ-1726625651-1.0.1.1-g7t7GhAo6QY8MN.G11J4PBD9AYVJ8GQLNi_YkpecsvvRBIMobFkwiLDjfwjeBt6WX_PBZ3HQWF1WKtZgvQxGxw
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: .WnGZ0TpZ40v29P63rEOgKKQn7jo7mUagr.UfiesQLs-1726625651592-0.0.1.1-604800000
.recordedfuture.com/	1970-01-21 09:13:05	Name: _ga_MHTMF48BZH Value: GS1.1.1726625651.1.0.1726625651.60.0.0
.go.recordedfuture.com/	1970-01-20 23:37:07	Name: __cf_bm Value: Ve4f2gDHh4UpwyKAOdKg9gAj2DvEkvtJwqcN8uNeOak-1726625652-1.0.1.1-mlK06jmG45QEq3b6a2WvfdXNjbLq.9gCOE2cOOpM7if4BBUwClbBDmbXdRanMVyJ55H3mnL642UKoqCq9I5_vg
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: __cfruid Value: 9637221616f9ab7150613ff099439b48b2bbfb2a-1726625652
.recordedfuture.com/	1970-01-20 23:38:32	Name: source Value: (direct)
.recordedfuture.com/	1970-01-20 23:38:32	Name: medium Value: (none)
.recordedfuture.com/	1970-01-20 23:38:32	Name: content Value: undefined
.recordedfuture.com/	1970-01-20 23:38:32	Name: keyword Value: undefined
.recordedfuture.com/	1970-01-20 23:38:32	Name: campaign Value:
.recordedfuture.com/	1970-01-20 23:38:32	Name: landing_page Value: /research/marko-polo-navigates-uncharted-waters-with-infostealer-empire
.recordedfuture.com/	1970-01-20 23:38:32	Name: conversion_page Value: /research/marko-polo-navigates-uncharted-waters-with-infostealer-empire

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/research.json?slug=research Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.recordedfuture.com/_next/data/kN6_LMFWg85Gf9jhziAkl/services-support/client-success.json Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
analytics.google.com
analytics.twitter.com
b.6sc.co
c.6sc.co
cdn.matomo.cloud
cms.recordedfuture.com
connect.facebook.net
cta-service-cms2.hubspot.com
dev.visualwebsiteoptimizer.com
epsilon.6sense.com
forms.hubspot.com
go.recordedfuture.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
js.hubspot.com
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
recordedfuture.matomo.cloud
secure.adnxs.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
td.doubleclick.net
track.hubspot.com
www.facebook.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.recordedfuture.com
www.recordedfuture.com
104.18.35.90
104.244.42.195
13.107.42.14
13.248.142.121
146.75.36.157
151.101.2.216
172.66.0.227
18.157.122.248
2001:4860:4802:32::181
23.196.3.196
2600:141b:1c00:2e::17d1:48d1
2600:141b:1c00:6::17df:d105
2600:9000:24f0:2400:c:7d55:b3c0:93a1
2606:2c40::c73c:6702
2606:4700:4400::ac40:9310
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:89d1
2606:4700::6811:afc9
2606:4700::6812:8b11
2606:4700::6813:afbc
2607:f8b0:4004:c06::9d
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80d::200a
2607:f8b0:4006:817::2002
2607:f8b0:4006:81e::2008
2607:f8b0:4006:821::2004
2620:1ec:21::14
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
34.96.102.137
68.67.161.208
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
01162dac953bb3e78b5d5f9634fc5dfade6efcfb45cf30aeb7125c38d352abf7
027148651049c1d7b2bc928eea421669ca0d15d331ac679b7277f6ec0f98df8b
03deb7f9afb221dd4f9c499ba993135331b0492478d6d16f72264fde9cac2ac1
04eba456b89f1e241ebcaade66c3c3b1fcb9fffce61e00c7ec3a46f0da5608bc
059b77025c02623999e7524b737287072bd2dbb42c1652f70a4020338b1e5f21
0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd
1083d5cb2cd087192da0c3af0c597782f089c76c4a49c578dc1426d90e8afd76
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
172d1e3c55a0d4632b33416ce6d444126009f0f09c1bfd504c66096f8cce8adb
1a57cec26655d086a0fdbcd57c6901c7f8704b66ca7b517f9912fe65796c6dd4
1b7ab22cdfb33b1ca4a7b1042cd5c8b12cabc5df338d2c75c37a8b48a737a6ff
1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183
1d441d3291c595de79459b33a46d24844b8b6d9a8a9cdb17e86d3a462c35df9e
287925105a8420d67f8d9f92a78503cd6245b3b503007046b70c3b37fb4483ca
2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde
2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470
2cab74f1607601d8773a9cb4f1cd1758d19d73aaae4b32ffad62b672fb5a440c
2df38ca14e1da3009e84718fff2e4fb5686f569e6d2bf3d61f392ff5db369024
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
352c70833fa552b3a6e00d52ebe78f576dce0df36e4c1e4e3d047b7eb67bdc1c
361f4d7382416dd2d57e473d0d0c17cf8353de936e7bc2d740cdf0ed2306f321
3638ac58690004bcc362c1b9dde0e0c4763dc1503a34a69780f33ff0c6536cb3
3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa
420399d77394cb1434bb36a8a18b30f84bac89f92d3e6c757091612d3c564827
43f20d0a51f32376a232ae9fbc41e803d09610000eacfe5b851bc46e191be5ff
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4512d280d6e3770022a6aced807c4b08d410ae107294c0ac19801ad24f6ef0f5
494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
59fc82d994a33a650be64d5d091a9c951c4e114046bea78c51f3d34771a60831
5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636
5dd46059902b99d86c42588668824486114180f5e1c385cb504a23e53b2d7bef
5fb675729c9065818c208dd27f067e0c3b1772918af3166d4992beea43041c53
642d3084f11c63d1192371cec7eaec8b1cad94923c2b4bfd8ff223e63695017f
67873f7881c232f0fb083823b6e578789317251d231a168b5a6fba860bc1f892
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6af2f3db57e956ffc58005b59e427115165532d049d091f4385d8594247098f1
6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082
712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f
735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b
759e36cb664b0ced90bc0d5f414df8545d40356551050e05790f90f74238ef67
7c50296589d6433f84936923ffd29636e28511969db10f3a12f84ef86340b702
7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8436eca0869a9ebe51c7cdf6e09ba3203239f68d3e1efd1e47c02f5ca3a72121
858cc68259d82c762aa20e8b2b8a015d61c7a026605bfb800ca896b62e528d58
87a7f873f45e72f6baf1e3853e62bce0f7132aeb48019b222fa1895de71d498d
8856d6269cb3d6130964505bd0ff1c9e242ddcf440da74edc075ec376cb346ba
88cb17803f855ba27baf3e10ef02d8b74166f0dc9398687e968224c5d6e72734
8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa
91203e702b388668ba42c7929309e90d45cf23900e4c9c37e8da706dcd1550ff
95c8d0c5a31279e62a9f12a62b205711dde30faf2582757f58039ad5142c05e9
a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3
a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070
a3f9811ae39889ebe6ee1f093c9d9b03da850ffe16faba91851ad03ab44c30ef
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aad905511c5ea6856220f79c4f46f62996ee6d9b2bd03cefc2b9eca04405a7ea
ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a
ac1f512b1788cec6dc44d9420f52de7cd45f93a8dd6a7ef105a99f31a51e8c29
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad2ad0fbe16dc54a407d9375acd456e68e81fb4e007efe1d237f67bf7f4eda1d
b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca
b9daf092e8250f7cb6cd4922a4f62868894b55f8c612ccaf7cca5a84338388d9
bde338bd3b5934c83601300b78f1ec86b2fcae1d9b8996e84aa2df25cad26db8
c060a69ff8c4146db57484eb560a78880b6011d87a3663044631d56e5478c1ec
c1233a49c4ecec12fed969bc83cd6ba59d8b2b88bef31988d9384f7e54c42e20
c2d02d5f5b95c51c99da75486561f118d1945d1c5bdff3166cd68f89f42241ad
c75f8c06d78926e0624b04af9e6d0fb3339cb4b52ff00034661ca8f0c29d81c4
d469a9457bead595aeb407aeabce5a6fe021037dfd053ec63232e5a6db9cced4
d8d1a08222c672eb0f696a4127a20f227db8f1a464448dd72f2534dd8ca2d268
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd0aa2edbf70120a3664d67d62c7be974905b21305d74bf06b58d4570bb81dc7
dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8
f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225
f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff64328b5dacc7701647dc8159d3ea754397e1a117ac5629986f890f106077e0

www.recordedfuture.com Open in urlscan Pro 104.18.35.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

106 Requests

98 %HTTPS

67 %IPv6

24 Domains

38 Subdomains

34 IPs

3 Countries

2376 kBTransfer

7262 kBSize

47 Cookies

10 Outgoing links

Redirected requests

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.recordedfuture.com Open in urlscan Pro
104.18.35.90 Public Scan

Screenshot
Live screenshot

Full Image

106
Requests

98 %
HTTPS

67 %
IPv6

24
Domains

38
Subdomains

34
IPs

3
Countries

2376 kB
Transfer

7262 kB
Size

47
Cookies

106 HTTP transactions
0 data transactions